Edit tour

Windows Analysis Report
LocalPlayback.exe

Overview

General Information

Sample name:	LocalPlayback.exe
Analysis ID:	1541117
MD5:	ef3eafbf2d877473b2802e1add2857ad
SHA1:	c60a150229844a0f1822556700c6a8cefd683a30
SHA256:	88fcc295ae1a01ca93de900d4fd56411dbf197453d07e2c109faa714558bf81b
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	49
Range:	0 - 100

Signatures

PE file has a writeable .text section

Registers a new ROOT certificate

Checks for available system drives (often done to infect USB drives)

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Use Short Name Path in Command Line

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

LocalPlayback.exe (PID: 1412 cmdline: "C:\Users\user\Desktop\LocalPlayback.exe" MD5: EF3EAFBF2D877473B2802E1ADD2857AD)

ISBEW64.exe (PID: 7172 cmdline: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F60EF52-B8AE-4C65-B672-4ECBA9C7EF64} MD5: 1AE40C548AE265EFF8D25EA7538A5196)

ISBEW64.exe (PID: 7204 cmdline: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DEBE9773-6CCB-402A-A045-44F23FC2C3BA} MD5: 1AE40C548AE265EFF8D25EA7538A5196)

ISBEW64.exe (PID: 7236 cmdline: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E46B7176-3FFC-40C6-B559-180C9F23E714} MD5: 1AE40C548AE265EFF8D25EA7538A5196)

ISBEW64.exe (PID: 7268 cmdline: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E5BF0CED-81A6-4ECC-9E75-24C1C03367D2} MD5: 1AE40C548AE265EFF8D25EA7538A5196)

ISBEW64.exe (PID: 7300 cmdline: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{83415305-25EC-4DB0-8231-2F0B7AC0579F} MD5: 1AE40C548AE265EFF8D25EA7538A5196)

ISBEW64.exe (PID: 7400 cmdline: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3309AE38-3356-4998-B51D-DDEA1CA316CD} MD5: 1AE40C548AE265EFF8D25EA7538A5196)

vcredist_x86.exe (PID: 8120 cmdline: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe /q MD5: 0FC525B6B7B96A87523DAA7A0013C69D)

vcredist_x86.exe (PID: 7224 cmdline: "C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe" /q -burn.unelevated BurnPipe.{DBEA4BDC-32D1-4571-8C40-9D2304124BE9} {91C7A57E-FB61-4624-AACC-1188F529C9A7} 8120 MD5: 0FC525B6B7B96A87523DAA7A0013C69D)

msiexec.exe (PID: 7236 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

vcredist_x64_2013.exe (PID: 1876 cmdline: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe /q MD5: 385194EB89B6741781CB9065D8E8158E)

vcredist_x64_2013.exe (PID: 6008 cmdline: "C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe" /q -burn.unelevated BurnPipe.{0942DD9A-AF4A-432E-BD2D-A92FFBEDB9E9} {F3730AF5-9EE5-4B54-A568-50E8BA9679B4} 1876 MD5: 385194EB89B6741781CB9065D8E8158E)

LocalPlayback.exe (PID: 5600 cmdline: "C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe" MD5: 7DE44B22F47E7F2B625C6A3611FE7471)

SrTasks.exe (PID: 8088 cmdline: C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1 MD5: 2694D2D28C368B921686FE567BD319EB)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vcredist_x86.exe (PID: 4376 cmdline: "C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe" /burn.runonce MD5: 2335AB0C0E19C0EF416D07DF66FEE649)

vcredist_x86.exe (PID: 4704 cmdline: "C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe" MD5: 2335AB0C0E19C0EF416D07DF66FEE649)

cleanup

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F60EF52-B8AE-4C65-B672-4ECBA9C7EF64}, CommandLine: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F60EF52-B8AE-4C65-B672-4ECBA9C7EF64}, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe, ParentCommandLine: "C:\Users\user\Desktop\LocalPlayback.exe", ParentImage: C:\Users\user\Desktop\LocalPlayback.exe, ParentProcessId: 1412, ParentProcessName: LocalPlayback.exe, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F60EF52-B8AE-4C65-B672-4ECBA9C7EF64}, ProcessId: 7172, ProcessName: ISBEW64.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe" /burn.runonce, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe, ProcessId: 8120, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{f65db027-aff3-4070-886a-0d87064aabb1}

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T13:01:17.260694+0200	2803305	3	Unknown Traffic	192.168.2.7	49983	49.51.129.211	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0045439B __EH_prolog3_GS,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,CryptHashData,CryptHashData,GetLastError,_memmove,CryptImportPublicKeyInfo,GetLastError,CryptVerifySignatureW,	2_2_0045439B
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00453F68 __EH_prolog3_GS,CryptAcquireCertificatePrivateKey,GetLastError,CryptCreateHash,GetLastError,CryptHashData,CryptHashData,CryptHashData,CryptSignHashW,CryptSignHashW,CryptSignHashW,GetLastError,GetLastError,WriteFile,WriteFile,WriteFile,	2_2_00453F68
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00447378 _memset,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,ReadFile,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,GetLastError,CryptDestroyHash,CryptReleaseContext,	19_2_00447378
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00428101 CryptHashPublicKeyInfo,GetLastError,	19_2_00428101
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00428386 DecryptFileW,	19_2_00428386
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00427E2A _memset,CryptCATAdminCalcHashFromFileHandle,GetLastError,GetLastError,CryptCATAdminCalcHashFromFileHandle,GetLastError,WinVerifyTrust,WinVerifyTrust,WinVerifyTrust,	19_2_00427E2A
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003E7378 _memset,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,ReadFile,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,GetLastError,CryptDestroyHash,CryptReleaseContext,	22_2_003E7378
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003C8101 CryptHashPublicKeyInfo,GetLastError,	22_2_003C8101
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003C8386 DecryptFileW,	22_2_003C8386
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003C7E2A _memset,CryptCATAdminCalcHashFromFileHandle,GetLastError,GetLastError,CryptCATAdminCalcHashFromFileHandle,GetLastError,WinVerifyTrust,WinVerifyTrust,WinVerifyTrust,	22_2_003C7E2A
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F28386 DecryptFileW,	27_2_00F28386
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F28101 CryptHashPublicKeyInfo,GetLastError,	27_2_00F28101
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F47378 _memset,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,ReadFile,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,GetLastError,CryptDestroyHash,CryptReleaseContext,	27_2_00F47378
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F27E2A _memset,CryptCATAdminCalcHashFromFileHandle,GetLastError,GetLastError,CryptCATAdminCalcHashFromFileHandle,GetLastError,WinVerifyTrust,WinVerifyTrust,WinVerifyTrust,	27_2_00F27E2A

Source: LocalPlayback.exe, 0000001E.00000002.2571774893.000000006B4F0000.00000002.00000001.01000000.00000021.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_66f99156-0

Compliance

Uses 32bit PE files

Source: LocalPlayback.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	File created: C:\Users\user~1\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\license.rtf
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	File created: C:\Users\user~1\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\license.rtf
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	File created: C:\Users\user~1\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\license.rtf
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	File created: C:\Users\user~1\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\license.rtf

PE / OLE file has a valid certificate

Source: LocalPlayback.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Users\user\Desktop\LocalPlayback.exe

File opened: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\msvcr90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: Nsd.pdb' source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_Tool_BaseLine_Tools3\code\target\vs2013\ToolShareModule\ToolShareModule.pdb source: LocalPlayback.exe, 0000001E.00000002.2575260611.000000006C8F8000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: .pdb? source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Project\2018NewVersionTools\UpgradeTool\code\target\UpgradeTool\Upgrade.pdb source: LocalPlayback.exe, 0000001E.00000002.2574995176.000000006C8CA000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: qddsd.pdbEScritOpedm source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\CodeBases\isdev\redist\Language Independent\i386\ISP\setup.pdb source: LocalPlayback.exe, 00000002.00000000.1288293705.00000000004AD000.00000002.00000001.01000000.00000004.sdmp, LocalPlayback.exe, 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: qtgad.pdbEScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdb source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424912060.0000000005C0D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: `C:\Program Files (x86)\LocalPlayback\Standard\\sqlpsql.pdb source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\platforms\qwindowsd.pdbbddll} source: LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_Tool_BaseLine_Tools3\code\target\VS2013\ToolGuiToolkit\ToolGuiToolkit.pdb source: LocalPlayback.exe, 0000001E.00000002.2573472697.000000006BE0A000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qwbmp.dll.pdb source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: `C:\Program Files (x86)\LocalPlayback\plugins\\indowsd.pdbws.ll source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qgifd.pdbl source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424912060.0000000005C0D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Project\2018NewVersionTools\UpgradeTool\code\target\UpgradeTool\Upgrade.pdb(( source: LocalPlayback.exe, 0000001E.00000002.2574995176.000000006C8CA000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysqld.pdbltmpI source: LocalPlayback.exe, 00000002.00000003.2169399913.0000000005A92000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435360519.0000000005A92000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2427166168.0000000005A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xC:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdb. source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\PROJ\hpr\hpr_svn\lib\vs2008\hpr.pdb source: LocalPlayback.exe, 0000001E.00000002.2572733998.000000006BB42000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: qwebpd.pdbScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.pdb source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qwbmpd.pdbScritOpedJ;^ source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: `C:\Program Files (x86)\LocalPlayback\plugins\\indowsd.pdb source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdbH source: vcredist_x86.exe, 0000001C.00000002.2561765338.00000000700E5000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: qminimald.pdbritOped&;2 source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qtiffd.pdb source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb source: vcredist_x86.exe, 00000013.00000000.1787811525.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000013.00000002.1873216538.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000013.00000003.1807866305.0000000000F47000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 00000014.00000002.1873113180.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000014.00000000.1791920978.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x64_2013.exe, 00000016.00000002.1937952943.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000016.00000000.1876182782.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000017.00000002.1938343186.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000017.00000000.1877246310.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x86.exe, 0000001B.00000002.1943499977.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001B.00000000.1932728808.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001C.00000002.2559508643.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001C.00000000.1936608719.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qjpegd.pdb source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_Tool_BaseLine_Tools3\code\target\VS2013\LocalPlayback\LocalPlayback.pdb source: LocalPlayback.exe, 0000001E.00000000.2168265549.0000000000D2C000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Compiler_SDK_HDFile_Win32\win\VS2013\Release\HDFileSDK.pdb source: LocalPlayback.exe, 0000001E.00000002.2573042521.000000006BCCB000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdbw source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_Tool_BaseLine_Tools3\code\target\vs2013\CommonSkin\CommonSkin.pdb source: LocalPlayback.exe, 0000001E.00000002.2568990669.000000006ADBD000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdb source: vcredist_x86.exe, 0000001C.00000002.2561765338.00000000700E5000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: qwbmpd.pdbXP1 source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qicod.pdbcod.llb source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysqld.pdb.lll source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\work\SuperRender\0000000\bin\win32\Private_PDB32\SuperRender.pdb8 ' source: LocalPlayback.exe, 0000001E.00000002.2561255132.0000000001267000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: qwindowsd.pdbritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\platforms\qoffscreend.pdb source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixDepCA.pdb source: vcredist_x86.exe, 00000013.00000003.1819940196.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 00000013.00000003.1815835578.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64_2013.exe, 00000016.00000003.1898813039.0000000000953000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64_2013.exe, 00000016.00000003.1901279866.000000000098E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qwebp.dll.pdb source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_SDK_HCNetUtils_win32\common\HCNetUtils\win32\lib\HCNetUtils.pdb source: LocalPlayback.exe, 0000001E.00000002.2570472714.000000006B205000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qwebpd.pdb source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qwbmpd.pdbt source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlited.pdbb source: LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdb.dldbA source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\work\SuperRender\0000000\bin\win32\Private_PDB32\SuperRender.pdb source: LocalPlayback.exe, 0000001E.00000002.2561255132.0000000001267000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qtiff.dll.pdb source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qicnsd.pdbScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: _isres_0x0409.dlllayout.bindata1.hdrdata1.cabsetup.exeISSetup.dll0x0804.ini0x0409.inisetup.iniAnalyzeData.dllAudioRender.dllcalib.dllD3DCompiler_43.dllD3DX9_43.dllEagleEyeRender.dllgdiplus.dllHCCore.dllHCNetSDK.dllHCNetUtils.dllHDFileSDK.dllhpr.dllHWDecode.dlliconv.dlllibxml2.dllLocalPlayback.exeLocalPlayback.ism.771LocalXml.zipMP_Render.dllMP_VIE.dllOpenAL32.dllPlayCtrl.dllQt5Core.dllQt5Gui.dllQt5Network.dllQt5PrintSupport.dllQt5Widgets.dllQt5Xml.dllSettings.xmlSuperRender.dllToolGuiToolkit.dllToolShareModule.dllToolShareModule.libUpgrade.dllUpgrade.xmlYUVProcess.dllzlib1.dllAudioIntercom.dllDsSdk.dllHCAlarm.dllHCAlarm.libHCCoreDevCfg.dllHCDisplay.dllHCGeneralCfgMgr.dllHCGeneralCfgMgr.libHCIndustry.dllHCPlayBack.dllHCPreview.dllHCPreview.libHCVoiceTalk.dlllibiconv2.dllmsvcr90.dllStreamTransClient.dllSystemTransform.dllqdds.dllqddsd.dllqddsd.pdbqgif.dllqgifd.dllqgifd.pdbqicns.dllqicnsd.dllqicnsd.pdbqico.dllqicod.dllqicod.pdbqjpeg.dllqjpegd.dllqjpegd.pdbqsvg.dllqsvgd.dllqsvgd.pdbqtga.dllqtgad.dllqtgad.pdbqtiff.dllqtiffd.dllqtiffd.pdbqwbmp.dllqwbmpd.dllqwbmpd.pdbqwebp.dllqwebpd.dllqwebpd.pdbqminimal.dllqminimald.dllqminimald.pdbqoffscreen.dllqoffscreend.dllqoffscreend.pdbqwindows.dllqwindowsd.dllqwindowsd.pdbqsqlite.dllqsqlited.dllqsqlited.pdbqsqlmysql.dllqsqlmysqld.dllqsqlmysqld.pdbqsqlpsql.dllqsqlpsqld.dllqsqlpsqld.pdbLocalPlayback_en.qmLocalPlayBack_en.tsLocalPlayback_zh.qmLocalPlayBack_zh.tsqt_en.qmqt_zh_CN.qmToolGuiToolkit_en.qmToolGuiToolkit_en.tsToolGuiToolkit_zh.qmToolGuiToolkit_zh.tsToolShareModule_en.qmToolShareModule_en.tsToolShareModule_zh.qmToolShareModule_zh.ts,g0W source: LocalPlayback.exe, 00000002.00000003.2197605938.0000000000855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb source: LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp, ISBEW64.exe, 00000006.00000002.2196188784.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000006.00000000.1332346457.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000007.00000002.1335450557.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000007.00000000.1333414243.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000008.00000000.1334155324.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000008.00000002.1336690488.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000009.00000002.1338208405.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000009.00000000.1334838319.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 0000000A.00000000.1335823221.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 0000000A.00000002.1338230664.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 0000000B.00000002.2171021829.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 0000000B.00000000.1389523104.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qsvgd.pdbpg.llg source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qgifd.pdbEScritOpedn;z source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: setup.inxlicense.rtfSetup.xmlvcredist_x64_2013.exevcredist_x86.exeFontData.iniDIFxData.inicorecomp.inidotnetinstaller.exedotnetinstaller.exe.configISBEW64.exeStringTable_0x0804.ipsStringTable_0x0409.ipsisrt.dlldefault.pal_isres_0x0804.dll_isres_0x0409.dlllayout.bindata1.hdrdata1.cabsetup.exeISSetup.dll0x0804.ini0x0409.inisetup.iniAnalyzeData.dllAudioRender.dllcalib.dllD3DCompiler_43.dllD3DX9_43.dllEagleEyeRender.dllgdiplus.dllHCCore.dllHCNetSDK.dllHCNetUtils.dllHDFileSDK.dllhpr.dllHWDecode.dlliconv.dlllibxml2.dllLocalPlayback.exeLocalPlayback.ism.771LocalXml.zipMP_Render.dllMP_VIE.dllOpenAL32.dllPlayCtrl.dllQt5Core.dllQt5Gui.dllQt5Network.dllQt5PrintSupport.dllQt5Widgets.dllQt5Xml.dllSettings.xmlSuperRender.dllToolGuiToolkit.dllToolShareModule.dllToolShareModule.libUpgrade.dllUpgrade.xmlYUVProcess.dllzlib1.dllAudioIntercom.dllDsSdk.dllHCAlarm.dllHCAlarm.libHCCoreDevCfg.dllHCDisplay.dllHCGeneralCfgMgr.dllHCGeneralCfgMgr.libHCIndustry.dllHCPlayBack.dllHCPreview.dllHCPreview.libHCVoiceTalk.dlllibiconv2.dllmsvcr90.dllStreamTransClient.dllSystemTransform.dllqdds.dllqddsd.dllqddsd.pdbqgif.dllqgifd.dllqgifd.pdbqicns.dllqicnsd.dllqicnsd.pdbqico.dllqicod.dllqicod.pdbqjpeg.dllqjpegd.dllqjpegd.pdbqsvg.dllqsvgd.dllqsvgd.pdbqtga.dllqtgad.dllqtgad.pdbqtiff.dllqtiffd.dllqtiffd.pdbqwbmp.dllqwbmpd.dllqwbmpd.pdbqwebp.dllqwebpd.dllqwebpd.pdbqminimal.dllqminimald.dllqminimald.pdbqoffscreen.dllqoffscreend.dllqoffscreend.pdbqwindows.dllqwindowsd.dllqwindowsd.pdbqsqlite.dllqsqlited.dllqsqlited.pdbqsqlmysql.dllqsqlmysqld.dllqsqlmysqld.pdbqsqlpsql.dllqsqlpsqld.dllqsqlpsqld.pdbLocalPlayback_en.qmLocalPlayBack_en.tsLocalPlayback_zh.qmLocalPlayBack_zh.tsqt_en.qmqt_zh_CN.qmToolGuiToolkit_en.qmToolGuiToolkit_en.tsToolGuiToolkit_zh.qmToolGuiToolkit_zh.tsToolShareModule_en.qmToolShareModule_en.tsToolShareModule_zh.qmToolShareModule_zh.ts,g0W source: LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196340763.000000000084F000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2188207802.0000000000844000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qsqlited.pdbcritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.pdbimage/~ source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlpsqld.pdb@ source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qsqlpsqld.pdbritOped$%4 source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qicnsd.pdbrmdlll source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qddsd.pdbformdll source: LocalPlayback.exe, 00000002.00000003.2198116230.000000000082E000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2189404783.000000000082C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qtgad.pdbp.dl source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /LocalPlayback/imageformats/qwebpd.pdb' source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\AudioRender0\WindowsAudio2\bin\win32\Private_PDB32\AudioRender.pdb =k source: LocalPlayback.exe, 0000001E.00000002.2571115843.000000006B3C9000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: qsvgd.pdbEScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :/aptui/complex/Images/System/Complex/date.pngtgad.pdb source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qsqlmysqld.pdbtOpedX:P source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@F source: vcredist_x86.exe, 00000013.00000000.1787811525.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000013.00000002.1873216538.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000014.00000002.1873113180.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000014.00000000.1791920978.000000000044A000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: kqsvgd.pdb source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@E source: vcredist_x86.exe, 00000013.00000003.1807866305.0000000000F47000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@@ source: vcredist_x64_2013.exe, 00000016.00000002.1937952943.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000016.00000000.1876182782.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000017.00000002.1938343186.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000017.00000000.1877246310.00000000003EA000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_Tool_BaseLine_Tools3\code\target\vs2013\CommonSkin\CommonStyle.pdb source: LocalPlayback.exe, 0000001E.00000002.2575854670.000000006FF59000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qwbmpd.pdb source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\AudioRender0\WindowsAudio2\bin\win32\Private_PDB32\AudioRender.pdb source: LocalPlayback.exe, 0000001E.00000002.2571115843.000000006B3C9000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: qjpegd.pdbScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qtiffd.pdbScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kegd.pdbX source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\platforms\qminimald.pdb source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qoffscreend.pdbtOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qjpegd.pdb source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424912060.0000000005C0D000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.pdbe Q source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdb3 source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qicod.pdbEScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@ source: vcredist_x86.exe, 0000001B.00000002.1943499977.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001B.00000000.1932728808.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001C.00000002.2559508643.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001C.00000000.1936608719.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00424C8F __EH_prolog3_GS,FindFirstFileW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrlenW,lstrcpyW,lstrcatW,SysStringLen,lstrcatW,GetFileAttributesW,lstrcatW,lstrcmpiW,lstrcpynW,lstrcmpiW,lstrcmpiW,SysStringLen,lstrcmpiW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,LZOpenFileW,LZOpenFileW,LZCopy,LZClose,LZClose,DeleteFileW,lstrcpyW,	2_2_00424C8F
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0045145E __EH_prolog3_GS,FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,RemoveDirectoryW,__CxxThrowException@8,DeleteFileW,	2_2_0045145E
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0044F772 GetProcAddress,SearchPathW,GetModuleFileNameW,FindFirstFileW,VirtualQuery,VirtualProtect,VirtualProtect,	2_2_0044F772
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0042BF7F FindFirstFileW,GetFileAttributesW,SetFileAttributesW,DeleteFileW,	2_2_0042BF7F
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00428BE8 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	19_2_00428BE8
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_004466A3 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	19_2_004466A3
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00445710 _memset,FindFirstFileW,FindClose,	19_2_00445710
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003C8BE8 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	22_2_003C8BE8
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003E66A3 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	22_2_003E66A3
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003E5710 _memset,FindFirstFileW,FindClose,	22_2_003E5710
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F466A3 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	27_2_00F466A3
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F28BE8 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	27_2_00F28BE8
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F45710 _memset,FindFirstFileW,FindClose,	27_2_00F45710
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 28_2_700DA685 _memset,FindFirstFileW,FindClose,	28_2_700DA685

Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe

Code function: 30_2_00C51A50 GetLogicalDrives,??0QByteArray@@QAE@XZ,??0QMessageBox@@QAE@PAVQWidget@@@Z,GetLogicalDriveStringsW,memset,GetDriveTypeW,?allocate@QArrayData@@SAPAU1@IIIV?$QFlags@W4AllocationOption@QArrayData@@@@@Z,?data@QArrayData@@QAEPAXXZ,??1QMessageBox@@UAE@XZ,??1QString@@QAE@XZ,?data@QArrayData@@QAEPAXXZ,?data@QArrayData@@QAEPAXXZ,?deallocate@QArrayData@@SAXPAU1@II@Z,

30_2_00C51A50

Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\FontData.ini	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Networking

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /4200/tool/windows/LocalPlayback/package.json HTTP/1.1Host: hikdownload.hik-connect.com

Suricata IDS alerts with low severity for network traffic

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49983 -> 49.51.129.211:80

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe

Code function: 19_2_00436994 InternetReadFile,WriteFile,WriteFile,GetLastError,GetLastError,

19_2_00436994

Source: global traffic

HTTP traffic detected: GET /4200/tool/windows/LocalPlayback/package.json HTTP/1.1Host: hikdownload.hik-connect.com

Source: LocalPlayback.exe, 0000001E.00000002.2571774893.000000006B4F0000.00000002.00000001.01000000.00000021.sdmp

String found in binary or memory: Ok04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)

Source: global traffic

DNS traffic detected: DNS query: hikdownload.hik-connect.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 11:01:17 GMTContent-Type: text/html; charset=UTF-8Content-Length: 242Connection: keep-aliveServer: TengineData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body bgcolor="white"><h1>404 Not Found</h1><p>The requested URL was not found on this server.<hr/>Powered by Tengine</body></html>

Source: LocalPlayback.exe, 00000002.00000000.1288293705.00000000004AD000.00000002.00000001.01000000.00000004.sdmp, LocalPlayback.exe, 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://=0x%04x.iniMS
Source: LocalPlayback.exe, 0000001E.00000002.2571774893.000000006B4F0000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://bugreports.qt.io/
Source: LocalPlayback.exe, 0000001E.00000002.2571774893.000000006B4F0000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://bugreports.qt.io/finishedServerMicrosoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogic
Source: LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: LocalPlayback.exe, 00000002.00000003.2197605938.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://deviis4.installshield.com/NetNirvana/
Source: LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196340763.000000000084F000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2188207802.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://deviis4.installshield.com/NetNirvana/m
Source: LocalPlayback.exe, 0000001E.00000002.2563943582.00000000035A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hikdownload.hik-connect.com.pngloseView.pngr.Q
Source: LocalPlayback.exe, 0000001E.00000002.2565211131.0000000003A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hikdownload.hik-connect.com/4200/tool/windows/LocalPlayback/v/standard/en/LocalPlayback
Source: LocalPlayback.exe, 0000001E.00000002.2565211131.0000000003A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hikdownload.hik-connect.com/4200/tool/windows/LocalPlayback/v/standard/en/LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2565211131.0000000003A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hikdownload.hik-connect.com/4200/tool/windows/LocalPlayback/v/standard/en/LocalPlayback.exeF
Source: LocalPlayback.exe, 0000001E.00000002.2564948444.0000000003917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.co
Source: LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://qt-project.org/xml/features/report-start-end-entity
Source: LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://qt-project.org/xml/features/report-whitespace-only-CharData
Source: LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://trolltech.com/xml/features/report-start-end-entity
Source: LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://trolltech.com/xml/features/report-whitespace-only-CharData
Source: LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: vcredist_x86.exe, 00000014.00000003.1868826765.0000000002ADB000.00000004.00000800.00020000.00000000.sdmp, vcredist_x86.exe, 00000014.00000003.1869418883.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 00000014.00000003.1793238511.000000000062F000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64_2013.exe, 00000017.00000003.1934969780.00000000018B0000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64_2013.exe, 00000017.00000003.1933566497.000000000391B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x86.exe, 0000001B.00000003.1935920151.0000000000652000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 0000001C.00000002.2560839508.0000000002E60000.00000004.00000800.00020000.00000000.sdmp, vcredist_x86.exe, 0000001C.00000002.2556580978.0000000000920000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 0000001C.00000003.1938300398.00000000009AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: vcredist_x64_2013.exe, 00000017.00000003.1933566497.000000000391B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010cessR
Source: vcredist_x64_2013.exe, 00000017.00000003.1933566497.000000000391B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010o
Source: LocalPlayback.exe, 00000002.00000003.1336775342.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.company.com
Source: LocalPlayback.exe, 00000002.00000003.1337188638.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2433505889.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424468858.0000000002B83000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1337342198.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2195158245.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1337050034.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197888428.0000000002B83000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1336897127.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2428892620.0000000002B83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.company.comt
Source: LocalPlayback.exe, 00000002.00000003.1337342198.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424684901.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2190273382.0000000005CAF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2186596203.0000000005CA2000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436551431.0000000005CB1000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1329950331.0000000002B70000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1965739685.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1965894729.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1964381135.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2170880571.0000000005CA2000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2198375398.0000000005CAF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197831927.0000000005CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hikvision.com
Source: LocalPlayback.exe, 00000002.00000003.2196340763.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hikvision.com4
Source: LocalPlayback.exe, 00000002.00000003.2424684901.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436551431.0000000005CB1000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2198375398.0000000005CAF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197831927.0000000005CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hikvision.comCT
Source: LocalPlayback.exe, 00000002.00000003.2424684901.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436551431.0000000005CB1000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2198375398.0000000005CAF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197831927.0000000005CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hikvision.comER
Source: LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2188207802.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hikvision.comX
Source: LocalPlayback.exe, 00000002.00000003.1313616804.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1304570653.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1303819742.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1315533478.00000000007EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hikvision.comal
Source: LocalPlayback.exe, 00000002.00000003.2195158245.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197888428.0000000002B83000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2200256507.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hikvision.coml=%ld
Source: LocalPlayback.exe, LocalPlayback.exe, 00000002.00000000.1288293705.00000000004AD000.00000002.00000001.01000000.00000004.sdmp, LocalPlayback.exe, 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmp, LocalPlayback.exe, 00000002.00000003.1329950331.0000000002B70000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1965739685.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1965894729.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1313616804.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1964381135.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1302943701.0000000002920000.00000040.00001000.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1304570653.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1303819742.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1315533478.00000000007EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d
Source: LocalPlayback.exe, 0000001E.00000002.2571774893.000000006B4F0000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.phreedom.org/md5)
Source: LocalPlayback.exe, 0000001E.00000002.2571774893.000000006B4F0000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.phreedom.org/md5)08:27
Source: LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaceshttp://xml.org/sax/features/namespace-prefixeshttp://trolltech

Key, Mouse, Clipboard, Microphone and Screen Capturing

Creates a DirectInput object (often for capturing keystrokes)

Source: LocalPlayback.exe, 0000001E.00000002.2561255132.0000000001267000.00000002.00000001.01000000.00000026.sdmp

Binary or memory string: DirectDrawCreateEx

memstr_f53362d3-4

E-Banking Fraud

Registers a new ROOT certificate

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_00453B2B __EH_prolog3,CertOpenSystemStoreW,CertOpenSystemStoreW,CertOpenSystemStoreW,CertAddCertificateContextToStore,GetLastError,CertGetIssuerCertificateFromStore,CertAddCertificateContextToStore,GetLastError,CertGetIssuerCertificateFromStore,

2_2_00453B2B

System Summary

PE file has a writeable .text section

Source: ISSetup.dll.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: isr8AA1.tmp.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ISS80A0.tmp.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Contains functionality to communicate with device drivers

Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe

Code function: 30_2_00C51660: memset,malloc,malloc,free,free,malloc,CreateFileW,DeviceIoControl,CloseHandle,free,free,free,free,free,CloseHandle,free,free,free,free,free,

30_2_00C51660

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_00446A5B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

2_2_00446A5B

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c8c.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4E9F.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\vcamp120.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\vcomp120.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c8f.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c8f.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c90.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI53FF.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120chs.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120cht.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120deu.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120enu.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120esn.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120fra.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120ita.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120jpn.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120kor.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120rus.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c93.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c93.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c94.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BFD.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcamp120.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcomp120.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c97.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c97.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c98.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{929FBD26-9020-399B-9A7A-751D61F0B942}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7005.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120chs.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120cht.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120deu.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120enu.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120esn.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120fra.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120ita.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120jpn.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120kor.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120rus.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c9b.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c4c9b.msi

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\6c4c8f.msi

Detected potential crypto function

Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0047C079	2_2_0047C079
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0046802F	2_2_0046802F
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0049C169	2_2_0049C169
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00490400	2_2_00490400
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_004785C3	2_2_004785C3
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0047C5E9	2_2_0047C5E9
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0047CF48	2_2_0047CF48
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0047D307	2_2_0047D307
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00471456	2_2_00471456
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0049D5C4	2_2_0049D5C4
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00475701	2_2_00475701
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0044DAE2	2_2_0044DAE2
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0047DA83	2_2_0047DA83
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0045E55F	2_2_0045E55F
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0045EA53	2_2_0045EA53
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00462D20	2_2_00462D20
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0045EE6B	2_2_0045EE6B
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00492EF0	2_2_00492EF0
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_004631C0	2_2_004631C0
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0045F2A0	2_2_0045F2A0
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0045F6D5	2_2_0045F6D5
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0047F77C	2_2_0047F77C
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0047BB10	2_2_0047BB10
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0046FC8B	2_2_0046FC8B
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Code function: 6_2_00007FF75D261AD0	6_2_00007FF75D261AD0
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Code function: 6_2_00007FF75D264230	6_2_00007FF75D264230
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Code function: 6_2_00007FF75D26D308	6_2_00007FF75D26D308
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Code function: 6_2_00007FF75D2742FC	6_2_00007FF75D2742FC
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Code function: 6_2_00007FF75D26F11C	6_2_00007FF75D26F11C
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Code function: 6_2_00007FF75D264E10	6_2_00007FF75D264E10
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Code function: 6_2_00007FF75D26CC64	6_2_00007FF75D26CC64
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Code function: 6_2_00007FF75D26FCE4	6_2_00007FF75D26FCE4
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CA5560	30_2_00CA5560
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CE9A70	30_2_00CE9A70
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CB7550	30_2_00CB7550
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CEC250	30_2_00CEC250
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00C48440	30_2_00C48440
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00C94A30	30_2_00C94A30
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00D00B80	30_2_00D00B80
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CFCBA0	30_2_00CFCBA0
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CF5530	30_2_00CF5530
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00C9DA60	30_2_00C9DA60
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CC9B80	30_2_00CC9B80
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00C9A1E0	30_2_00C9A1E0
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CF2120	30_2_00CF2120
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CE9A70	30_2_00CE9A70
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00C630B0	30_2_00C630B0
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00C47830	30_2_00C47830
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00C630B0	30_2_00C630B0
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011F4C40	30_2_011F4C40
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011FA140	30_2_011FA140
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011FA600	30_2_011FA600
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011F6670	30_2_011F6670
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011FA9B0	30_2_011FA9B0
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011FA8B0	30_2_011FA8B0
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011FAAB0	30_2_011FAAB0
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011F2C90	30_2_011F2C90
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011F2F40	30_2_011F2F40
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011F3140	30_2_011F3140
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011F7170	30_2_011F7170
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011FF1E0	30_2_011FF1E0
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_011F7070	30_2_011F7070
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_0123E125	30_2_0123E125
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_01258108	30_2_01258108
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_0125E0B4	30_2_0125E0B4
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_0123E310	30_2_0123E310
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_01262486	30_2_01262486

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: String function: 0044177A appears 60 times
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: String function: 0044540B appears 73 times
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: String function: 0044294E appears 460 times
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: String function: 0043F6A2 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: String function: 0043FA86 appears 654 times
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: String function: 00F4294E appears 460 times
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: String function: 00F3F6A2 appears 35 times
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: String function: 00F4540B appears 73 times
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: String function: 700D10E3 appears 70 times
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: String function: 700DAFD3 appears 31 times
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: String function: 00F3FA86 appears 654 times
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: String function: 00F4177A appears 60 times
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: String function: 00462F51 appears 35 times
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: String function: 0045B6C9 appears 295 times
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: String function: 0045B6FF appears 57 times
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: String function: 00423321 appears 40 times
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: String function: 0045A10D appears 136 times
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: String function: 004091B8 appears 102 times
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: String function: 0045B696 appears 235 times
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: String function: 00466070 appears 55 times
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: String function: 00459DAE appears 77 times
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: String function: 00459DDC appears 56 times
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: String function: 00C35173 appears 41 times
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: String function: 00C3247D appears 32 times
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: String function: 00D0C478 appears 46 times
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: String function: 00C3647E appears 38 times
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: String function: 003E540B appears 73 times
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: String function: 003E177A appears 60 times
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: String function: 003DFA86 appears 654 times
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: String function: 003E294E appears 460 times
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: String function: 003DF6A2 appears 35 times

PE file contains executable resources (Code or Archives)

Source: hpr8777.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: Loc8846.tmp.2.dr	Static PE information: Resource name: RT_ICON type: tar archive (old), type '9' (, mode !\005, uid )\006, gid !\010\0, size *\010, seconds \006\016, linkname \014\002, comment: 7

Sample file is different than original file name gathered from version info

Source: LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRT.dll vs LocalPlayback.exe
Source: LocalPlayback.exe, 00000002.00000000.1288340748.0000000000518000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameInstallShield Setup.exe< vs LocalPlayback.exe
Source: LocalPlayback.exe	Binary or memory string: OriginalFilename vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2575336087.000000006C8FF000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: OriginalFilenameToolShareModule.dll@ vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2571617408.000000006B450000.00000002.00000001.01000000.00000020.sdmp	Binary or memory string: OriginalFilenameQt5PrintSupport.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2576115403.000000007004B000.00000002.00000001.01000000.0000002A.sdmp	Binary or memory string: OriginalFilenameqdds.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2573230518.000000006BCD5000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: OriginalFilenameHDFileSDK.dll4 vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2560995220.000000000120F000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: OriginalFilenameAnalyzeData.dll8 vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2561519409.00000000012E1000.00000002.00000001.01000000.00000026.sdmp	Binary or memory string: OriginalFilenameSuperRender.dllb! vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2570330216.000000006AEC3000.00000002.00000001.01000000.00000027.sdmp	Binary or memory string: OriginalFilenameqwindows.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2572836301.000000006BC57000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: OriginalFilenamehpr.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2574879072.000000006C7FA000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilenameQt5Gui.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2568305204.000000006AC66000.00000002.00000001.01000000.0000002F.sdmp	Binary or memory string: OriginalFilenameqtga.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2568863892.000000006ACB8000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: OriginalFilenameqico.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2568057819.000000006AC4D000.00000002.00000001.01000000.00000030.sdmp	Binary or memory string: OriginalFilenameqtiff.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2571873027.000000006B528000.00000002.00000001.01000000.00000021.sdmp	Binary or memory string: OriginalFilenameQt5Network.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2573691280.000000006BED1000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenameToolGuiToolkit.dll> vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2574203004.000000006C30C000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: OriginalFilenameQt5Widgets.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2571195230.000000006B3D6000.00000002.00000001.01000000.00000023.sdmp	Binary or memory string: OriginalFilenameAudioRender.dllb! vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2572561458.000000006BB12000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: OriginalFilenameQt5Core.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2575743999.000000006FF48000.00000002.00000001.01000000.0000002B.sdmp	Binary or memory string: OriginalFilenameqgif.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2567687436.000000006ABF6000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: OriginalFilenameqwbmp.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2575563003.000000006C919000.00000002.00000001.01000000.0000002C.sdmp	Binary or memory string: OriginalFilenameqicns.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2568537510.000000006ACAC000.00000002.00000001.01000000.0000002E.sdmp	Binary or memory string: OriginalFilenameqjpeg.dll( vs LocalPlayback.exe
Source: LocalPlayback.exe, 0000001E.00000002.2567183037.0000000010367000.00000002.00000001.01000000.0000001D.sdmp	Binary or memory string: OriginalFilenamePlayCtrl.dll2 vs LocalPlayback.exe

Uses 32bit PE files

Source: LocalPlayback.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ISSetup.dll.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: lib96F4.tmp.2.dr	Static PE information: Section: .reloc IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: isr8AA1.tmp.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ISS80A0.tmp.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: lib96F4.tmp.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: isr8AA1.tmp.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: LocalPlayback.exe, 0000001E.00000002.2572144739.000000006B8F5000.00000002.00000001.01000000.0000001E.sdmp

Binary or memory string: nna.nosciencehu.comtadaoka.osaka.jphayakawa.yamanashi.jpdnsalias.orgedu.saedu.sbedu.rsedu.sclib.id.usogori.fukuoka.jpnotogawa.shiga.jpedu.sdrepbody.aeroid.auedu.ruk12.nj.usloyalist.museumedu.rwedu.sgxyzmoka.tochigi.jpdynathome.netkimino.wakayama.jpedu.slnissanveterinaire.kmkokubunji.tokyo.jpedu.snos.hordaland.notm.kmartsandcrafts.museumis-a-musician.com*.kitakyushu.jpiitate.fukushima.jpedu.stav.iturayasu.chiba.jpedu.svflorida.museumninjaedu.synemuro.hokkaido.jpedu.tjs

Source: classification engine

Classification label: sus24.bank.evad.winEXE@29/455@1/1

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe

Code function: 19_2_0043F326 FormatMessageW,GetLastError,LocalFree,

19_2_0043F326

Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00454269 __EH_prolog3_GS,CertOpenSystemStoreW,GetLastError,CertOpenSystemStoreW,		2_2_00454269
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00453B2B __EH_prolog3,CertOpenSystemStoreW,CertOpenSystemStoreW,CertOpenSystemStoreW,CertAddCertificateContextToStore,GetLastError,CertGetIssuerCertificateFromStore,CertAddCertificateContextToStore,GetLastError,CertGetIssuerCertificateFromStore,		2_2_00453B2B

Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00446A5B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,	2_2_00446A5B
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_004113BA GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	19_2_004113BA
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003B13BA GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	22_2_003B13BA
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F113BA GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	27_2_00F113BA

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_0041F059 __EH_prolog3_GS,_memset,GetDiskFreeSpaceExW,LoadLibraryW,GetProcAddress,lstrcpyW,lstrcatW,GetDiskFreeSpaceExW,GetDiskFreeSpaceExW,GetLastError,GetDiskFreeSpaceW,GetDiskFreeSpaceW,

2_2_0041F059

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_00444E65 __EH_prolog3_GS,CreateToolhelp32Snapshot,GetLastError,Process32FirstW,Process32NextW,OpenProcess,

2_2_00444E65

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_0041A2E5 CoCreateInstance,

2_2_0041A2E5

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_00499420 FindResourceW,FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,_memmove,CreateStreamOnHGlobal,GlobalUnlock,GlobalFree,

2_2_00499420

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe

Code function: 19_2_0042E774 ChangeServiceConfigW,GetLastError,

19_2_0042E774

Source: C:\Users\user\Desktop\LocalPlayback.exe

File created: C:\Program Files (x86)\InstallShield Installation Information\

Jump to behavior

Source: C:\Users\user\Desktop\LocalPlayback.exe

File created: C:\Users\Public\Desktop\LocalPlayback.lnk

Jump to behavior

Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Users\user\Desktop\LocalPlayback.exe	Mutant created: \Sessions\1\BaseNamedObjects\6674BCC5-BC57-446B-B83B-FA53501E0FDC
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Mutant created: \Sessions\1\BaseNamedObjects\QtLockedFile mutex c:/users/user/appdata/local/temp/qtsingleapplication-b312-1-lockfile

Source: C:\Users\user\Desktop\LocalPlayback.exe

File created: C:\Users\user~1\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\

Jump to behavior

Source: C:\Users\user\Desktop\LocalPlayback.exe	Command line argument: x$L	2_2_00425602
Source: C:\Users\user\Desktop\LocalPlayback.exe	Command line argument: x$L	2_2_00425602
Source: C:\Users\user\Desktop\LocalPlayback.exe	Command line argument: x$L	2_2_00425602
Source: C:\Users\user\Desktop\LocalPlayback.exe	Command line argument: EXE=%s	2_2_00425602
Source: C:\Users\user\Desktop\LocalPlayback.exe	Command line argument: EXEProcessBegin	2_2_00425602
Source: C:\Users\user\Desktop\LocalPlayback.exe	Command line argument: ISSetupInit	2_2_00425602
Source: C:\Users\user\Desktop\LocalPlayback.exe	Command line argument: x$L	2_2_00425602
Source: C:\Users\user\Desktop\LocalPlayback.exe	Command line argument: x$L	2_2_00425602

Source: LocalPlayback.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\LocalPlayback.exe

File read: C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\setup.ini

Jump to behavior

Source: C:\Users\user\Desktop\LocalPlayback.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vcredist_x86.exe, 00000013.00000003.1819940196.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 00000013.00000003.1815835578.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64_2013.exe, 00000016.00000003.1898813039.0000000000953000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64_2013.exe, 00000016.00000003.1901279866.000000000098E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT `WixDependency`.`WixDependency`, `WixDependencyProvider`.`Component_`, `WixDependency`.`ProviderKey`, `WixDependency`.`MinVersion`, `WixDependency`.`MaxVersion`, `WixDependency`.`Attributes` FROM `WixDependencyProvider`, `WixDependency`, `WixDependencyRef` WHERE `WixDependency`.`WixDependency` = `WixDependencyRef`.`WixDependency_` AND `WixDependencyProvider`.`WixDependencyProvider` = `WixDependencyRef`.`WixDependencyProvider_`SELECT `WixDependencyProvider`.`WixDependencyProvider`, `WixDependencyProvider`.`Component_`, `WixDependencyProvider`.`ProviderKey`, `WixDependencyProvider`.`Attributes` FROM `WixDependencyProvider`Failed to ignored dependency "%ls" to the string dictionary.;Failed to create the string dictionary.Failed to get the string value of the IGNOREDEPENDENCIES property.IGNOREDEPENDENCIESUnknownFailed to set the dependency name "%ls" into the message record.Failed to set the dependency key "%ls" into the message record.The dependency "%ls" is missing or is not the required version.Found dependent "%ls", name: "%ls".Failed to set the number of dependencies into the message record.Failed to set the message identifier into the message record.Not enough memory to create the message record.wixdepca.cppUnexpected message response %d from user or bootstrapper application.Failed to create the dependency record for message %d.Failed to enumerate all of the rows in the dependency query view.Failed to get WixDependency.Attributes.Failed to get WixDependency.MaxVersion.Failed to get WixDependency.MinVersion.Failed to get WixDependency.ProviderKey.Failed to get WixDependencyProvider.Component_.Failed to get WixDependency.WixDependency.Failed dependency check for %ls.Skipping dependency check for %ls because the component %ls is not being (re)installed.Failed to open the query view for dependencies.Failed to initialize the unique dependency string list.Failed to check if the WixDependency table exists.Skipping the dependency check since no dependencies are authored.WixDependencyFailed to enumerate all of the rows in the dependency provider query view.Failed to get WixDependencyProvider.Attributes.Failed to get WixDependencyProvider.ProviderKey.Failed to get WixDependencyProvider.Component.Failed to get WixDependencyProvider.WixDependencyProvider.Failed dependents check for %ls.Skipping dependents check for %ls because the component %ls is not being uninstalled.Failed to open the query view for dependency providers.Failed to check if the WixDependencyProvider table exists.Skipping the dependents check since no dependency providers are authored.WixDependencyProviderSkipping the dependencies check since IGNOREDEPENDENCIES contains "ALL".Failed to check if "ALL" was set in IGNOREDEPENDENCIES.ALLFailed to get the ignored dependents.Failed to ensure required dependencies for (re)installing components.ALLUSERSFailed to initialize the registry functions.Failed to initialize.WixDependencyRequireFailed to ensure absent dependents for uninstalling com

Source: vcredist_x86.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: vcredist_x64_2013.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: vcredist_x86.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: LocalPlayback.exe	String found in binary or memory: --yexl-- CPlayBackInteraction-StartPlayback nofile

Source: C:\Users\user\Desktop\LocalPlayback.exe

File read: C:\Users\user\Desktop\LocalPlayback.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LocalPlayback.exe "C:\Users\user\Desktop\LocalPlayback.exe"
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F60EF52-B8AE-4C65-B672-4ECBA9C7EF64}
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DEBE9773-6CCB-402A-A045-44F23FC2C3BA}
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E46B7176-3FFC-40C6-B559-180C9F23E714}
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E5BF0CED-81A6-4ECC-9E75-24C1C03367D2}
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{83415305-25EC-4DB0-8231-2F0B7AC0579F}
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3309AE38-3356-4998-B51D-DDEA1CA316CD}
Source: unknown	Process created: C:\Windows\System32\SrTasks.exe C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Source: C:\Windows\System32\SrTasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe /q
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe "C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe" /q -burn.unelevated BurnPipe.{DBEA4BDC-32D1-4571-8C40-9D2304124BE9} {91C7A57E-FB61-4624-AACC-1188F529C9A7} 8120
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe /q
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe "C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe" /q -burn.unelevated BurnPipe.{0942DD9A-AF4A-432E-BD2D-A92FFBEDB9E9} {F3730AF5-9EE5-4B54-A568-50E8BA9679B4} 1876
Source: unknown	Process created: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe "C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe" /burn.runonce
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Process created: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe "C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe"
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe "C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe"
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F60EF52-B8AE-4C65-B672-4ECBA9C7EF64}	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DEBE9773-6CCB-402A-A045-44F23FC2C3BA}	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E46B7176-3FFC-40C6-B559-180C9F23E714}	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E5BF0CED-81A6-4ECC-9E75-24C1C03367D2}	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{83415305-25EC-4DB0-8231-2F0B7AC0579F}	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3309AE38-3356-4998-B51D-DDEA1CA316CD}	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe /q	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe /q	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process created: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe "C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe "C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe" /q -burn.unelevated BurnPipe.{DBEA4BDC-32D1-4571-8C40-9D2304124BE9} {91C7A57E-FB61-4624-AACC-1188F529C9A7} 8120	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe "C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe" /q -burn.unelevated BurnPipe.{0942DD9A-AF4A-432E-BD2D-A92FFBEDB9E9} {F3730AF5-9EE5-4B54-A568-50E8BA9679B4} 1876
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Process created: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe "C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe"

Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: lz32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: sxproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: srcore.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vss_ps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: sxproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: msxml3.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: feclient.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: msxml3.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: srclient.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: spp.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: vssapi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: vsstrace.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: usoapi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: sxproxy.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: cryptnet.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: srpapi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: tsappcmp.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: msxml3.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: feclient.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Section loaded: textshaping.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: windowscodecs.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: explorerframe.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: riched20.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: usp10.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: msls31.dll
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5core.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5gui.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5widgets.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: toolguitoolkit.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: toolsharemodule.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: hdfilesdk.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: hpr.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: playctrl.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: analyzedata.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: upgrade.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcp120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcr120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5core.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcp120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcr120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5core.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcp120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcr120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: hpr.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5core.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5network.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcp120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcr120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5core.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5printsupport.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5xml.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: hpr.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcp120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcr120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: superrender.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: audiorender.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcp120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcr120.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: hcnetutils.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: ddraw.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: dciman32.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: wintab32.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: qt5svg.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\LocalPlayback.exe

File written: C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\0x0409.ini

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\Desktop\LocalPlayback.exe	Automated click: Next >
Source: C:\Users\user\Desktop\LocalPlayback.exe	Automated click: Next >
Source: C:\Users\user\Desktop\LocalPlayback.exe	Automated click: Next >
Source: C:\Users\user\Desktop\LocalPlayback.exe	Automated click: Install
Source: C:\Users\user\Desktop\LocalPlayback.exe	Automated click: Next >

Uses Rich Edit Controls

Source: C:\Users\user\Desktop\LocalPlayback.exe

File opened: C:\Windows\SysWOW64\RICHED32.DLL

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found window with many clickable UI elements (buttons, textforms, scrollbars etc)

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Window detected: Number of UI elements: 19
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Window detected: Number of UI elements: 19
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Window detected: Number of UI elements: 19

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}

PE / OLE file has a valid certificate

Source: LocalPlayback.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: LocalPlayback.exe

Static file information: File size 80556152 > 1048576

Uses new MSVCR Dlls

Source: C:\Users\user\Desktop\LocalPlayback.exe

File opened: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\msvcr90.dll

Jump to behavior

PE file contains a debug data directory

Source: LocalPlayback.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: Nsd.pdb' source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_Tool_BaseLine_Tools3\code\target\vs2013\ToolShareModule\ToolShareModule.pdb source: LocalPlayback.exe, 0000001E.00000002.2575260611.000000006C8F8000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: .pdb? source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Project\2018NewVersionTools\UpgradeTool\code\target\UpgradeTool\Upgrade.pdb source: LocalPlayback.exe, 0000001E.00000002.2574995176.000000006C8CA000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: qddsd.pdbEScritOpedm source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\CodeBases\isdev\redist\Language Independent\i386\ISP\setup.pdb source: LocalPlayback.exe, 00000002.00000000.1288293705.00000000004AD000.00000002.00000001.01000000.00000004.sdmp, LocalPlayback.exe, 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: qtgad.pdbEScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdb source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424912060.0000000005C0D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: `C:\Program Files (x86)\LocalPlayback\Standard\\sqlpsql.pdb source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\platforms\qwindowsd.pdbbddll} source: LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_Tool_BaseLine_Tools3\code\target\VS2013\ToolGuiToolkit\ToolGuiToolkit.pdb source: LocalPlayback.exe, 0000001E.00000002.2573472697.000000006BE0A000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qwbmp.dll.pdb source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: `C:\Program Files (x86)\LocalPlayback\plugins\\indowsd.pdbws.ll source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qgifd.pdbl source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424912060.0000000005C0D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Project\2018NewVersionTools\UpgradeTool\code\target\UpgradeTool\Upgrade.pdb(( source: LocalPlayback.exe, 0000001E.00000002.2574995176.000000006C8CA000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysqld.pdbltmpI source: LocalPlayback.exe, 00000002.00000003.2169399913.0000000005A92000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435360519.0000000005A92000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2427166168.0000000005A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xC:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdb. source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\PROJ\hpr\hpr_svn\lib\vs2008\hpr.pdb source: LocalPlayback.exe, 0000001E.00000002.2572733998.000000006BB42000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: qwebpd.pdbScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.pdb source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qwbmpd.pdbScritOpedJ;^ source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: `C:\Program Files (x86)\LocalPlayback\plugins\\indowsd.pdb source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdbH source: vcredist_x86.exe, 0000001C.00000002.2561765338.00000000700E5000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: qminimald.pdbritOped&;2 source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qtiffd.pdb source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb source: vcredist_x86.exe, 00000013.00000000.1787811525.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000013.00000002.1873216538.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000013.00000003.1807866305.0000000000F47000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 00000014.00000002.1873113180.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000014.00000000.1791920978.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x64_2013.exe, 00000016.00000002.1937952943.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000016.00000000.1876182782.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000017.00000002.1938343186.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000017.00000000.1877246310.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x86.exe, 0000001B.00000002.1943499977.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001B.00000000.1932728808.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001C.00000002.2559508643.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001C.00000000.1936608719.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qjpegd.pdb source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_Tool_BaseLine_Tools3\code\target\VS2013\LocalPlayback\LocalPlayback.pdb source: LocalPlayback.exe, 0000001E.00000000.2168265549.0000000000D2C000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Compiler_SDK_HDFile_Win32\win\VS2013\Release\HDFileSDK.pdb source: LocalPlayback.exe, 0000001E.00000002.2573042521.000000006BCCB000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdbw source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_Tool_BaseLine_Tools3\code\target\vs2013\CommonSkin\CommonSkin.pdb source: LocalPlayback.exe, 0000001E.00000002.2568990669.000000006ADBD000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdb source: vcredist_x86.exe, 0000001C.00000002.2561765338.00000000700E5000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: qwbmpd.pdbXP1 source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qicod.pdbcod.llb source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysqld.pdb.lll source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\work\SuperRender\0000000\bin\win32\Private_PDB32\SuperRender.pdb8 ' source: LocalPlayback.exe, 0000001E.00000002.2561255132.0000000001267000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: qwindowsd.pdbritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\platforms\qoffscreend.pdb source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixDepCA.pdb source: vcredist_x86.exe, 00000013.00000003.1819940196.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 00000013.00000003.1815835578.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64_2013.exe, 00000016.00000003.1898813039.0000000000953000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64_2013.exe, 00000016.00000003.1901279866.000000000098E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qwebp.dll.pdb source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_SDK_HCNetUtils_win32\common\HCNetUtils\win32\lib\HCNetUtils.pdb source: LocalPlayback.exe, 0000001E.00000002.2570472714.000000006B205000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qwebpd.pdb source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qwbmpd.pdbt source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlited.pdbb source: LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdb.dldbA source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\work\SuperRender\0000000\bin\win32\Private_PDB32\SuperRender.pdb source: LocalPlayback.exe, 0000001E.00000002.2561255132.0000000001267000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qtiff.dll.pdb source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qicnsd.pdbScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: _isres_0x0409.dlllayout.bindata1.hdrdata1.cabsetup.exeISSetup.dll0x0804.ini0x0409.inisetup.iniAnalyzeData.dllAudioRender.dllcalib.dllD3DCompiler_43.dllD3DX9_43.dllEagleEyeRender.dllgdiplus.dllHCCore.dllHCNetSDK.dllHCNetUtils.dllHDFileSDK.dllhpr.dllHWDecode.dlliconv.dlllibxml2.dllLocalPlayback.exeLocalPlayback.ism.771LocalXml.zipMP_Render.dllMP_VIE.dllOpenAL32.dllPlayCtrl.dllQt5Core.dllQt5Gui.dllQt5Network.dllQt5PrintSupport.dllQt5Widgets.dllQt5Xml.dllSettings.xmlSuperRender.dllToolGuiToolkit.dllToolShareModule.dllToolShareModule.libUpgrade.dllUpgrade.xmlYUVProcess.dllzlib1.dllAudioIntercom.dllDsSdk.dllHCAlarm.dllHCAlarm.libHCCoreDevCfg.dllHCDisplay.dllHCGeneralCfgMgr.dllHCGeneralCfgMgr.libHCIndustry.dllHCPlayBack.dllHCPreview.dllHCPreview.libHCVoiceTalk.dlllibiconv2.dllmsvcr90.dllStreamTransClient.dllSystemTransform.dllqdds.dllqddsd.dllqddsd.pdbqgif.dllqgifd.dllqgifd.pdbqicns.dllqicnsd.dllqicnsd.pdbqico.dllqicod.dllqicod.pdbqjpeg.dllqjpegd.dllqjpegd.pdbqsvg.dllqsvgd.dllqsvgd.pdbqtga.dllqtgad.dllqtgad.pdbqtiff.dllqtiffd.dllqtiffd.pdbqwbmp.dllqwbmpd.dllqwbmpd.pdbqwebp.dllqwebpd.dllqwebpd.pdbqminimal.dllqminimald.dllqminimald.pdbqoffscreen.dllqoffscreend.dllqoffscreend.pdbqwindows.dllqwindowsd.dllqwindowsd.pdbqsqlite.dllqsqlited.dllqsqlited.pdbqsqlmysql.dllqsqlmysqld.dllqsqlmysqld.pdbqsqlpsql.dllqsqlpsqld.dllqsqlpsqld.pdbLocalPlayback_en.qmLocalPlayBack_en.tsLocalPlayback_zh.qmLocalPlayBack_zh.tsqt_en.qmqt_zh_CN.qmToolGuiToolkit_en.qmToolGuiToolkit_en.tsToolGuiToolkit_zh.qmToolGuiToolkit_zh.tsToolShareModule_en.qmToolShareModule_en.tsToolShareModule_zh.qmToolShareModule_zh.ts,g0W source: LocalPlayback.exe, 00000002.00000003.2197605938.0000000000855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb source: LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp, ISBEW64.exe, 00000006.00000002.2196188784.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000006.00000000.1332346457.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000007.00000002.1335450557.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000007.00000000.1333414243.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000008.00000000.1334155324.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000008.00000002.1336690488.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000009.00000002.1338208405.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 00000009.00000000.1334838319.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 0000000A.00000000.1335823221.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 0000000A.00000002.1338230664.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 0000000B.00000002.2171021829.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp, ISBEW64.exe, 0000000B.00000000.1389523104.00007FF75D277000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qsvgd.pdbpg.llg source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qgifd.pdbEScritOpedn;z source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: setup.inxlicense.rtfSetup.xmlvcredist_x64_2013.exevcredist_x86.exeFontData.iniDIFxData.inicorecomp.inidotnetinstaller.exedotnetinstaller.exe.configISBEW64.exeStringTable_0x0804.ipsStringTable_0x0409.ipsisrt.dlldefault.pal_isres_0x0804.dll_isres_0x0409.dlllayout.bindata1.hdrdata1.cabsetup.exeISSetup.dll0x0804.ini0x0409.inisetup.iniAnalyzeData.dllAudioRender.dllcalib.dllD3DCompiler_43.dllD3DX9_43.dllEagleEyeRender.dllgdiplus.dllHCCore.dllHCNetSDK.dllHCNetUtils.dllHDFileSDK.dllhpr.dllHWDecode.dlliconv.dlllibxml2.dllLocalPlayback.exeLocalPlayback.ism.771LocalXml.zipMP_Render.dllMP_VIE.dllOpenAL32.dllPlayCtrl.dllQt5Core.dllQt5Gui.dllQt5Network.dllQt5PrintSupport.dllQt5Widgets.dllQt5Xml.dllSettings.xmlSuperRender.dllToolGuiToolkit.dllToolShareModule.dllToolShareModule.libUpgrade.dllUpgrade.xmlYUVProcess.dllzlib1.dllAudioIntercom.dllDsSdk.dllHCAlarm.dllHCAlarm.libHCCoreDevCfg.dllHCDisplay.dllHCGeneralCfgMgr.dllHCGeneralCfgMgr.libHCIndustry.dllHCPlayBack.dllHCPreview.dllHCPreview.libHCVoiceTalk.dlllibiconv2.dllmsvcr90.dllStreamTransClient.dllSystemTransform.dllqdds.dllqddsd.dllqddsd.pdbqgif.dllqgifd.dllqgifd.pdbqicns.dllqicnsd.dllqicnsd.pdbqico.dllqicod.dllqicod.pdbqjpeg.dllqjpegd.dllqjpegd.pdbqsvg.dllqsvgd.dllqsvgd.pdbqtga.dllqtgad.dllqtgad.pdbqtiff.dllqtiffd.dllqtiffd.pdbqwbmp.dllqwbmpd.dllqwbmpd.pdbqwebp.dllqwebpd.dllqwebpd.pdbqminimal.dllqminimald.dllqminimald.pdbqoffscreen.dllqoffscreend.dllqoffscreend.pdbqwindows.dllqwindowsd.dllqwindowsd.pdbqsqlite.dllqsqlited.dllqsqlited.pdbqsqlmysql.dllqsqlmysqld.dllqsqlmysqld.pdbqsqlpsql.dllqsqlpsqld.dllqsqlpsqld.pdbLocalPlayback_en.qmLocalPlayBack_en.tsLocalPlayback_zh.qmLocalPlayBack_zh.tsqt_en.qmqt_zh_CN.qmToolGuiToolkit_en.qmToolGuiToolkit_en.tsToolGuiToolkit_zh.qmToolGuiToolkit_zh.tsToolShareModule_en.qmToolShareModule_en.tsToolShareModule_zh.qmToolShareModule_zh.ts,g0W source: LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196340763.000000000084F000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2188207802.0000000000844000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qsqlited.pdbcritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.pdbimage/~ source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlpsqld.pdb@ source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qsqlpsqld.pdbritOped$%4 source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qicnsd.pdbrmdlll source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qddsd.pdbformdll source: LocalPlayback.exe, 00000002.00000003.2198116230.000000000082E000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2189404783.000000000082C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qtgad.pdbp.dl source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /LocalPlayback/imageformats/qwebpd.pdb' source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\AudioRender0\WindowsAudio2\bin\win32\Private_PDB32\AudioRender.pdb =k source: LocalPlayback.exe, 0000001E.00000002.2571115843.000000006B3C9000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: qsvgd.pdbEScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :/aptui/complex/Images/System/Complex/date.pngtgad.pdb source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qsqlmysqld.pdbtOpedX:P source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@F source: vcredist_x86.exe, 00000013.00000000.1787811525.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000013.00000002.1873216538.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000014.00000002.1873113180.000000000044A000.00000002.00000001.01000000.0000000F.sdmp, vcredist_x86.exe, 00000014.00000000.1791920978.000000000044A000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: kqsvgd.pdb source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@E source: vcredist_x86.exe, 00000013.00000003.1807866305.0000000000F47000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@@ source: vcredist_x64_2013.exe, 00000016.00000002.1937952943.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000016.00000000.1876182782.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000017.00000002.1938343186.00000000003EA000.00000002.00000001.01000000.00000013.sdmp, vcredist_x64_2013.exe, 00000017.00000000.1877246310.00000000003EA000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_Tool_BaseLine_Tools3\code\target\vs2013\CommonSkin\CommonStyle.pdb source: LocalPlayback.exe, 0000001E.00000002.2575854670.000000006FF59000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: C:/Program Files (x86)/LocalPlayback/imageformats/qwbmpd.pdb source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\AudioRender0\WindowsAudio2\bin\win32\Private_PDB32\AudioRender.pdb source: LocalPlayback.exe, 0000001E.00000002.2571115843.000000006B3C9000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: qjpegd.pdbScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qtiffd.pdbScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kegd.pdbX source: LocalPlayback.exe, 0000001E.00000002.2555626033.0000000000A91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\platforms\qminimald.pdb source: LocalPlayback.exe, 00000002.00000003.2198507434.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2171020004.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436234286.0000000005C50000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196692354.0000000005C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qoffscreend.pdbtOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qjpegd.pdb source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424912060.0000000005C0D000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.pdbe Q source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdb3 source: LocalPlayback.exe, 0000001E.00000003.2190142052.0000000000B48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qicod.pdbEScritOped source: LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174101184.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2435760784.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@ source: vcredist_x86.exe, 0000001B.00000002.1943499977.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001B.00000000.1932728808.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001C.00000002.2559508643.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp, vcredist_x86.exe, 0000001C.00000000.1936608719.0000000000F4A000.00000002.00000001.01000000.00000015.sdmp

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_00495AB0 LoadLibraryW,GetProcAddress,MonitorFromPoint,GetDC,GetDeviceCaps,ReleaseDC,MulDiv,FreeLibrary,

2_2_00495AB0

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .rsrc

PE file contains sections with non-standard names

Source: qdd97B4.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qdd97C5.tmp.2.dr	Static PE information: section name: .qtmetad
Source: vcr8865.tmp.2.dr	Static PE information: section name: .wixburn
Source: vcr8951.tmp.2.dr	Static PE information: section name: .wixburn
Source: qgi9815.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qgi9826.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qic9885.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qic9896.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qic98F6.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qic9916.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qjp9985.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qjp99A6.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qsv9A34.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qsv9A54.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qtg9B02.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qtg9B13.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qti9B63.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qti9B93.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qwb9C22.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qwb9C32.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qwe9CA2.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qwe9CA2.tmp.2.dr	Static PE information: section name: _RDATA
Source: qwe9CB2.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qmi9E6A.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qmi9E7A.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qofA0BE.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qofA0FE.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qwiA296.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qwiA2F5.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qsqA549.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qsqA579.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qsqA636.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qsqA647.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qsqA6B6.tmp.2.dr	Static PE information: section name: .qtmetad
Source: qsqA6D6.tmp.2.dr	Static PE information: section name: .qtmetad
Source: Eag859C.tmp.2.dr	Static PE information: section name: .rodata
Source: gdi85CC.tmp.2.dr	Static PE information: section name: Shared
Source: Pla89D3.tmp.2.dr	Static PE information: section name: .rodata
Source: Pla89D3.tmp.2.dr	Static PE information: section name: .data1
Source: Pla89D3.tmp.2.dr	Static PE information: section name: _RDATA

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0043DEB0 push edi; retn 0001h	2_2_0043DEB3
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_004660B5 push ecx; ret	2_2_004660C8
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0045B664 push ecx; ret	2_2_0045B677
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00439B85 push ecx; ret	19_2_00439B98
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003D9B85 push ecx; ret	22_2_003D9B98
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F39B85 push ecx; ret	27_2_00F39B98
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 28_2_700DEE85 push ecx; ret	28_2_700DEE98
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 28_2_700DC354 pushad ; ret	28_2_700DC355
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CFC170 push ecx; mov dword ptr [esp], 40000000h	30_2_00CFC261
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CFC4C0 push ecx; mov dword ptr [esp], 3F000000h	30_2_00CFC5A8
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CBCD90 push ecx; mov dword ptr [esp], 40000000h	30_2_00CBCE2E
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00D0CE35 push ecx; ret	30_2_00D0CE48
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CBDC50 push ecx; mov dword ptr [esp], 3F000000h	30_2_00CBDCCA
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CBE230 push ecx; mov dword ptr [esp], 40000000h	30_2_00CBE35C
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00C77400 push ecx; mov dword ptr [esp], 40000000h	30_2_00C7743D
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CFB520 push ecx; mov dword ptr [esp], 3F000000h	30_2_00CFB560
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CFB520 push ecx; mov dword ptr [esp], 40000000h	30_2_00CFB6FE
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CFB520 push ecx; mov dword ptr [esp], 40000000h	30_2_00CFB89F
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00CFBE30 push ecx; mov dword ptr [esp], 40000000h	30_2_00CFBF18
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_01244264 push ecx; ret	30_2_01244277

Source: lib96F4.tmp.2.dr	Static PE information: section name: .text entropy: 7.40720181647502
Source: msv9724.tmp.2.dr	Static PE information: section name: .text entropy: 6.9206406211911835
Source: isr8AA1.tmp.2.dr	Static PE information: section name: .text entropy: 7.983864400776431

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120chs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDK.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\gdiplus.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\libiconv2.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qdd97C5.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qtg9B13.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Sys9794.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\DsSdk.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Upg8FDB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qti9B63.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qofA0BE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qic98F6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qic9896.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qwiA2F5.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qmi9E7A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\msvcr90.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Too8DD4.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCG95F3.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt58D82.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysql.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt5PrintSupport.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qgif.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120fra.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\vcamp120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\_is8AD2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\D3D84EF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120cht.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\plugins\skins\ComA8AE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\cal8412.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCP9683.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCC8669.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120esn.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCA9581.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCAlarm.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\AnalyzeData.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\lib96F4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120rus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\ISSetup.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\plugins\styles\ComA8DE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120kor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\D3D8452.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qtga.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qoffscreend.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\libxml2.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qjpeg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\plugins\skins\ComA87F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qwindowsd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\dot8A6E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCCoreDevCfg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	File created: C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Ope9753.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qic9885.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120enu.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCV96C4.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Ana9465.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\isr8AA1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\AudioIntercom.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120ita.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt58C27.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCN86E8.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\set7FB5.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qicns.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qsvg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlpsqld.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\MP_8925.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120cht.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qoffscreen.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qjp9985.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	File created: C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qwiA296.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qico.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCDisplay.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qgi9826.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCPreview.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qwe9CA2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\plugins\styles\ComA8DF.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qtiff.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\gdi85CC.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCIndustry.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Ope89B2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qofA0FE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qsvgd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA6B6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\calib.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qtg9B02.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA549.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmp.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\hpr8777.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\StreamTransClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\D3DCompiler_43.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISB8A8F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\SuperRender.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qsv9A34.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\iconv.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\OpenAL32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HWD8787.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCPlayBack.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\DsS94A6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\vcr902B.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCGeneralCfgMgr.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qjp99A6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt5Widgets.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt5Gui.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qtgad.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qwe9CB2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	File created: C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.be\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\SystemTransform.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\vcomp120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qdds.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120enu.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCC95A3.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qgi9815.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt58C87.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120deu.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Eag859C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120ita.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qsv9A54.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\ToolGuiToolkit.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qddsd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\ISS80A0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\D3DX9_43.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Sup8DC4.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlpsql.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qic9916.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\EagleEyeRender.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qicnsd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qgifd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt5Network.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\_isres_0x0409.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcr8951.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qti9B93.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\ico87D7.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA636.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\dotnetinstaller.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\plugins\skins\CommonSkin_D.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\AnalyzeData.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt58AAE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HDFileSDK.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt58B6B.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\hpr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	File created: C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.be\vcredist_x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\MP_8904.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlited.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\msv9724.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\MP_VIE.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HDF8747.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qminimal.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Too8EB0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcr8865.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt58C67.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\vcr92EB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HWDecode.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysqld.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\ISSetup.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCVoiceTalk.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Str9774.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120jpn.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCI9643.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA579.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Pla89D3.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\zli9454.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120deu.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\plugins\skins\CommonSkin.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcamp120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Aud83F2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlite.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120chs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA6D6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCD95D2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qwb9C32.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qminimald.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Aud9485.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\OpenAL32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qdd97B4.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\isrt.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\YUVProcess.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qwebp.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\vcredist_x64_2013.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120fra.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Qt5Core.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120esn.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\vcredist_x86.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qwindows.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcomp120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\AudioRender.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\PlayCtrl.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Ana83C2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCN86B8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120kor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\platforms\qmi9E6A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qjpegd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCP9663.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCCore.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA647.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\YUV9415.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120rus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	File created: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qicod.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\HCNetUtils.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\plugins\styles\CommonStyle_D.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\ToolShareModule.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\plugins\styles\CommonStyle.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Loc8846.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\MP_Render.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\lib8816.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\Upgrade.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qtiffd.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120jpn.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Program Files (x86)\LocalPlayback\imageformats\qwb9C22.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	File created: C:\ProgramData\Package Cache\{1b103cea-f037-4504-81de-956057b442c3}\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe (copy)	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	File created: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	File created: C:\ProgramData\Package Cache\{1b103cea-f037-4504-81de-956057b442c3}\vcredist_x64.exe			Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120chs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcomp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120deu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120ita.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120deu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120kor.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120ita.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120cht.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120rus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120rus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcamp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120kor.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120chs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120fra.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120fra.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\vcamp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120jpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120cht.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120enu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120jpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120esn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\vcomp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc120enu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120esn.dll	Jump to dropped file

Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0041C3F9 __EH_prolog3_GS,GetPrivateProfileIntW,		2_2_0041C3F9
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00489BF0 GetLastError,SetLastError,_memset,lstrcpyA,_memset,lstrcpyW,lstrlenA,_memset,lstrcpyA,lstrlenA,lstrlenA,_memmove,lstrcmpiA,GetLastError,SetLastError,_memmove,GetPrivateProfileIntA,_memset,lstrcpyA,GetPrivateProfileStringA,GetSysColor,_memset,_memset,GetPrivateProfileSectionNamesA,lstrcpyA,lstrcpyA,lstrlenA,lstrcpyA,GetPrivateProfileStringA,GetSysColor,GetLastError,SysFreeString,SysFreeString,SysFreeString,SetLastError,lstrcpyA,lstrlenA,lstrcmpA,lstrcpyA,GetPrivateProfileStringA,GetProcAddress,		2_2_00489BF0

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	File created: C:\Users\user~1\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\license.rtf
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	File created: C:\Users\user~1\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\license.rtf
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	File created: C:\Users\user~1\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\license.rtf
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	File created: C:\Users\user~1\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\license.rtf

Boot Survival

Creates or modifies windows services

Source: C:\Users\user\Desktop\LocalPlayback.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore

Jump to behavior

Modifies existing windows services

Source: C:\Windows\System32\SrTasks.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP

Jump to behavior

Stores files to the Windows start menu directory

Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LocalPlayback\	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LocalPlayback\Local Playback User Manual.lnk	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LocalPlayback\LocalPlayback.lnk	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LocalPlayback\Uninstall LocalPlayback.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {f65db027-aff3-4070-886a-0d87064aabb1}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {f65db027-aff3-4070-886a-0d87064aabb1}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {f65db027-aff3-4070-886a-0d87064aabb1}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {f65db027-aff3-4070-886a-0d87064aabb1}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {1b103cea-f037-4504-81de-956057b442c3}
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {1b103cea-f037-4504-81de-956057b442c3}
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {1b103cea-f037-4504-81de-956057b442c3}
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {1b103cea-f037-4504-81de-956057b442c3}

Hooking and other Techniques for Hiding and Protection

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_0044E37D LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_0044E37D

Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains capabilities to detect virtual machines

Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe

File opened / queried: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Found dropped PE file which has not been started or loaded

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc120chs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120deu.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Qt58C87.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDK.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Eag859C.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\gdiplus.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\libiconv2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc120ita.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qdd97C5.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qsv9A54.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qddsd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\ISS80A0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\D3DX9_43.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qtg9B13.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Sup8DC4.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Sys9794.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\DsSdk.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlpsql.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qic9916.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\EagleEyeRender.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Upg8FDB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qti9B63.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qicnsd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qgifd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qic9896.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qofA0BE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qic98F6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qwiA2F5.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qmi9E7A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\msvcr90.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\_isres_0x0409.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Too8DD4.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCG95F3.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysql.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Qt58D82.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qti9B93.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\ico87D7.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qgif.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA636.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc120fra.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\vcamp120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\_is8AD2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\D3D84EF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120cht.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\plugins\skins\ComA8AE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\dotnetinstaller.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\cal8412.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\plugins\skins\CommonSkin_D.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCP9683.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCC8669.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Qt58AAE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120esn.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Qt58B6B.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\MP_8904.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCA9581.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCAlarm.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlited.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\msv9724.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\lib96F4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120rus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\MP_VIE.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HDF8747.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\ISSetup.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qminimal.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\plugins\styles\ComA8DE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc120kor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\D3D8452.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Too8EB0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qtga.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qoffscreend.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Qt58C67.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\libxml2.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HWDecode.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysqld.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\ISSetup.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qjpeg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\plugins\skins\ComA87F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qwindowsd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\dot8A6E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCCoreDevCfg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCVoiceTalk.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc120jpn.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Str9774.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Ope9753.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qic9885.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120enu.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCV96C4.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCI9643.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Ana9465.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\isr8AA1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\AudioIntercom.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Pla89D3.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA579.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120ita.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Qt58C27.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCN86E8.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\zli9454.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\set7FB5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc120deu.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qicns.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qsvg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlpsqld.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\MP_8925.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc120cht.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qjp9985.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qoffscreen.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\plugins\skins\CommonSkin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcamp120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlite.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Aud83F2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qwiA296.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qico.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCDisplay.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qgi9826.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120chs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA6D6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCPreview.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCD95D2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qwe9CA2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qwb9C32.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\plugins\styles\ComA8DF.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qtiff.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qminimald.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\OpenAL32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Aud9485.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\gdi85CC.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qdd97B4.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCIndustry.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\isrt.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Ope89B2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qwebp.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\YUVProcess.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qsvgd.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120fra.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qofA0FE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA6B6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\calib.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qtg9B02.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc120esn.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qwindows.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA549.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmp.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcomp120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\Ana83C2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCN86B8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120kor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qjpegd.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\platforms\qmi9E6A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\hpr8777.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCP9663.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCCore.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\YUV9415.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA647.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc120rus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\StreamTransClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qicod.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\D3DCompiler_43.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qsv9A34.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\OpenAL32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\iconv.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCPlayBack.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HWD8787.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\DsS94A6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCGeneralCfgMgr.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\plugins\styles\CommonStyle_D.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qjp99A6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\plugins\styles\CommonStyle.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\MP_Render.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qtgad.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\lib8816.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qwe9CB2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qtiffd.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120jpn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.be\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qwb9C22.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\SystemTransform.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\vcomp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc120enu.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qdds.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{1b103cea-f037-4504-81de-956057b442c3}\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCC95A3.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LocalPlayback.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LocalPlayback\imageformats\qgi9815.tmp	Jump to dropped file

Found evaded block containing many API calls

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Evaded block: after key decision

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Found evasive API chain checking for process token information

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Found large amount of non-executed APIs

Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe

API coverage: 3.0 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\SrTasks.exe TID: 8092

Thread sleep time: -290000s >= -30000s

Jump to behavior

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_0043F195 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0043F236h	19_2_0043F195
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_0043F195 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0043F22Fh	19_2_0043F195
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003DF195 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 003DF236h	22_2_003DF195
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003DF195 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 003DF22Fh	22_2_003DF195
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F3F195 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00F3F236h	27_2_00F3F195
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F3F195 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00F3F22Fh	27_2_00F3F195

Source: C:\Users\user\Desktop\LocalPlayback.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File Volume queried: C:\Windows FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00424C8F __EH_prolog3_GS,FindFirstFileW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrlenW,lstrcpyW,lstrcatW,SysStringLen,lstrcatW,GetFileAttributesW,lstrcatW,lstrcmpiW,lstrcpynW,lstrcmpiW,lstrcmpiW,SysStringLen,lstrcmpiW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,LZOpenFileW,LZOpenFileW,LZCopy,LZClose,LZClose,DeleteFileW,lstrcpyW,	2_2_00424C8F
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0045145E __EH_prolog3_GS,FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,RemoveDirectoryW,__CxxThrowException@8,DeleteFileW,	2_2_0045145E
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0044F772 GetProcAddress,SearchPathW,GetModuleFileNameW,FindFirstFileW,VirtualQuery,VirtualProtect,VirtualProtect,	2_2_0044F772
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0042BF7F FindFirstFileW,GetFileAttributesW,SetFileAttributesW,DeleteFileW,	2_2_0042BF7F
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00428BE8 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	19_2_00428BE8
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_004466A3 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	19_2_004466A3
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00445710 _memset,FindFirstFileW,FindClose,	19_2_00445710
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003C8BE8 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	22_2_003C8BE8
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003E66A3 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	22_2_003E66A3
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003E5710 _memset,FindFirstFileW,FindClose,	22_2_003E5710
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F466A3 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	27_2_00F466A3
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F28BE8 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	27_2_00F28BE8
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F45710 _memset,FindFirstFileW,FindClose,	27_2_00F45710
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 28_2_700DA685 _memset,FindFirstFileW,FindClose,	28_2_700DA685

Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe

30_2_00C51A50

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_0041C834 CreateFileW,CreateFileMappingW,GetSystemInfo,MapViewOfFile,IsBadReadPtr,UnmapViewOfFile,MapViewOfFile,IsBadReadPtr,GetLastError,

2_2_0041C834

Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\FontData.ini	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: SrTasks.exe, 00000011.00000003.1979159865.000001E88953F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:88
Source: LocalPlayback.exe, 00000002.00000003.2192280789.0000000002CC3000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2191341803.0000000002CB3000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2193014205.0000000002CDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0bIsVirtualMachinesK
Source: LocalPlayback.exe, 00000002.00000003.2199032197.0000000002DEF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2198813545.0000000002DDE000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2434443203.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2423416014.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2199718658.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424223438.0000000002E07000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2173827960.0000000002DCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0bIsVirtualMachine,
Source: LocalPlayback.exe, 00000002.00000003.2173827960.0000000002DCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0bIsVirtualMachine0
Source: LocalPlayback.exe, 00000002.00000003.2173827960.0000000002DCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0bIsVirtualMachine=%ldat.t=0x0000000
Source: LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2432646353.0000000000885000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2425247455.0000000000885000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2195090458.0000000000884000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2194775220.0000000000880000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2188207802.0000000000844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0bIsVirtualMachine4
Source: LocalPlayback.exe, 00000002.00000003.2194282526.000000000089C000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2194108617.0000000000890000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2194743909.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174730969.0000000000890000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2188207802.0000000000890000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196083127.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0_GetVirtualMachineType
Source: LocalPlayback.exe, 00000002.00000003.2173827960.0000000002DCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0bIsVirtualMachine0x00000000
Source: LocalPlayback.exe, 00000002.00000003.1337188638.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2433505889.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424468858.0000000002B83000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2173154921.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1337342198.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2195158245.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1337050034.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197888428.0000000002B83000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1336897127.0000000002B84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _IsVirtualMachine
Source: LocalPlayback.exe, 00000002.00000003.2170880571.0000000005CA2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:m
Source: LocalPlayback.exe, 00000002.00000003.1337188638.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1337342198.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1337050034.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1336897127.0000000002B84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bIsVirtualMachine=%ld
Source: LocalPlayback.exe, 00000002.00000003.1337188638.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1337342198.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1337050034.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1336897127.0000000002B84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bIsVirtualMachine
Source: LocalPlayback.exe, 00000002.00000003.2194282526.000000000089C000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2194108617.0000000000890000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2194743909.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174730969.0000000000890000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2188207802.0000000000890000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196083127.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0_IsVirtualMachine\|
Source: LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AddIconCallDLLFnComponentViewCreateWindowComponentViewDestroyComponentViewRefreshComponentViewSelectAllComponentViewSetInfoComponentViewSetInfoExCreateFolderDeleteFolderDeleteIconEnableHourGlassEnumFoldersItemsGetCPUTypeGetFontSubGetHandleGetPortsGetSelectedItemStateIsEmptyIsNTAdminIsOSTypeNTIsObjectIsPowerUserLangLoadStringMessageBeepPPathCompactPathPixelPathCrackUrlPathGetDirPathGetDrivePathGetFilePathGetFileExtPathGetFileNamePathGetLongFromShortPathGetPathPathIsValidSyntaxQueryIconReadArrayPropertyReadBoolPropertyReadNumberPropertyReplaceIconShowFolderTextSubSubstituteVerGetFileVersionWriteArrayPropertyWriteBoolPropertyWriteNumberPropertyWriteStringProperty_AppSearch_BrowseForFolder_CCPSearch_CHARArrayToWCHARArray_CalculateAndAddFileCost_CleanupInet_CloseFile_CmdGetHwndDlg_CmdGetMsg_CmdGetParam1_CmdGetParam2_CoGetObject_CompareDWORD_ComponentAddItem_ComponentCompareSizeRequired_ComponentError_ComponentErrorInfo_ComponentFileEnum_ComponentFileInfo_ComponentFilterLanguage_ComponentFilterOS_ComponentGetCost_ComponentGetCostEx_ComponentGetData_ComponentGetItemSize_ComponentGetTotalCost_ComponentGetTotalCostEx_ComponentInitialize_ComponentIsItemSelected_ComponentListItems_ComponentLoadTarget_ComponentMoveData_ComponentPatch_ComponentReinstall_ComponentRemoveAll_ComponentRemoveAllInLogOnly_ComponentSaveTarget_ComponentSelectItem_ComponentSelectNew_ComponentSetData_ComponentSetupTypeEnum_ComponentSetupTypeGetData_ComponentSetupTypeSet_ComponentTotalSize_ComponentTransferData_ComponentUpdate_ComponentValidate_ComponentViewCreate_ComponentViewQueryInfo_CopyBytes_CreateDir_CreateObject_CreateRegistrySet_CreateShellObjects_CtrlGetNotificationCode_CtrlGetParentWindowHelper_CtrlGetSubCommand_CtrlGetUrlForLinkClicked_CtrlSetHtmlContent_CtrlSetMLERichText_DIFxDriverPackageGetPath_DIFxDriverPackageInstall_DIFxDriverPackagePreinstall_DIFxDriverPackageUninstall_DefineDialog_DeleteCHARArray_DialogSetFont_DisableBranding_DisableStatus_Divide_DoInstall_DoSprintf_DotNetCoCreateObject_DotNetUnloadAppDomain_EnableDialogCache_EnablePrevDialog_EnableSkins_EnableStatus_EnableWow64FsRedirection_EndDialog_ExistsDir_ExistsDisk_ExistsFile_ExitInstall_FeatureAddCost_FeatureAddUninstallCost_FeatureGetCost_FeatureInitialize_FeatureSpendCost_FeatureSpendUninstallCost_FileCopy_FloatingPointOperation_GenerateFileMD5SignatureHex_GetByte_GetCurrentDialogName_GetDiskInfo_GetDiskSpaceEx_GetDiskSpaceExEx_GetFont_GetGlobalFlags_GetGlobalMemorySize_GetInetFileSize_GetInetFileTime_GetLine_GetLineSize_GetObject_GetObjectByIndex_GetObjectCount_GetProcessorInfo_GetRunningChildProcess_GetRunningChildProcessEx_GetRunningChildProcessEx2_GetSelectedTreeComponent_GetStandardLangId_GetSupportDir_GetSystemDpi_GetTrueTypeFontFileInfo_GetVirtualMachineType_InetEndofTransfer_InetGetLastError_InetGetNextDisk_InitInstall_IsFontTypefaceNameAvailable_IsInAdminGroup_IsLangSupported_IsSkinLoaded_IsVirtualMachine_IsWindowsME_IsWow64_KillProcesses_ListAddItem_ListAddString_ListCount_ListCreate_ListCurrentIte
Source: LocalPlayback.exe, 0000001E.00000003.2198854322.00000000034CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware&prod_virtual_disk#4&1
Source: SrTasks.exe, 00000011.00000003.1979159865.000001E88953F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: SrTasks.exe, 00000011.00000003.1983702371.000001E8894F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:5
Source: SrTasks.exe, 00000011.00000003.1982316287.000001E88953F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CVMWar&Prod_VMware_SATA_CD00d
Source: LocalPlayback.exe, 0000001E.00000003.2196516371.0000000003502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}g
Source: LocalPlayback.exe, 00000002.00000002.2431896583.00000000007E2000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424572499.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0_IsVirtualMachine
Source: LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _GetVirtualMachineType
Source: LocalPlayback.exe, 00000002.00000003.2192280789.0000000002CC3000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2191341803.0000000002CB3000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2193014205.0000000002CDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0bIsVirtualMachine=%ld
Source: LocalPlayback.exe, 0000001E.00000002.2563398991.00000000033A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000P4
Source: LocalPlayback.exe, 00000002.00000003.2199032197.0000000002DEF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2198813545.0000000002DDE000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2434443203.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2423416014.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2199718658.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424223438.0000000002E07000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2173827960.0000000002DCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0_GetVirtualMachineTypeieZ
Source: LocalPlayback.exe, 00000002.00000003.2199032197.0000000002DEF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2198813545.0000000002DDE000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2434443203.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2423416014.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2432646353.0000000000885000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2425247455.0000000000885000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2193014205.0000000002CA8000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2199718658.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2195090458.0000000000884000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0bIsVirtualMachine
Source: LocalPlayback.exe, 0000001E.00000002.2574803336.000000006C7F3000.00000008.00000001.01000000.00000017.sdmp	Binary or memory string: cfl.?AVQEmulationPaintEngine@@
Source: LocalPlayback.exe, 0000001E.00000002.2574803336.000000006C7F3000.00000008.00000001.01000000.00000017.sdmp	Binary or memory string: .?AVQEmulationPaintEngine@@

Source: C:\Users\user\Desktop\LocalPlayback.exe	API call chain: ExitProcess graph end node	graph_2-79928
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_00464AFE _memset,IsDebuggerPresent,

2_2_00464AFE

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_00479B1B EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_00479B1B

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_00495AB0 LoadLibraryW,GetProcAddress,MonitorFromPoint,GetDC,GetDeviceCaps,ReleaseDC,MulDiv,FreeLibrary,

2_2_00495AB0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_0046A319 GetProcessHeap,

2_2_0046A319

Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_00463457 SetUnhandledExceptionFilter,	2_2_00463457
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: 2_2_0046347A SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0046347A
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Code function: 6_2_00007FF75D26DCD4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF75D26DCD4
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe	Code function: 6_2_00007FF75D2707D8 SetUnhandledExceptionFilter,	6_2_00007FF75D2707D8
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_0043A0AC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_0043A0AC
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00438A42 SetUnhandledExceptionFilter,	19_2_00438A42
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Code function: 19_2_00437EAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_00437EAA
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003DA0AC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_003DA0AC
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003D8A42 SetUnhandledExceptionFilter,	22_2_003D8A42
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Code function: 22_2_003D7EAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_003D7EAA
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F3A0AC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_00F3A0AC
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F38A42 SetUnhandledExceptionFilter,	27_2_00F38A42
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 27_2_00F37EAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	27_2_00F37EAA
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 28_2_700DB88C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_700DB88C
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Code function: 28_2_700DC9C1 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_700DC9C1
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_00D0D288 ?terminate@@YAXXZ,__crtSetUnhandledExceptionFilter,	30_2_00D0D288
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: 30_2_01246266 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	30_2_01246266

HIPS / PFW / Operating System Protection Evasion

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe "c:\users\user\appdata\local\temp\{77f7b223-84f4-43ae-9469-cc107488bb8b}\{6674bcc5-bc57-446b-b83b-fa53501e0fdc}\vcredist_x64_2013.exe" /q -burn.unelevated burnpipe.{0942dd9a-af4a-432e-bd2d-a92ffbedb9e9} {f3730af5-9ee5-4b54-a568-50e8ba9679b4} 1876
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Process created: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe "c:\users\user\appdata\local\temp\{77f7b223-84f4-43ae-9469-cc107488bb8b}\{6674bcc5-bc57-446b-b83b-fa53501e0fdc}\vcredist_x64_2013.exe" /q -burn.unelevated burnpipe.{0942dd9a-af4a-432e-bd2d-a92ffbedb9e9} {f3730af5-9ee5-4b54-a568-50e8ba9679b4} 1876

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_0041B88A __EH_prolog3_GS,_memset,_memset,_memset,_memset,_memset,_memset,InitializeSecurityDescriptor,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,SetSecurityDescriptorDacl,CoInitializeSecurity,

2_2_0041B88A

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_0045004E GetCurrentThread,OpenThreadToken,GetLastError,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,

2_2_0045004E

Source: LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2432330466.000000000085A000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2201835616.0000000000859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OPTYPE_PROGMAN
Source: LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2201787489.0000000000860000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196340763.000000000084F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OPTYPE_PROGMAN7j
Source: LocalPlayback.exe, 00000002.00000003.1302943701.0000000002920000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: ISLOG_VERSION_INFO..\..\..\Shared\LogServices2\LogDB.cppOPTYPE_PROGMANISLOGDB_USER_PROPERTIES<
Source: LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2432330466.000000000085A000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2201835616.0000000000859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OPTYPE_PROGMANes
Source: LocalPlayback.exe, 0000001E.00000002.2573965503.000000006C1B4000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: QTrayIconMessageWindowClassTaskbarCreatedChangeWindowMessageFilterExuser32ChangeWindowMessageFilterThe platform plugin failed to create a message window.Shell_NotifyIconGetRectShell_TrayWndTrayNotifyWndSysPagerToolbarWindow32`

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_004634AA cpuid

2_2_004634AA

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,GetLocaleInfoW,	2_2_0046DC40
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	2_2_00469E2F
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_00479E97
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: EnumSystemLocalesW,	2_2_0046DEB0
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_0046DF0C
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_0046DF89
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,	2_2_0046E00C
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: GetLocaleInfoW,	2_2_0046E1FF
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale,	2_2_0041237B
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_0046E327
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	2_2_0046E3D4
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: _memset,_TranslateName,_TranslateName,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	2_2_0046E4A8
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: EnumSystemLocalesW,	2_2_0046E9A7
Source: C:\Users\user\Desktop\LocalPlayback.exe	Code function: GetLocaleInfoW,	2_2_0046EA2D
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Code function: GetLocaleInfoA,	30_2_01262289

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\LocalPlayback.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LocalPlayback.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\logo.png VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\logo.png VolumeInformation
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\logo.png VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\platforms\qminimal.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\platforms\qminimald.pdb VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\platforms\qoffscreen.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\platforms\qoffscreend.pdb VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\platforms\qwindowsd.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\platforms\qwindowsd.pdb VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\plugins\styles\CommonStyle.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\plugins\styles\CommonStyle_D.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\translations\LocalPlayback_en.qm VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\translations\ToolGuiToolkit_en.qm VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\translations\ToolShareModule_en.qm VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\plugins\skins\CommonSkin.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\plugins\styles\CommonStyle.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\imageformats\qdds.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\imageformats\qddsd.pdb VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\imageformats\qgif.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\imageformats\qgifd.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\imageformats\qtiffd.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdb VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.dll VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\Program Files (x86)\LocalPlayback\Settings.xml VolumeInformation
Source: C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe

Code function: 19_2_004135A5 ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,CreateNamedPipeW,GetLastError,

19_2_004135A5

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_0043A720 __EH_prolog3_GS,GetCurrentProcessId,_memset,GetLocalTime,GetModuleFileNameW,

2_2_0043A720

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe

Code function: 19_2_00419A5A GetUserNameW,GetLastError,

19_2_00419A5A

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe

Code function: 19_2_00447D79 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

19_2_00447D79

Source: C:\Users\user\Desktop\LocalPlayback.exe

Code function: 2_2_004501B9 GetVersion,

2_2_004501B9

Source: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	4 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	12 System Time Discovery	Remote Services	11 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	13 Command and Scripting Interpreter	22 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	11 Registry Run Keys / Startup Folder	22 Windows Service	11 Install Root Certificate	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	3 Process Injection	2 Software Packing	NTDS	5 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	37 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	41 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Masquerading	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	3 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LocalPlayback.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\ISS80A0.tmp	4%	ReversingLabs
C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\ISSetup.dll (copy)	4%	ReversingLabs
C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\set7FB5.tmp	0%	ReversingLabs
C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\setup.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Ana83C2.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\AnalyzeData.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Aud83F2.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\AudioRender.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\D3D8452.tmp	3%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\D3D84EF.tmp	3%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\D3DCompiler_43.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\D3DX9_43.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Eag859C.tmp	3%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\EagleEyeRender.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCC8669.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCCore.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCN86B8.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCN86E8.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDK.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Ana9465.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\AnalyzeData.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Aud9485.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\AudioIntercom.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\DsS94A6.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\DsSdk.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCA9581.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCAlarm.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCC95A3.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCCoreDevCfg.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCD95D2.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCDisplay.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCG95F3.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCGeneralCfgMgr.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCI9643.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCIndustry.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCP9663.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCP9683.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCPlayBack.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCPreview.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCV96C4.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCVoiceTalk.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Ope9753.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\OpenAL32.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Str9774.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\StreamTransClient.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Sys9794.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\SystemTransform.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\lib96F4.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\libiconv2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\msv9724.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\msvcr90.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HCNetUtils.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HDF8747.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HDFileSDK.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HWD8787.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\HWDecode.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Loc8846.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\MP_8904.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\MP_8925.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\MP_Render.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\MP_VIE.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Ope89B2.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\OpenAL32.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Pla89D3.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\PlayCtrl.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt58AAE.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt58B6B.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt58C27.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt58C67.tmp	2%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt58C87.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt58D82.tmp	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt5Core.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt5Gui.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt5Network.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt5PrintSupport.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt5Widgets.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\LocalPlayback\Qt5Xml.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hikdownload.hik-connect.com	49.51.129.211	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.phreedom.org/md5)	LocalPlayback.exe, 0000001E.00000002.2571774893.000000006B4F0000.00000002.00000001.01000000.00000021.sdmp	false		unknown
http://=0x%04x.iniMS	LocalPlayback.exe, 00000002.00000000.1288293705.00000000004AD000.00000002.00000001.01000000.00000004.sdmp, LocalPlayback.exe, 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmp	false		unknown
http://www.phreedom.org/md5)08:27	LocalPlayback.exe, 0000001E.00000002.2571774893.000000006B4F0000.00000002.00000001.01000000.00000021.sdmp	false		unknown
http://wixtoolset.org/schemas/thmutil/2010	vcredist_x86.exe, 00000014.00000003.1868826765.0000000002ADB000.00000004.00000800.00020000.00000000.sdmp, vcredist_x86.exe, 00000014.00000003.1869418883.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 00000014.00000003.1793238511.000000000062F000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64_2013.exe, 00000017.00000003.1934969780.00000000018B0000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64_2013.exe, 00000017.00000003.1933566497.000000000391B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x86.exe, 0000001B.00000003.1935920151.0000000000652000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 0000001C.00000002.2560839508.0000000002E60000.00000004.00000800.00020000.00000000.sdmp, vcredist_x86.exe, 0000001C.00000002.2556580978.0000000000920000.00000004.00000020.00020000.00000000.sdmp, vcredist_x86.exe, 0000001C.00000003.1938300398.00000000009AD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.adobe.co	LocalPlayback.exe, 0000001E.00000002.2564948444.0000000003917000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.thawte.com0	LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.company.comt	LocalPlayback.exe, 00000002.00000003.1337188638.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2433505889.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424468858.0000000002B83000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1337342198.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2195158245.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1337050034.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197888428.0000000002B83000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1336897127.0000000002B84000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2428892620.0000000002B83000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://qt-project.org/xml/features/report-whitespace-only-CharData	LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	false		unknown
http://www.hikvision.comX	LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2188207802.0000000000844000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/features/namespaces	LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	false		unknown
http://deviis4.installshield.com/NetNirvana/m	LocalPlayback.exe, 00000002.00000003.2174730969.0000000000844000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2196340763.000000000084F000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2188207802.0000000000844000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://hikdownload.hik-connect.com/4200/tool/windows/LocalPlayback/v/standard/en/LocalPlayback	LocalPlayback.exe, 0000001E.00000002.2565211131.0000000003A2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/features/namespaceshttp://xml.org/sax/features/namespace-prefixeshttp://trolltech	LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	false		unknown
http://deviis4.installshield.com/NetNirvana/	LocalPlayback.exe, 00000002.00000003.2197605938.0000000000855000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/features/namespace-prefixes	LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	false		unknown
http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d	LocalPlayback.exe, LocalPlayback.exe, 00000002.00000000.1288293705.00000000004AD000.00000002.00000001.01000000.00000004.sdmp, LocalPlayback.exe, 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmp, LocalPlayback.exe, 00000002.00000003.1329950331.0000000002B70000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1965739685.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1965894729.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1313616804.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1964381135.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1302943701.0000000002920000.00000040.00001000.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1304570653.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1303819742.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1315533478.00000000007EF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://bugreports.qt.io/	LocalPlayback.exe, 0000001E.00000002.2571774893.000000006B4F0000.00000002.00000001.01000000.00000021.sdmp	false		unknown
http://hikdownload.hik-connect.com/4200/tool/windows/LocalPlayback/v/standard/en/LocalPlayback.exeF	LocalPlayback.exe, 0000001E.00000002.2565211131.0000000003A2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.hikvision.comCT	LocalPlayback.exe, 00000002.00000003.2424684901.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436551431.0000000005CB1000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2198375398.0000000005CAF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197831927.0000000005CA7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://wixtoolset.org/schemas/thmutil/2010cessR	vcredist_x64_2013.exe, 00000017.00000003.1933566497.000000000391B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.hikvision.comER	LocalPlayback.exe, 00000002.00000003.2424684901.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436551431.0000000005CB1000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2198375398.0000000005CAF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197831927.0000000005CA7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	LocalPlayback.exe, 00000002.00000003.1328776964.000000000087D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hikvision.comal	LocalPlayback.exe, 00000002.00000003.1313616804.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1304570653.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1303819742.00000000007EF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1315533478.00000000007EF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.hikvision.com	LocalPlayback.exe, 00000002.00000003.1337342198.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2424684901.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2190273382.0000000005CAF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2186596203.0000000005CA2000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000002.2436551431.0000000005CB1000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1329950331.0000000002B70000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1965739685.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1965894729.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.1964381135.0000000006600000.00000004.00000800.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2170880571.0000000005CA2000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2198375398.0000000005CAF000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197831927.0000000005CA7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.hikvision.com4	LocalPlayback.exe, 00000002.00000003.2196340763.000000000084F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://qt-project.org/xml/features/report-start-end-entity	LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	false		unknown
http://wixtoolset.org/schemas/thmutil/2010o	vcredist_x64_2013.exe, 00000017.00000003.1933566497.000000000391B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://trolltech.com/xml/features/report-start-end-entity	LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	false		unknown
http://www.hikvision.coml=%ld	LocalPlayback.exe, 00000002.00000003.2195158245.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2197888428.0000000002B83000.00000004.00000020.00020000.00000000.sdmp, LocalPlayback.exe, 00000002.00000003.2200256507.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.company.com	LocalPlayback.exe, 00000002.00000003.1336775342.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://trolltech.com/xml/features/report-whitespace-only-CharData	LocalPlayback.exe, 0000001E.00000002.2571320041.000000006B3F9000.00000002.00000001.01000000.00000022.sdmp	false		unknown
http://bugreports.qt.io/finishedServerMicrosoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogic	LocalPlayback.exe, 0000001E.00000002.2571774893.000000006B4F0000.00000002.00000001.01000000.00000021.sdmp	false		unknown
http://hikdownload.hik-connect.com/4200/tool/windows/LocalPlayback/v/standard/en/LocalPlayback.exe	LocalPlayback.exe, 0000001E.00000002.2565211131.0000000003A2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://hikdownload.hik-connect.com.pngloseView.pngr.Q	LocalPlayback.exe, 0000001E.00000002.2563943582.00000000035A0000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
49.51.129.211	hikdownload.hik-connect.com	China		132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541117
Start date and time:	2024-10-24 12:58:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LocalPlayback.exe
Detection:	SUS
Classification:	sus24.bank.evad.winEXE@29/455@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 153 Number of non-executed functions: 221
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, VSSVC.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: LocalPlayback.exe

Simulations

Behavior and APIs

Time	Type	Description
08:55:49	API Interceptor	29x Sleep call for process: SrTasks.exe modified
08:56:29	API Interceptor	679x Sleep call for process: LocalPlayback.exe modified
14:55:54	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce {f65db027-aff3-4070-886a-0d87064aabb1} "C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe" /burn.runonce

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	powerpc.elf	Get hash	malicious	Unknown	Browse	124.157.170.101
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	49.51.77.119
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	101.34.109.211
	PO 635614 635613_CQDM.html	Get hash	malicious	HTMLPhisher	Browse	162.62.150.176
	m68k.elf	Get hash	malicious	Unknown	Browse	124.156.108.17
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	101.48.49.48
	https://api-restauration.basiic.net/fWmcv/	Get hash	malicious	Unknown	Browse	162.62.150.176
	https://thebatallangroup.taplink.ws/	Get hash	malicious	Unknown	Browse	49.51.78.226
	https://apeidieppe-d.basiic.net/yKKWd	Get hash	malicious	HTMLPhisher	Browse	162.62.150.176
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	129.226.56.200

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	14057
Entropy (8bit):	5.488271135042784
Encrypted:	false
SSDEEP:	192:4dEDaVRVKBWYkGMFEpbpeHdCRI6AkIRiCRI6AkyRBDEHot42npNaeX:4lpspBJ
MD5:	25B6B5C70F03E72F513BA984BEADB982
SHA1:	DE1E2111B019DDCFD6562021B9ACB01C3E3D95F1
SHA-256:	AD2AA131E0A191F3C78FD5233F314343FABE2EDC09D83A1839FAC772A9D61703
SHA-512:	AE54F888A3E7C448F31C9E136A213D82A3F51D579B468BCCC8C539B0F635E23811E1087441E88F2BA208B69EEEF3302008D183AF5D19DE98B59FD1671E611631
Malicious:	false
Preview:	...@IXOS.@.....@.FXY.@.....@.....@.....@.....@.....@......&.{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}:.Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005..vc_runtimeMinimum_x86.msi.@.....@.R...@.....@........&.{E9934153-EAB1-4DA6-AA72-86C8BB1EDF2C}.....@.....@.....@.....@.......@.....@.....@.......@....:.Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{FE80AAC7-9373-345B-8C89-01D4359338F8}&.{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}.@......&.{0835C947-D6D2-4E52-AF14-0231D04E88EA}&.{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}.@......&.{74260D9F-D644-423B-B2D4-0291EA4BA8BE}&.{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}.@......&.{63B83B20-1AB9-4F49-B0B2-4489724CA96C}&.{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}.@......&.{E08DC543-ADA7-466B-B629-CE908DD9BDE3}&.{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}.@......&.{1A7754D3-744B-439A-B284-BD7A1C24FCFA}&.{

C:\Config.Msi\6c4c92.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	20505
Entropy (8bit):	5.349610899906326
Encrypted:	false
SSDEEP:	384:Bz4VaeqQi1qb3k/CogAAl4f92jY0E1iKCy/v755kFTvq5kFT1eEfvc:Bt2jY0E1iKCAXv
MD5:	DE07C7A16D52E6553E5113DE838373E9
SHA1:	1B84B4D12C1331308170B2EF1182DF921CBCA597
SHA-256:	5AF31913F9E25C3124721D02BDB02BA073B63247997B11823B826F3275523F31
SHA-512:	E76106E8E656D15A40A366D16D0ADA69098A0206FA869E6C375F50EF1203470D8F3141C3DE3BD2A87945CC5367DF8288223B8CE72B946244BB1454C3FD0D8459
Malicious:	false
Preview:	...@IXOS.@.....@.FXY.@.....@.....@.....@.....@.....@......&.{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}=.Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005..vc_runtimeAdditional_x86.msi.@.....@.R...@.....@........&.{5703FD24-BF2D-4D14-AB2F-E415A0361E63}.....@.....@.....@.....@.......@.....@.....@.......@....=.Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{1D481A21-C43F-38B9-B0D1-E090FD2D2643}&.{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}.@......&.{7EA36934-F736-408F-BD04-A2A710E04773}&.{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}.@......&.{B5B46CD9-9426-401F-9C3B-646807EFE00B}&.{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}.@......&.{D4263C2B-DA4A-4000-A8E0-4BE8E46A9A3C}&.{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}.@......&.{271E5C92-3536-4282-9ABF-449A91B8C2D7}&.{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}.@......&.{8E4244B1-6F8F-4EA0-AC6A-346DE7C

C:\Config.Msi\6c4c96.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	14067
Entropy (8bit):	5.530529869170216
Encrypted:	false
SSDEEP:	192:8TJpMVUu+Rc7wyetdHAkIgHAkxr9E3cjM2npb4:8TXMVUu+RNgwguO
MD5:	174871875C488C4C78E3A9322598A55A
SHA1:	BFB939480AFEE497AFBC329C644652F981548D61
SHA-256:	6CD4D3B7CA1D2AD9D436D0E3BB040EEA2445B21DC76C826F5877DF94D94D6F8A
SHA-512:	8DDA1665BC63C0A42E368DC66B6BDE6329A656CBCC28E3ABF306EA2A70AAFCC6B4B968006D15A791444414A7A268D3E65BFF6EDA7BDAF1977D7E443305FDE1CF
Malicious:	false
Preview:	...@IXOS.@.....@.GXY.@.....@.....@.....@.....@.....@......&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005..vc_runtimeMinimum_x64.msi.@.....@.R...@.....@........&.{FE26E34E-F44B-4B4D-A2C9-878D87759F44}.....@.....@.....@.....@.......@.....@.....@.......@....:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{BC1F4291-6F0A-38EB-984E-C2E555837FE1}&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}.@......&.{E5B92048-5859-4AF1-AEAD-B97EBF00B087}&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}.@......&.{570C624B-D57C-4CD1-9013-1B80C800093B}&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}.@......&.{14E8634F-8AEA-4CD1-AC48-BEBFDA18523A}&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}.@......&.{4C723A6F-9201-44D8-BE75-E08B5D104F85}&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}.@......&.{EFA0F8A1-F16D-4E44-8EE4-2CD86E1D12F4}&.{

C:\Config.Msi\6c4c9a.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	20517
Entropy (8bit):	5.349151388392472
Encrypted:	false
SSDEEP:	384:8RH4oM7QduPrfgoog5QAfCuS588U+LcucBlXDxMe:8RH4oM7QduPrfgoog5W367
MD5:	F3F6076B3C671E620793E3217F415CBA
SHA1:	F49422BFD25CD2D3B3A73EFB85D04224B1F34F5B
SHA-256:	507432E9E2EB6D1B87E6D28E9C7FD64678C94E04317DD9A8D9260D01CCD7F01B
SHA-512:	D7A3252DE43ADAD3C888961548A0CF7DCCA0DE63D55B3BC61C23F8BE3B95901867F05FDFCEC4CAC8736F6B33F3B6BFE3604690023B4AB47447032A837D7CF7B2
Malicious:	false
Preview:	...@IXOS.@.....@.GXY.@.....@.....@.....@.....@.....@......&.{929FBD26-9020-399B-9A7A-751D61F0B942}=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005..vc_runtimeAdditional_x64.msi.@.....@.R...@.....@........&.{0990E7AB-85D7-456A-B8F8-1E1E56A29571}.....@.....@.....@.....@.......@.....@.....@.......@....=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{191E6DE4-E7B2-3CE9-B48B-25D0FFF3D88E}&.{929FBD26-9020-399B-9A7A-751D61F0B942}.@......&.{E70078E7-D25B-421C-A415-0AB472053F72}&.{929FBD26-9020-399B-9A7A-751D61F0B942}.@......&.{7D2EA505-A879-4E71-8632-F3DE9B679CE6}&.{929FBD26-9020-399B-9A7A-751D61F0B942}.@......&.{1F74928D-AA17-468C-A7D7-6A730A8DB25B}&.{929FBD26-9020-399B-9A7A-751D61F0B942}.@......&.{ECA05A2B-D2CC-43F5-B3B4-6501C6C75D8B}&.{929FBD26-9020-399B-9A7A-751D61F0B942}.@......&.{ABE93925-6BF3-4948-90FF-1E4DF15

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\0x0409.ini (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	22490
Entropy (8bit):	3.484827950705229
Encrypted:	false
SSDEEP:	384:CTmyuV//BiTbh/Y4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/N/lWr0aa0Mhs+XVgv
MD5:	8586214463BD73E1C2716113E5BD3E13
SHA1:	F02E3A76FD177964A846D4AA0A23F738178DB2BE
SHA-256:	089D3068E42958DD2C0AEC668E5B7E57B7584ACA5C77132B1BCBE3A1DA33EF54
SHA-512:	309200F38D0E29C9AAA99BB6D95F4347F8A8C320EB65742E7C539246AD9B759608BD5151D1C5D1D05888979DAA38F2B6C3BF492588B212B583B8ADBE81FA161B
Malicious:	false
Preview:	..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\0x0804.ini (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10758
Entropy (8bit):	5.783506671145112
Encrypted:	false
SSDEEP:	192:Nw8vvP/KID2jmYt1bRNJQYRyljRpRIHDJCL0PvrmeAdovo/BVEU3EDa+7VUX7AoU:7XD6bP9PvabCU6l7
MD5:	6F4C6D5B044895684A1E11BFE98B2ABD
SHA1:	45EFEC6E70E66A248B25ED1437BC336B846F6F19
SHA-256:	792E2ED82640E22F9D86F19EC34FD4BB89450B8B874EDEB4FDCBE07935A63110
SHA-512:	04727EB781330FD11C2B3ADECDECE5FA6ED9501061497E41EFE9ED528C2E95A724AD8E6D02180F31C6E810C28F94751E6944FCDB6D7415C338BBF5CF82726973
Malicious:	false
Preview:	..[.P.r.o.p.e.r.t.i.e.s.].....F.o.n.t.N.a.m.e.=..[SO....F.o.n.t.S.i.z.e.=.9.........[.0.x.0.8.0.4.].....1.1.0.0.=..[..z.^.R.Y.S.......1.1.0.1.=.%.s.....1.1.0.2.=.%.1. ..[..z.^ck(W.Q.Y .%.2....[.\._.[.`.[.biRYO.v.[...z.0...z.P.0....1.1.0.3.=.ck(W.h.g.d\O.\|.~Hr,g....1.1.0.4.=.ck(W.h.g .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .Hr,g....1.1.0.5.=.ck(WM.n. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.ck(WM.n. .%.s.....1.1.0.7.=..[..z.^.](W.`.v.\|.~-N.[.b.N .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. ..vM.n..0 .......e/T.R.\|.~.N.O.~.~.[..0 ...US.Q. ..e/T.R. eg..e/T.R.\|.~.0....1.1.0.8.=.%.s.....1.1.2.5.=....b.[..z.^.v.......1.1.2.6.=..N.N.N..y.-N...bdk.[..z.^.v....0....1.1.2.7.=.I.n.s.t.a.l.l.e.r. .._{...e/T.R.`.v.\|.~..Mb...[.b .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. ..g.R.vM.n..0US.Q"./f"..S.zsS..e/T.R..US.Q".&T"..R.S(W.N.T/T.R.0....1.1.2.8.=..[..z.^.\.[.b .'.%.s.'. ..f.e.0/f&T.~.~......1.1.2.9.=.dk:ghV.].[....eHr .'.%.s.'..0.[..e.l.~.~.0....1.1.3.0.=.nx.[....1.1.3.1.=..S.m....1.

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\0x0814D.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10758
Entropy (8bit):	5.783506671145112
Encrypted:	false
SSDEEP:	192:Nw8vvP/KID2jmYt1bRNJQYRyljRpRIHDJCL0PvrmeAdovo/BVEU3EDa+7VUX7AoU:7XD6bP9PvabCU6l7
MD5:	6F4C6D5B044895684A1E11BFE98B2ABD
SHA1:	45EFEC6E70E66A248B25ED1437BC336B846F6F19
SHA-256:	792E2ED82640E22F9D86F19EC34FD4BB89450B8B874EDEB4FDCBE07935A63110
SHA-512:	04727EB781330FD11C2B3ADECDECE5FA6ED9501061497E41EFE9ED528C2E95A724AD8E6D02180F31C6E810C28F94751E6944FCDB6D7415C338BBF5CF82726973
Malicious:	false
Preview:	..[.P.r.o.p.e.r.t.i.e.s.].....F.o.n.t.N.a.m.e.=..[SO....F.o.n.t.S.i.z.e.=.9.........[.0.x.0.8.0.4.].....1.1.0.0.=..[..z.^.R.Y.S.......1.1.0.1.=.%.s.....1.1.0.2.=.%.1. ..[..z.^ck(W.Q.Y .%.2....[.\._.[.`.[.biRYO.v.[...z.0...z.P.0....1.1.0.3.=.ck(W.h.g.d\O.\|.~Hr,g....1.1.0.4.=.ck(W.h.g .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .Hr,g....1.1.0.5.=.ck(WM.n. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.ck(WM.n. .%.s.....1.1.0.7.=..[..z.^.](W.`.v.\|.~-N.[.b.N .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. ..vM.n..0 .......e/T.R.\|.~.N.O.~.~.[..0 ...US.Q. ..e/T.R. eg..e/T.R.\|.~.0....1.1.0.8.=.%.s.....1.1.2.5.=....b.[..z.^.v.......1.1.2.6.=..N.N.N..y.-N...bdk.[..z.^.v....0....1.1.2.7.=.I.n.s.t.a.l.l.e.r. .._{...e/T.R.`.v.\|.~..Mb...[.b .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. ..g.R.vM.n..0US.Q"./f"..S.zsS..e/T.R..US.Q".&T"..R.S(W.N.T/T.R.0....1.1.2.8.=..[..z.^.\.[.b .'.%.s.'. ..f.e.0/f&T.~.~......1.1.2.9.=.dk:ghV.].[....eHr .'.%.s.'..0.[..e.l.~.~.0....1.1.3.0.=.nx.[....1.1.3.1.=..S.m....1.

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\0x0817D.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	22490
Entropy (8bit):	3.484827950705229
Encrypted:	false
SSDEEP:	384:CTmyuV//BiTbh/Y4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/N/lWr0aa0Mhs+XVgv
MD5:	8586214463BD73E1C2716113E5BD3E13
SHA1:	F02E3A76FD177964A846D4AA0A23F738178DB2BE
SHA-256:	089D3068E42958DD2C0AEC668E5B7E57B7584ACA5C77132B1BCBE3A1DA33EF54
SHA-512:	309200F38D0E29C9AAA99BB6D95F4347F8A8C320EB65742E7C539246AD9B759608BD5151D1C5D1D05888979DAA38F2B6C3BF492588B212B583B8ADBE81FA161B
Malicious:	false
Preview:	..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\ISS80A0.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	798720
Entropy (8bit):	7.77027621741067
Encrypted:	false
SSDEEP:	12288:Uw8lkARCPhAWiNHDCd5wpZYOu/ssZJzDD5guP2KpSxxoH0M:Uw8yQCPhQaosZhDvpSxyU
MD5:	F9F00FD142530C2B5892F46B8F1A036B
SHA1:	3EF804D63252E8686F81AF8206E15DCD24A0E0B8
SHA-256:	8437A9931CCA96AB8477D371A19ECFAE094E4C54EC58C364B37401FA2E649653
SHA-512:	52AE1AD381E3FC20D7C05AF525552F8CD444DABA485D86DD0E61186C7E2815BFF011632E01AB305A83EC252B88F5CC0844E9982E3C78270566BD93065A2FEE57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........h2...\...\...\.u.....\......\....a.\.....\..~....\..~....\...]...\..~....\.I....\.I....\.I...\.I....\.I....\.......\.I....\.Rich..\.................PE..L......U...........!....."...(........%......@................................%.....#................................{%.G.....%.R.....#.......................%......H..8............................................................................text....p#.............PEC2MO...... ....rsrc.........#...... .............. ....reloc........%.....................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\ISSetup.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	798720
Entropy (8bit):	7.77027621741067
Encrypted:	false
SSDEEP:	12288:Uw8lkARCPhAWiNHDCd5wpZYOu/ssZJzDD5guP2KpSxxoH0M:Uw8yQCPhQaosZhDvpSxyU
MD5:	F9F00FD142530C2B5892F46B8F1A036B
SHA1:	3EF804D63252E8686F81AF8206E15DCD24A0E0B8
SHA-256:	8437A9931CCA96AB8477D371A19ECFAE094E4C54EC58C364B37401FA2E649653
SHA-512:	52AE1AD381E3FC20D7C05AF525552F8CD444DABA485D86DD0E61186C7E2815BFF011632E01AB305A83EC252B88F5CC0844E9982E3C78270566BD93065A2FEE57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........h2...\...\...\.u.....\......\....a.\.....\..~....\..~....\...]...\..~....\.I....\.I....\.I...\.I....\.I....\.......\.I....\.Rich..\.................PE..L......U...........!....."...(........%......@................................%.....#................................{%.G.....%.R.....#.......................%......H..8............................................................................text....p#.............PEC2MO...... ....rsrc.........#...... .............. ....reloc........%.....................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\dat7B00.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	29396
Entropy (8bit):	3.720172973516485
Encrypted:	false
SSDEEP:	768:P9aaIZIO6SaJvO95Zgp8X8+/lb+/DQS+PBZb+PzcF:1k7pZb8W
MD5:	507BDDD8FD510775FAFEB4BCDDE7BC7D
SHA1:	BD34B3D2BD37CC19940ED93F1759CDE97B68CCEB
SHA-256:	8650F75584B0BFA0D84008F51BAEC549D95F933BC6B26258E46551BA968C2213
SHA-512:	7CA6DB89A27645398A2884EB2B1437AC68A3E56CA6FC62810645E8D46824436E21B23F26CA28DCF51E51E947FA43C09EABABE0C7574E1E080376FE6C95CE2031
Malicious:	false
Preview:	ISc(............A'...r..........................................................................B~.....................................................................................................................................................................................................................................................J....................................tfW.kD.;.SP...................x.7..[.B....i.o.AA..L..F.IJ.E.A.N.._p..H...L.B.....................................................s...........A'.......I...I..........@.......@.....................W...c...................................o...........{...................................................................................................................................................................#.........................../...............................;...............G...........S..................................._.......................k...w.....................................................

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\dat7B01.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	14335896
Entropy (8bit):	7.999178331190897
Encrypted:	true
SSDEEP:	393216:Bxr9hG1A2fooVWrydkkzNg0C2fc2JMYo33ksW:BxhhquoWr+kkNCUc2J50kf
MD5:	02A7F0028AFB0246ECADE84FBCA5CA19
SHA1:	7C67A9CB6DF336FFBB361A94110718026AA57962
SHA-256:	A72E4805479555112E0FA382B6E0C20FD25D753F670D09F29DFF30B57828022B
SHA-512:	2C097B74B264624B298D0F7B601DA871FBC0E56742CDF1C5F59FE31187A44F29850F87704E47127D1F362D4C4C6FC4F20CB5918DA39FD2E57FE01AA45542FF4C
Malicious:	false
Preview:	ISc(.....................................................................................................................................................................................................................................................................................................................................................J....................................tfW.kD.;.SP...................x.7..[.B....i.o.AA..L..F.IJ.E.A.N.._p..H...L.B.....................................................+.....6.=U....q%..IQR.ag.c7UY..z.~..H."l.`.hdeJ.......sx.r.2...`w.otS.D.......b..YL...}e.....l2.Q.!...h.."O.....dV6.%.......E-\.0........ ..kH..Tif`.V...KRS!5CA..$..Y....P...k....E.......An}.j...`.I..\.i.)0..&......=p......f..@..9p......n.J.bF...:W..J1...n..b.R. 7.3........:..a.p....l..<...<+.oWW{'b..=`.....Xi...7.........i..7.F.G.z.u..,z.K..:....O.....=.A<.a...0.=m.<......C..}.'....M_....x>.a..,Ul..Fq..a_\).......,..>...g.\..i.1i......n...>..+..*~.e.....q.\|..C

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\data1.cab (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	14335896
Entropy (8bit):	7.999178331190897
Encrypted:	true
SSDEEP:	393216:Bxr9hG1A2fooVWrydkkzNg0C2fc2JMYo33ksW:BxhhquoWr+kkNCUc2J50kf
MD5:	02A7F0028AFB0246ECADE84FBCA5CA19
SHA1:	7C67A9CB6DF336FFBB361A94110718026AA57962
SHA-256:	A72E4805479555112E0FA382B6E0C20FD25D753F670D09F29DFF30B57828022B
SHA-512:	2C097B74B264624B298D0F7B601DA871FBC0E56742CDF1C5F59FE31187A44F29850F87704E47127D1F362D4C4C6FC4F20CB5918DA39FD2E57FE01AA45542FF4C
Malicious:	false
Preview:	ISc(.....................................................................................................................................................................................................................................................................................................................................................J....................................tfW.kD.;.SP...................x.7..[.B....i.o.AA..L..F.IJ.E.A.N.._p..H...L.B.....................................................+.....6.=U....q%..IQR.ag.c7UY..z.~..H."l.`.hdeJ.......sx.r.2...`w.otS.D.......b..YL...}e.....l2.Q.!...h.."O.....dV6.%.......E-\.0........ ..kH..Tif`.V...KRS!5CA..$..Y....P...k....E.......An}.j...`.I..\.i.)0..&......=p......f..@..9p......n.J.bF...:W..J1...n..b.R. 7.3........:..a.p....l..<...<+.oWW{'b..=`.....Xi...7.........i..7.F.G.z.u..,z.K..:....O.....=.A<.a...0.=m.<......C..}.'....M_....x>.a..,Ul..Fq..a_\).......,..>...g.\..i.1i......n...>..+..*~.e.....q.\|..C

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\data1.hdr (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	29396
Entropy (8bit):	3.720172973516485
Encrypted:	false
SSDEEP:	768:P9aaIZIO6SaJvO95Zgp8X8+/lb+/DQS+PBZb+PzcF:1k7pZb8W
MD5:	507BDDD8FD510775FAFEB4BCDDE7BC7D
SHA1:	BD34B3D2BD37CC19940ED93F1759CDE97B68CCEB
SHA-256:	8650F75584B0BFA0D84008F51BAEC549D95F933BC6B26258E46551BA968C2213
SHA-512:	7CA6DB89A27645398A2884EB2B1437AC68A3E56CA6FC62810645E8D46824436E21B23F26CA28DCF51E51E947FA43C09EABABE0C7574E1E080376FE6C95CE2031
Malicious:	false
Preview:	ISc(............A'...r..........................................................................B~.....................................................................................................................................................................................................................................................J....................................tfW.kD.;.SP...................x.7..[.B....i.o.AA..L..F.IJ.E.A.N.._p..H...L.B.....................................................s...........A'.......I...I..........@.......@.....................W...c...................................o...........{...................................................................................................................................................................#.........................../...............................;...............G...........S..................................._.......................k...w.....................................................

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\lay7AEF.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	data
Category:	dropped
Size (bytes):	580
Entropy (8bit):	2.0042610078197334
Encrypted:	false
SSDEEP:	6:OMY1GndIIhCzCnFpl8JDWLNglETl127W7Jtn:KFswAQyBTj
MD5:	C7DC5ADFFFF108DEC7322A9377B4E218
SHA1:	1E8359CD6A73F3730113095A548E80D05DA8BDA9
SHA-256:	A1EE393AC58AE738FC0079D56FF09470691FE15838EDB85F89B07A3922E940B5
SHA-512:	FC6615B3ACF417DAA9CBBFF70FB73E3886836B5C93C36E0396CFC9BE51CCC63E3474260B1F84ACDFE463A5AB9D2B17D70045C55460565DC90A3D0E1B391FBEC6
Malicious:	false
Preview:	c..S.@..D................................................................................................................................................................................................................................................................... ...H...............p...................................0...........................................s.e.t.u.p...i.n.i.....s.e.t.u.p...i.n.x...I.S.S.e.t.u.p...d.l.l...0.x.0.8.0.4...i.n.i...0.x.0.4.0.9...i.n.i...d.a.t.a.1...h.d.r...d.a.t.a.1...c.a.b...d.a.t.a.2...c.a.b...l.a.y.o.u.t...b.i.n...s.e.t.u.p...e.x.e...

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\layout.bin (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	data
Category:	dropped
Size (bytes):	580
Entropy (8bit):	2.0042610078197334
Encrypted:	false
SSDEEP:	6:OMY1GndIIhCzCnFpl8JDWLNglETl127W7Jtn:KFswAQyBTj
MD5:	C7DC5ADFFFF108DEC7322A9377B4E218
SHA1:	1E8359CD6A73F3730113095A548E80D05DA8BDA9
SHA-256:	A1EE393AC58AE738FC0079D56FF09470691FE15838EDB85F89B07A3922E940B5
SHA-512:	FC6615B3ACF417DAA9CBBFF70FB73E3886836B5C93C36E0396CFC9BE51CCC63E3474260B1F84ACDFE463A5AB9D2B17D70045C55460565DC90A3D0E1B391FBEC6
Malicious:	false
Preview:	c..S.@..D................................................................................................................................................................................................................................................................... ...H...............p...................................0...........................................s.e.t.u.p...i.n.i.....s.e.t.u.p...i.n.x...I.S.S.e.t.u.p...d.l.l...0.x.0.8.0.4...i.n.i...0.x.0.4.0.9...i.n.i...d.a.t.a.1...h.d.r...d.a.t.a.1...c.a.b...d.a.t.a.2...c.a.b...l.a.y.o.u.t...b.i.n...s.e.t.u.p...e.x.e...

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\set7FB5.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1191936
Entropy (8bit):	6.682246176843057
Encrypted:	false
SSDEEP:	24576:oQt5lb3YpnAuE9CDRYcDZYr1yy0llllj6XAF7GCWZf:ft5JunAuE9CD+yaOlllljC4E5
MD5:	E188643B48930186D6AC477BA67857B3
SHA1:	51C1305DD0D6330B772C4EAF18A3D38674DE3B26
SHA-256:	FB874E3CDBDD65E0658067003D5663AE62A68394CE7F1A9E69729058EA7A0648
SHA-512:	EA774B767244688DB85AAD409FDE9527E3193DF440ABCDA2609E467252B027E60E9553701E46A2129B3691A01398680EBE96B25B1D43FBEA4280F5EB55EE5233
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X=..6n..6n..6n[2.n..6n.3.n..6n.3.n\|.6n[2.n..6n.3.n..6n...n..6n..7nY.6n...n..6n[2.n..6n[2.n..6n...n..6n[2.n..6nRich..6n........PE..L...X..U.....................p....................@........................................................................../..,.......(...........................@...8...........................P)..@............................................text...;........................... ..`.rdata..x...........................@..@.data....K...`...&...F..............@....rsrc...(............l..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\set81BD.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	data
Category:	dropped
Size (bytes):	256012
Entropy (8bit):	7.372841368757717
Encrypted:	false
SSDEEP:	3072:jUgqLn4zM1TF08meQdQ5NhHMm77hplbnALofCAZz4w5YpTBqqodQcQnnSF7a5INZ:jUgqLIQlddthAo4w0BqWnShYTNtG
MD5:	51CFDC963AB67279BCE6C9D7E7C4B933
SHA1:	66E3E4DA9A3AB8B2AD2717CC772860D6383FB02B
SHA-256:	BDAFEBD536D5E00A4C284CC425CA1D4B45AA155A58F7DFA46CCE02165FBADA57
SHA-512:	25C319E84AC87337D36A68337C79DB1F112FE9C8B7E5146AC041EC61C751C19A31AAA323BD134913F53625C43D27CD4C9763D904003506085708AB7C13573345
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}a.=mQ.Y]A..M1..)!.)........................................}...m..q]}}aMm.U=].E-M.5.=.%.-...............................]......a..(..H....YQQEY.0.o=55.={.gC[..W.....O.So##` ......,..x8........X......]..H.........5MM.5s..gW.CKgCC.....;..TDh..8P@........8.....p.e..Q...\| h......%]1II.1....S[wSS.[.G.W.o....L.`H ..D.. ........t....L......ayyIa......s..w!99.!....Gs[K[............T,.0,,......\|(.....l...P...yyy!a...........w.o.....W.;o?g..+O.....4.,$\.@....<......l......}uuI}.4..@....!99.!..s.w..3{.SGk.......0.D4\.... H.............4...Ye}!e. ..D....c.w......w3.;#.#C.[.THl....(.<,4p,.$.......a..t...8..L..YQQ=Y...w.{o..`.--..S.w3.7+kk .....$..H8@.X,0...y...........x...H...1miMQ.c4....{%9-%%.-c.sO.....'7?..... @\D.....H...................iuUaaUi...MEE%M..gk........?.7wK.....@.\|$d8......$.<................e}}Qe...I]1II.1.W.[.c_.;[s.....g..W..L<l...

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\set8289.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2422
Entropy (8bit):	3.672251874347952
Encrypted:	false
SSDEEP:	48:rsAMDeB+5pEDXiomcPTmssu/+S8gvn6CJkkY09TzcqYtxkYOvl5ZAMXvrcOyb0pn:rsAMD35pPcrGqrvnp6kY05w7tCYOvlnR
MD5:	A5796064347CA23B634BE2CE0F5F2F4A
SHA1:	25DE30F651B05B1074B8F70914C800AAE2EFAEA8
SHA-256:	8A6F5FEFB3CB4804A66753A5A788E6FE4A89C1C783572561B4425C5F3EB15D98
SHA-512:	F86189F8C9BB9DA31A38C31CE2BCAD46B9E4B4B5D8AEDFD606AAD23E4218E18D9F322F95B4C942C66ABCCF2ADC68287610CECC4F4499A7118602DA9739D7EE01
Malicious:	false
Preview:	..[.S.t.a.r.t.u.p.].....P.r.o.d.u.c.t.=.L.o.c.a.l.P.l.a.y.b.a.c.k.....P.r.o.d.u.c.t.G.U.I.D.=.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.....C.o.m.p.a.n.y.N.a.m.e.=.h.i.k.v.i.s.i.o.n.....C.o.m.p.a.n.y.U.R.L.=.h.t.t.p.:././.w.w.w...h.i.k.v.i.s.i.o.n...c.o.m.....E.r.r.o.r.R.e.p.o.r.t.U.R.L.=.h.t.t.p.:././.w.w.w...i.n.s.t.a.l.l.s.h.i.e.l.d...c.o.m./.i.s.e.t.u.p./.P.r.o.E.r.r.o.r.C.e.n.t.r.a.l...a.s.p.?.E.r.r.o.r.C.o.d.e.=.%.d. .:. .0.x.%.x.&.E.r.r.o.r.I.n.f.o.=.%.s.....M.e.d.i.a.F.o.r.m.a.t.=.1.....L.o.g.M.o.d.e.=.1.....S.m.a.l.l.P.r.o.g.r.e.s.s.=.N.....S.p.l.a.s.h.T.i.m.e.=.....C.h.e.c.k.M.D.5.=.Y.....C.m.d.L.i.n.e.=.....S.h.o.w.P.a.s.s.w.o.r.d.D.i.a.l.o.g.=.N.....S.c.r.i.p.t.D.r.i.v.e.n.=.4.........[.L.a.n.g.u.a.g.e.s.].....D.e.f.a.u.l.t.=.0.x.0.4.0.9.....S.u.p.p.o.r.t.e.d.=.0.x.0.8.0.4.,.0.x.0.4.0.9.....R.e.q.u.i.r.e.E.x.a.c.t.L.a.n.g.M.a.t.c.h.=.0.x.0.4.0.4.,.0.x.0.8.0.4.....R.T.L.L.a.n.g.s.=.0.x.0.4.0.1.,.0.x.0.4.0.d.........[.0.x.0.4.0.9.].....0.x.0.4.0.

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\setup.exe (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1191936
Entropy (8bit):	6.682246176843057
Encrypted:	false
SSDEEP:	24576:oQt5lb3YpnAuE9CDRYcDZYr1yy0llllj6XAF7GCWZf:ft5JunAuE9CD+yaOlllljC4E5
MD5:	E188643B48930186D6AC477BA67857B3
SHA1:	51C1305DD0D6330B772C4EAF18A3D38674DE3B26
SHA-256:	FB874E3CDBDD65E0658067003D5663AE62A68394CE7F1A9E69729058EA7A0648
SHA-512:	EA774B767244688DB85AAD409FDE9527E3193DF440ABCDA2609E467252B027E60E9553701E46A2129B3691A01398680EBE96B25B1D43FBEA4280F5EB55EE5233
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X=..6n..6n..6n[2.n..6n.3.n..6n.3.n\|.6n[2.n..6n.3.n..6n...n..6n..7nY.6n...n..6n[2.n..6n[2.n..6n...n..6n[2.n..6nRich..6n........PE..L...X..U.....................p....................@........................................................................../..,.......(...........................@...8...........................P)..@............................................text...;........................... ..`.rdata..x...........................@..@.data....K...`...&...F..............@....rsrc...(............l..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\setup.ilg (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	276992
Entropy (8bit):	2.826431565667897
Encrypted:	false
SSDEEP:	3072:zFaUaT2q0kgRMbfno8m46+6l6767v+T553Y4TMyT8Iqy1jF1QKb4ReZva96Ja96x:B1RMbfnoh46+6l67
MD5:	79150C58384BB928336FE4E0A4750507
SHA1:	823D14337B5D1D5E1A49D14AF87F1C5C6F38DE3C
SHA-256:	B5DB58C0A9945A59CB88FE4680FA1565EF05BB05D40F09F4E086863C94D72124
SHA-512:	5F1752CD150FB5B1CE432CDC7B65792EEB941D03B2EB9F9E3169793F68707574E7BCFD8C9B416644B0C7646EC79E6AEA9BE4168284D89091279A5F0C874F11E6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..............................................................................................................."... ...)...]...#...$...%...&...'...(...6...7...+...,...-......./...0...1...2...3...4...5.......8...T...9...:...;...<...=...>...?...@...A...\...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...U...[...V...W...X...Y...Z...o..._...^.......b...`...a...t...n...d...e...f...g...h...i...j...k...l...m.......u...p...q...r...s...............w...x...y...z...

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\setup.ini

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2570
Entropy (8bit):	3.6965417109859424
Encrypted:	false
SSDEEP:	48:rsAMDeB+5pEDXiomcPTodOmssu/+S8gvn6CJkkY09TzcqYtxkYOvl5ZAMXvrcOyM:rsAMD35pPckdOGqrvnp6kY05w7tCYOvj
MD5:	C69068CFDD85B0ED7EE3B2D8FC4FF3D1
SHA1:	BABA932CD3A316285436BC891DBFADD675E2D24E
SHA-256:	97F011A6B6FA81B532AAA77F3CE24BF78837B0F498ACB2458054884775E86FFC
SHA-512:	384DF34A128EDE5F187037E0B1FD58589D15C899FF0E9FFF9DFCD5EDA1AE7A2EA275DD374769B33893AFEA0FE0EBA2F72C6F8AA8FBD6598175BA190154493122
Malicious:	false
Preview:	..[.S.t.a.r.t.u.p.].....P.r.o.d.u.c.t.=.L.o.c.a.l.P.l.a.y.b.a.c.k.....P.r.o.d.u.c.t.G.U.I.D.=.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.....C.o.m.p.a.n.y.N.a.m.e.=.h.i.k.v.i.s.i.o.n.....C.o.m.p.a.n.y.U.R.L.=.h.t.t.p.:././.w.w.w...h.i.k.v.i.s.i.o.n...c.o.m.....E.r.r.o.r.R.e.p.o.r.t.U.R.L.=.h.t.t.p.:././.w.w.w...i.n.s.t.a.l.l.s.h.i.e.l.d...c.o.m./.i.s.e.t.u.p./.P.r.o.E.r.r.o.r.C.e.n.t.r.a.l...a.s.p.?.E.r.r.o.r.C.o.d.e.=.%.d. .:. .0.x.%.x.&.E.r.r.o.r.I.n.f.o.=.%.s.....M.e.d.i.a.F.o.r.m.a.t.=.1.....L.o.g.M.o.d.e.=.1.....S.m.a.l.l.P.r.o.g.r.e.s.s.=.N.....S.p.l.a.s.h.T.i.m.e.=.....C.h.e.c.k.M.D.5.=.Y.....C.m.d.L.i.n.e.=.....S.h.o.w.P.a.s.s.w.o.r.d.D.i.a.l.o.g.=.N.....S.c.r.i.p.t.D.r.i.v.e.n.=.4.....S.o.u.r.c.e.=.0.....A.l.l.U.s.e.r.s.=.1.....I.n.s.t.a.l.l.G.u.i.d.=.{.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.}.........[.L.a.n.g.u.a.g.e.s.].....D.e.f.a.u.l.t.=.0.x.0.4.0.9.....S.u.p.p.o.r.t.e.d.=.0.x.0.8.0.4.,.0.x.0.4.0.9.....R.e.q.u.

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\setup.inx (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	data
Category:	dropped
Size (bytes):	256012
Entropy (8bit):	7.372841368757717
Encrypted:	false
SSDEEP:	3072:jUgqLn4zM1TF08meQdQ5NhHMm77hplbnALofCAZz4w5YpTBqqodQcQnnSF7a5INZ:jUgqLIQlddthAo4w0BqWnShYTNtG
MD5:	51CFDC963AB67279BCE6C9D7E7C4B933
SHA1:	66E3E4DA9A3AB8B2AD2717CC772860D6383FB02B
SHA-256:	BDAFEBD536D5E00A4C284CC425CA1D4B45AA155A58F7DFA46CCE02165FBADA57
SHA-512:	25C319E84AC87337D36A68337C79DB1F112FE9C8B7E5146AC041EC61C751C19A31AAA323BD134913F53625C43D27CD4C9763D904003506085708AB7C13573345
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}a.=mQ.Y]A..M1..)!.)........................................}...m..q]}}aMm.U=].E-M.5.=.%.-...............................]......a..(..H....YQQEY.0.o=55.={.gC[..W.....O.So##` ......,..x8........X......]..H.........5MM.5s..gW.CKgCC.....;..TDh..8P@........8.....p.e..Q...\| h......%]1II.1....S[wSS.[.G.W.o....L.`H ..D.. ........t....L......ayyIa......s..w!99.!....Gs[K[............T,.0,,......\|(.....l...P...yyy!a...........w.o.....W.;o?g..+O.....4.,$\.@....<......l......}uuI}.4..@....!99.!..s.w..3{.SGk.......0.D4\.... H.............4...Ye}!e. ..D....c.w......w3.;#.#C.[.THl....(.<,4p,.$.......a..t...8..L..YQQ=Y...w.{o..`.--..S.w3.7+kk .....$..H8@.X,0...y...........x...H...1miMQ.c4....{%9-%%.-c.sO.....'7?..... @\D.....H...................iuUaaUi...MEE%M..gk........?.7wK.....@.\|$d8......$.<................e}}Qe...I]1II.1.W.[.c_.;[s.....g..W..L<l...

C:\Program Files (x86)\LocalPlayback\Ana83C2.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114794
Entropy (8bit):	6.119938156637067
Encrypted:	false
SSDEEP:	1536:t9pCNQwvcWY5lqVBE4ZrQhSkR4P/a7ErtbLvgLvzytk:30v/YiDE02R4P1JnUzytk
MD5:	8EED7A3A2951961120566C4222C64B62
SHA1:	FB1D82F124F05A715DE2C9C18C8528EA82579C16
SHA-256:	C7F4ACE34AA906855AA978460FF0B0F606E939A5C097525451BDC4D613DD903C
SHA-512:	0C4F817053BEC22F1166499402BF5E70867890E85FEF5289ABB251879B2E8FFB7BC6A3E591105DF4E204F51722F92E145F2BD8C91FD69CAF8A06420CB9C6521A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.._..._..._..@..._..SC..._..@..._..@..._..@..._..._..._..\|..._...Y..._../...._..Rich._..........PE..L......S...........!....................................................................................................k.......<.......8.......................p....................................................................................text............................... ..`.rdata........... ..................@..@.data........ ....... ..............@....rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\AnalyzeData.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114794
Entropy (8bit):	6.119938156637067
Encrypted:	false
SSDEEP:	1536:t9pCNQwvcWY5lqVBE4ZrQhSkR4P/a7ErtbLvgLvzytk:30v/YiDE02R4P1JnUzytk
MD5:	8EED7A3A2951961120566C4222C64B62
SHA1:	FB1D82F124F05A715DE2C9C18C8528EA82579C16
SHA-256:	C7F4ACE34AA906855AA978460FF0B0F606E939A5C097525451BDC4D613DD903C
SHA-512:	0C4F817053BEC22F1166499402BF5E70867890E85FEF5289ABB251879B2E8FFB7BC6A3E591105DF4E204F51722F92E145F2BD8C91FD69CAF8A06420CB9C6521A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.._..._..._..@..._..SC..._..@..._..@..._..@..._..._..._..\|..._...Y..._../...._..Rich._..........PE..L......S...........!....................................................................................................k.......<.......8.......................p....................................................................................text............................... ..`.rdata........... ..................@..@.data........ ....... ..............@....rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Aud83F2.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	146944
Entropy (8bit):	6.6265092591590955
Encrypted:	false
SSDEEP:	1536:2/V7JG2m5qmsxhEnN/2HhUBQhMx1AN+TFKSq/y6SL29kutZZlWBXvtmgMbFuwtn3:k7Jx0/vCu1sy6cuttWB/Ag0FuwtrR3d
MD5:	971D200177B3CB4F322AB331142E009C
SHA1:	DD8DEAC2277BAA7878597A1AE0391D112200F648
SHA-256:	F5666FB4C523165EE2D6DFFE57D6C5B297FF02D643322B6B1A317B9C5A96E3AB
SHA-512:	94F58A12F3C49ABB91AD9321CE1562DB17225D373CEDC682D9CB162BB19969A3BAEF1C867467D333CBA11C21E3B0D27B851E72758AE59F6A1A805381E88A3393
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]+..<E..<E..<E..n...<E..n..f<E..D...<E..n...<E...>..<E..<D..<E..n...<E..n...<E..n...<E..n...<E.Rich.<E.........................PE..L....-BZ...........!.....t...........r..............................................bz....@.....................................d....`..l....................p..8.......................................@............................................text...>r.......t.................. ..`.rdata..]............x..............@..@.data...\|;... ......................@....rsrc...l....`......................@..@.reloc.......p....... ..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\AudioRender.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	146944
Entropy (8bit):	6.6265092591590955
Encrypted:	false
SSDEEP:	1536:2/V7JG2m5qmsxhEnN/2HhUBQhMx1AN+TFKSq/y6SL29kutZZlWBXvtmgMbFuwtn3:k7Jx0/vCu1sy6cuttWB/Ag0FuwtrR3d
MD5:	971D200177B3CB4F322AB331142E009C
SHA1:	DD8DEAC2277BAA7878597A1AE0391D112200F648
SHA-256:	F5666FB4C523165EE2D6DFFE57D6C5B297FF02D643322B6B1A317B9C5A96E3AB
SHA-512:	94F58A12F3C49ABB91AD9321CE1562DB17225D373CEDC682D9CB162BB19969A3BAEF1C867467D333CBA11C21E3B0D27B851E72758AE59F6A1A805381E88A3393
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]+..<E..<E..<E..n...<E..n..f<E..D...<E..n...<E...>..<E..<D..<E..n...<E..n...<E..n...<E..n...<E.Rich.<E.........................PE..L....-BZ...........!.....t...........r..............................................bz....@.....................................d....`..l....................p..8.......................................@............................................text...>r.......t.................. ..`.rdata..]............x..............@..@.data...\|;... ......................@....rsrc...l....`......................@..@.reloc.......p....... ..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\D3D8452.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2106216
Entropy (8bit):	6.4563314852745375
Encrypted:	false
SSDEEP:	49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
MD5:	1C9B45E87528B8BB8CFA884EA0099A85
SHA1:	98BE17E1D324790A5B206E1EA1CC4E64FBE21240
SHA-256:	2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
SHA-512:	B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\D3D84EF.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1998168
Entropy (8bit):	6.7631254131269465
Encrypted:	false
SSDEEP:	24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
MD5:	86E39E9161C3D930D93822F1563C280D
SHA1:	F5944DF4142983714A6D9955E6E393D9876C1E11
SHA-256:	0B28546BE22C71834501F7D7185EDE5D79742457331C7EE09EFC14490DD64F5F
SHA-512:	0A3E311C4FD5C2194A8807469E47156AF35502E10AEB8A3F64A01FF802CD8669C7E668CC87B593B182FD830A126D002B5D5D7B6C77991158BFFDB0B5B997F6B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..=.a.n.a.n.a.n.a.n.a.n.3hn.a.n.3jn.a.n.3^nZa.n.3on.a.n.3_n.a.n-..n.a.n.3nn.a.n.3in.a.nRich.a.n........................PE..L....1.K...........!.........4......................................................m.....@..........................i..&,...Z..d....................f..X.......x.......................................@............................................text............................... ..`.data....P..........................@....rsrc...............................@..@.reloc..>...........................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\D3DCompiler_43.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2106216
Entropy (8bit):	6.4563314852745375
Encrypted:	false
SSDEEP:	49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
MD5:	1C9B45E87528B8BB8CFA884EA0099A85
SHA1:	98BE17E1D324790A5B206E1EA1CC4E64FBE21240
SHA-256:	2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
SHA-512:	B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\D3DX9_43.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1998168
Entropy (8bit):	6.7631254131269465
Encrypted:	false
SSDEEP:	24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
MD5:	86E39E9161C3D930D93822F1563C280D
SHA1:	F5944DF4142983714A6D9955E6E393D9876C1E11
SHA-256:	0B28546BE22C71834501F7D7185EDE5D79742457331C7EE09EFC14490DD64F5F
SHA-512:	0A3E311C4FD5C2194A8807469E47156AF35502E10AEB8A3F64A01FF802CD8669C7E668CC87B593B182FD830A126D002B5D5D7B6C77991158BFFDB0B5B997F6B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..=.a.n.a.n.a.n.a.n.a.n.3hn.a.n.3jn.a.n.3^nZa.n.3on.a.n.3_n.a.n-..n.a.n.3nn.a.n.3in.a.nRich.a.n........................PE..L....1.K...........!.........4......................................................m.....@..........................i..&,...Z..d....................f..X.......x.......................................@............................................text............................... ..`.data....P..........................@....rsrc...............................@..@.reloc..>...........................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Eag859C.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410624
Entropy (8bit):	6.7115007309520935
Encrypted:	false
SSDEEP:	6144:OCSAbIaBCi6YDFtJtZNd83FP0i088QThe5QJin2nJgklpB:OqdDFtJtZv83FX0kThTJimp
MD5:	85B856D79C732A2C5B1BE11ACF2BCEAD
SHA1:	818ADF4DC52D78C6FD0AD4C4B71780D48A8AE7A2
SHA-256:	E9D1D4E3E37A7B6E4BE597089743FBED75532AAC0F26F1D244758ABE0F3AE26E
SHA-512:	BC86C97D3EF4154B36FB92632B33DF40BFBEFCAEE2437864A65E4EE7ABC4FE82CCA2DF47B47D17F5ED783FC7CAAAE7508C2F7D08EA2C9B54A93004780DA88227
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..+..+..+...+..+...+.+...+C..+.@.+..+...+..+...+..+../+..+0..+..+..+[..+..+..+...+..+...+...+...+..+...+..+...+..+Rich..+........PE..L....qY...........!.........F.......X....... ...............................0......!+....@.........................P...&.......................................d4..P$............................................... ..\............................text............................... ..`.rodata............................. ..`.rdata..v.... ......................@..@.data............2..................@....rsrc...............................@..@.reloc..z5.......6..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\EagleEyeRender.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410624
Entropy (8bit):	6.7115007309520935
Encrypted:	false
SSDEEP:	6144:OCSAbIaBCi6YDFtJtZNd83FP0i088QThe5QJin2nJgklpB:OqdDFtJtZv83FX0kThTJimp
MD5:	85B856D79C732A2C5B1BE11ACF2BCEAD
SHA1:	818ADF4DC52D78C6FD0AD4C4B71780D48A8AE7A2
SHA-256:	E9D1D4E3E37A7B6E4BE597089743FBED75532AAC0F26F1D244758ABE0F3AE26E
SHA-512:	BC86C97D3EF4154B36FB92632B33DF40BFBEFCAEE2437864A65E4EE7ABC4FE82CCA2DF47B47D17F5ED783FC7CAAAE7508C2F7D08EA2C9B54A93004780DA88227
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..+..+..+...+..+...+.+...+C..+.@.+..+...+..+...+..+../+..+0..+..+..+[..+..+..+...+..+...+...+...+..+...+..+...+..+Rich..+........PE..L....qY...........!.........F.......X....... ...............................0......!+....@.........................P...&.......................................d4..P$............................................... ..\............................text............................... ..`.rodata............................. ..`.rdata..v.... ......................@..@.data............2..................@....rsrc...............................@..@.reloc..z5.......6..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCC8669.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1107968
Entropy (8bit):	6.699930744636248
Encrypted:	false
SSDEEP:	24576:H+OULaZr56gty3e3/+YBX52+LbdYZ1Q4j01oxH2Tgkwi/y:Hk6568G+FLbd+QqMckwi/y
MD5:	9126D7DEA415168166AC5C8D7BC27A03
SHA1:	BF9730921764F9FE7C62E98D346F07F030D2FD24
SHA-256:	5BAAF9E69AD3A891A1BF53A38592197AD6B096ADB74E9D17EECD4523E3E8E8D6
SHA-512:	878B286228CF340DFA13D648C7EF687272FAF39C0492F9F52C232674D259B157806896F258EFDEE1059BE2FE69E282A897235A64B9A645EBF008D045D02EAF19
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......H......,...,...,..q,...,J.i,...,J.W,A..,J.V,..,.B},...,...,...,..S,...,.#V,...,.#W,...,X..,...,..V,...,..W,G..,..j,...,..m,...,..!,...,..h,...,Rich...,........................PE..L....y.W...........!..........................................................(...........@.............................`..`.........(...................... (.....`...8...............................@............................................text...w........................... ..`.rdata...i.......j..................@..@.data...H.... ...P..................@....rsrc.........(......P..............@..@.reloc....... (......T..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCCore.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1107968
Entropy (8bit):	6.699930744636248
Encrypted:	false
SSDEEP:	24576:H+OULaZr56gty3e3/+YBX52+LbdYZ1Q4j01oxH2Tgkwi/y:Hk6568G+FLbd+QqMckwi/y
MD5:	9126D7DEA415168166AC5C8D7BC27A03
SHA1:	BF9730921764F9FE7C62E98D346F07F030D2FD24
SHA-256:	5BAAF9E69AD3A891A1BF53A38592197AD6B096ADB74E9D17EECD4523E3E8E8D6
SHA-512:	878B286228CF340DFA13D648C7EF687272FAF39C0492F9F52C232674D259B157806896F258EFDEE1059BE2FE69E282A897235A64B9A645EBF008D045D02EAF19
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......H......,...,...,..q,...,J.i,...,J.W,A..,J.V,..,.B},...,...,...,..S,...,.#V,...,.#W,...,X..,...,..V,...,..W,G..,..j,...,..m,...,..!,...,..h,...,Rich...,........................PE..L....y.W...........!..........................................................(...........@.............................`..`.........(...................... (.....`...8...............................@............................................text...w........................... ..`.rdata...i.......j..................@..@.data...H.... ...P..................@....rsrc.........(......P..............@..@.reloc....... (......T..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCN86B8.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	660992
Entropy (8bit):	6.674525649022369
Encrypted:	false
SSDEEP:	12288:DBgMG2++RzL7fqZHkDUHqOj39EJg/hur269:DmMG5+17fsceqO9EC/2
MD5:	AE95C4C6957A547004246913A6BD10E4
SHA1:	3277884EB60BA6EB45F2EFC8AE151424A34C15E5
SHA-256:	CEBD252E5AD0FB70B7DD6E959022478C1A1B9251499AB9CEB0AAA5DBAAC187F7
SHA-512:	93E8F0A8FE5C0D70CF1943C1BD4EA8BD41C220E24DCBF607FAB07A12F5198AE4F91E0C8C3E9B278B98EB30A3AEB0640F61B0122BA8B2284A27FE23F59B4410BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K..IK..IK..I.1'IH..I..?IW..I...I...I...I...I.n+II..IF.=IH..IK..I...IF..IO..IF..I^..IF.<IJ..IF.;IJ..IK.wIJ..IF.>IJ..IRichK..I................PE..L....z.W...........!.....`...................p...............................`............@......................... ....p......<................................\..ps..8...............................@............p...............................text....^.......`.................. ..`.rdata...'...p...(...d..............@..@.data....K.......(..................@....rsrc...............................@..@.reloc...\.......^..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCN86E8.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	660480
Entropy (8bit):	6.6232964458681005
Encrypted:	false
SSDEEP:	12288:HQWeFMu6FueK1YKCZo6pNk27sIeN/VwGlGO5stiHyZiWdlK8AZYAwB:HQWeFMBKuKCaUNkesIcCPOugHyQWdHAO
MD5:	1F9EA54A536FC6E92092F5BA38275386
SHA1:	0451687D6B3BC4F4AA54F2879CE6B06585BDFF83
SHA-256:	0DC4F2E06FCFDF3822DB197822215DC8233E0D3B3705484425131939A5CF20F8
SHA-512:	4FEA86A9BFA82291C70E8B2BD5AF4E75111C7E97874CC4CDECCBE351A28B226084508E01A3148C226C8CF479B1BA469BC4852F38F57A8FCCD060ED10C65F23A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..gw..4w..4w..4.>#4r..41.;4U..41..4;..41..4...4...4...4...4r..4#..4g..4z..44..4w..4..4.a/4x..4z..4...4z.84v..4z.?4v..4w.s4v..4z.:4v..4Richw..4........PE..L....S.Z...........!.....@..........K........P............................... !...........@..........................R.......`..d..... ....................... ..k...R..8...............................@............P..$............................text...\|?.......@.................. ..`.rdata.......P.......D..............@..@.data....%...p...D...`..............@....rsrc......... .....................@..@.reloc...k.... ..l..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDK.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	660992
Entropy (8bit):	6.674525649022369
Encrypted:	false
SSDEEP:	12288:DBgMG2++RzL7fqZHkDUHqOj39EJg/hur269:DmMG5+17fsceqO9EC/2
MD5:	AE95C4C6957A547004246913A6BD10E4
SHA1:	3277884EB60BA6EB45F2EFC8AE151424A34C15E5
SHA-256:	CEBD252E5AD0FB70B7DD6E959022478C1A1B9251499AB9CEB0AAA5DBAAC187F7
SHA-512:	93E8F0A8FE5C0D70CF1943C1BD4EA8BD41C220E24DCBF607FAB07A12F5198AE4F91E0C8C3E9B278B98EB30A3AEB0640F61B0122BA8B2284A27FE23F59B4410BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K..IK..IK..I.1'IH..I..?IW..I...I...I...I...I.n+II..IF.=IH..IK..I...IF..IO..IF..I^..IF.<IJ..IF.;IJ..IK.wIJ..IF.>IJ..IRichK..I................PE..L....z.W...........!.....`...................p...............................`............@......................... ....p......<................................\..ps..8...............................@............p...............................text....^.......`.................. ..`.rdata...'...p...(...d..............@..@.data....K.......(..................@....rsrc...............................@..@.reloc...\.......^..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Ana9465.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	543744
Entropy (8bit):	5.9833384248611186
Encrypted:	false
SSDEEP:	6144:z6W+MfDNntLXBsAp3QhZsR6EGkGrF4YVAOc:zD33Q/x/kKyYV
MD5:	DADBEA2E864AB9E94849DA7A989122BB
SHA1:	8AD8642E6C84EC2DF9F8ED7AC609F480D384E9D0
SHA-256:	81F448EFD020CB599432410589C1DD28861D57B19C4862EFDBEB00232DF69ADC
SHA-512:	3BB77D1AD8DD827C39F30875BF589346EF33AB533BB081AD637363ADFAC4570D1E77565B476560D2748490F6B210B91F7E553CC6D92D15974EC762056E70D691
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m...m...m...s...M...Jf.n...m.......s.....d...c...s...$...s...l...s...l...m...l...s...l...Richm...........PE..L....9jW...........!.....t...........2.......................................@.......................................]..........(................................%..P...............................................$................................textbss.................................text...is... ...t.................. ..`.rdata...............x..............@..@.data....{...p.......:..............@....idata..............................@....rsrc...............................@..@.reloc...........0..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\AnalyzeData.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	543744
Entropy (8bit):	5.9833384248611186
Encrypted:	false
SSDEEP:	6144:z6W+MfDNntLXBsAp3QhZsR6EGkGrF4YVAOc:zD33Q/x/kKyYV
MD5:	DADBEA2E864AB9E94849DA7A989122BB
SHA1:	8AD8642E6C84EC2DF9F8ED7AC609F480D384E9D0
SHA-256:	81F448EFD020CB599432410589C1DD28861D57B19C4862EFDBEB00232DF69ADC
SHA-512:	3BB77D1AD8DD827C39F30875BF589346EF33AB533BB081AD637363ADFAC4570D1E77565B476560D2748490F6B210B91F7E553CC6D92D15974EC762056E70D691
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m...m...m...s...M...Jf.n...m.......s.....d...c...s...$...s...l...s...l...m...l...s...l...Richm...........PE..L....9jW...........!.....t...........2.......................................@.......................................]..........(................................%..P...............................................$................................textbss.................................text...is... ...t.................. ..`.rdata...............x..............@..@.data....{...p.......:..............@....idata..............................@....rsrc...............................@..@.reloc...........0..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Aud9485.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	475136
Entropy (8bit):	6.66857667134917
Encrypted:	false
SSDEEP:	12288:JAyIgUsQZPenUxK+AQU/jLE73yXUMJH6:gPenoAt7XUM
MD5:	35F1221C66C49C85034006320BAF46BB
SHA1:	18900B4488F5953AF18D3CA87A460B75F940C0F4
SHA-256:	0A16D1D12E057970B0AD685DC4A75396E498DA23631755FEB6B1BC58B11ECC18
SHA-512:	900E34C6086A181460914A30E94E688C5369C01FE58DD3A51B4C1D322173D35A61CB68DFA8FE66D1248B3FCEF7F11885F717EA4D3541042B0F0434D095C2BACC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6m..r...r...r....z{.k....zO........G...{tv.v...,..q...r.......l^a.q....zN.A....z~.s...R.>.s....zx.s...Richr...........................PE..L....3MW...........!.....N...........m.......`.......................................................................e.......Z..P................................"..@b...............................................`...............................text....M.......N.................. ..`.rdata..X....`.......R..............@..@.data...\....p.......^..............@....rsrc...............................@..@.reloc..n$.......&..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\AudioIntercom.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	475136
Entropy (8bit):	6.66857667134917
Encrypted:	false
SSDEEP:	12288:JAyIgUsQZPenUxK+AQU/jLE73yXUMJH6:gPenoAt7XUM
MD5:	35F1221C66C49C85034006320BAF46BB
SHA1:	18900B4488F5953AF18D3CA87A460B75F940C0F4
SHA-256:	0A16D1D12E057970B0AD685DC4A75396E498DA23631755FEB6B1BC58B11ECC18
SHA-512:	900E34C6086A181460914A30E94E688C5369C01FE58DD3A51B4C1D322173D35A61CB68DFA8FE66D1248B3FCEF7F11885F717EA4D3541042B0F0434D095C2BACC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6m..r...r...r....z{.k....zO........G...{tv.v...,..q...r.......l^a.q....zN.A....z~.s...R.>.s....zx.s...Richr...........................PE..L....3MW...........!.....N...........m.......`.......................................................................e.......Z..P................................"..@b...............................................`...............................text....M.......N.................. ..`.rdata..X....`.......R..............@..@.data...\....p.......^..............@....rsrc...............................@..@.reloc..n$.......&..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\DsS94A6.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5275648
Entropy (8bit):	7.908453196767072
Encrypted:	false
SSDEEP:	98304:pxqNFK4d/9WlgaVnTQOZZMZ9WIuuJ2t1fRlgoG0/pPK1Y29Q/a1D54+ne6fcY:pxdCW1LZa9WIuuJ+4iKm2l14+ne6
MD5:	DCF46DAFEF2FA056DA1901B67E17F7F7
SHA1:	E238122F9A5E91A6B1BF7FDEE46D5F0015036ECC
SHA-256:	BE8FB8620B7D7D67AE117F4F4BB5C69319D87E195D19520428032A60BD771AAB
SHA-512:	2478731DB5C5935AB08161D95A3A2563A6F75F5B824D8CF73ED4A07E00BCC38ED5CAE7D1CAB383988B5A3AAB8A728F6E5AA0C5974A085297DD52385652D2C585
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3..wi..wi..wi...a..ti..P...ui...u..li..AO...i...J..vi...J..ui..#J..}i...v..ri..#J..ui...K..si..wi...h...a..di..AO../i...o..vi...I..vi..Richwi..................PE..L...^.{N...........!..........k...............................................p......................................S..H...(9........o.......................o. L...................................................................................text...>........................... ..`.rdata..............................@..@.data...@-j......0J.................@....rsrc.........o.. ....O.............@..@.reloc..^.....o.......O.............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\DsSdk.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5275648
Entropy (8bit):	7.908453196767072
Encrypted:	false
SSDEEP:	98304:pxqNFK4d/9WlgaVnTQOZZMZ9WIuuJ2t1fRlgoG0/pPK1Y29Q/a1D54+ne6fcY:pxdCW1LZa9WIuuJ+4iKm2l14+ne6
MD5:	DCF46DAFEF2FA056DA1901B67E17F7F7
SHA1:	E238122F9A5E91A6B1BF7FDEE46D5F0015036ECC
SHA-256:	BE8FB8620B7D7D67AE117F4F4BB5C69319D87E195D19520428032A60BD771AAB
SHA-512:	2478731DB5C5935AB08161D95A3A2563A6F75F5B824D8CF73ED4A07E00BCC38ED5CAE7D1CAB383988B5A3AAB8A728F6E5AA0C5974A085297DD52385652D2C585
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3..wi..wi..wi...a..ti..P...ui...u..li..AO...i...J..vi...J..ui..#J..}i...v..ri..#J..ui...K..si..wi...h...a..di..AO../i...o..vi...I..vi..Richwi..................PE..L...^.{N...........!..........k...............................................p......................................S..H...(9........o.......................o. L...................................................................................text...>........................... ..`.rdata..............................@..@.data...@-j......0J.................@....rsrc.........o.. ....O.............@..@.reloc..^.....o.......O.............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCA9581.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	451584
Entropy (8bit):	6.633475066767831
Encrypted:	false
SSDEEP:	12288:mrbSamvjD2cZWXUO54kyWEWJhDZMxKArmov4MBt5ICZbXCZwAsEqDJmsx:jrW3MYZMBMCZTCKAhkx
MD5:	299135CBEA145397A22397CAE21213A8
SHA1:	46C8C87C305CEE7C3135B7C1DA2C44A49308496A
SHA-256:	4276676C659EB6349A5F09843E3A0BB8A4DDE86D730479EECB266BDBEC9FA8B7
SHA-512:	FB8192F731460898B7A28287F589ABB418F4F8106055099CCE6B57CC8A09165265F36192CEC6A50FD9D9E55D41030576FDB2C95CF518F0F5322BCFF7A674FE4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.>$..Pw..Pw..Pw.w.w-.Pwh..w0.Pwh..w..Pwh..w..Pw.(.w".Pw#..w+.Pw..Qw..Pw#..w=.Pw#..w&.Pw#..w/.Pw#..w/.Pw...w/.Pw#..w/.PwRich..Pw................PE..L...az.W...........!.........@......d.....................................................@..........................e......Pm...................................<..p...8............................A..@............................................text............................... ..`.rdata..^...........................@..@.data...............................@....rsrc...............................@..@.reloc...<.......>..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCA95A2.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	13908
Entropy (8bit):	5.428822268377484
Encrypted:	false
SSDEEP:	384:Su8VYXvazOb99Hcii0jhA+PxDpEmWglTheWfnJOk2hOkb9rVcy/qJ5+r8FKepjG6:SjVYXvazOb99Hcii0jhA+PxDpEmWglTL
MD5:	7CA21868FA90974E05C472AD8145837D
SHA1:	96A5C9DB0F9E8874D51234E1A2E43A9872E77129
SHA-256:	1F22EDE89356E5F200E100FF05BBC7CE377FE7D25B4F7489C4BEC89CA6685ACD
SHA-512:	20A3B230D7CF7CC69D055F2080DEEC8CE5936F1C9C55DDF7621D594B9873D0F63357820550469A687BA170204AC978635E95C0D4A5EE347991ADF7CD9FF6B10E
Malicious:	false
Preview:	!<arch>./ 1473149536 0 3451 `....R...........$..2D..2D..1Z..1Z..4...4...5t..5t..4...4...5...5...4...4...3...3...3$..3$..2...2...0...0...1...1...%...%...%...%...$...$...+r..+r..$...$.........!...!...(@..(@.."~.."~..(...(...#...#...)...)...#...#...)N..)N..^..^..,...,... v.. v..&...&...&"..&"..!\|..!\|..'...'... ... ...',..',..0`../...-....t../l......,...-...-.__IMPORT_DESCRIPTOR_HCAlarm.__NULL_IMPORT_DESCRIPTOR..HCAlarm_NULL_THUNK_DATA._COM_Alarm_Init@0.__imp__COM_Alarm_Init@0._COM_Alarm_Fini@0.__imp__COM_Alarm_Fini@0._COM_StartListen@8.__imp__COM_StartListen@8._COM_StopListen@0.__imp__COM_StopListen@0._COM_StartListen_V30@16.__imp__COM_StartListen_V30@16._COM_StopListen_V30@4.__imp__COM_StopListen_V30@4._COM_StartRecvNakedDataListen@8.__imp__COM_StartRecvNakedDataListen@8._COM_SetNakedDataRecvCallBack@12.__imp__COM_SetNakedDataRecvCallBack@12._COM_OpenAlarmChan@8.__imp__COM_OpenAlarmChan@8._COM_CloseAlarmChan@4.__imp__COM_CloseAlarmChan@4._COM_Ala

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCAlarm.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	451584
Entropy (8bit):	6.633475066767831
Encrypted:	false
SSDEEP:	12288:mrbSamvjD2cZWXUO54kyWEWJhDZMxKArmov4MBt5ICZbXCZwAsEqDJmsx:jrW3MYZMBMCZTCKAhkx
MD5:	299135CBEA145397A22397CAE21213A8
SHA1:	46C8C87C305CEE7C3135B7C1DA2C44A49308496A
SHA-256:	4276676C659EB6349A5F09843E3A0BB8A4DDE86D730479EECB266BDBEC9FA8B7
SHA-512:	FB8192F731460898B7A28287F589ABB418F4F8106055099CCE6B57CC8A09165265F36192CEC6A50FD9D9E55D41030576FDB2C95CF518F0F5322BCFF7A674FE4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.>$..Pw..Pw..Pw.w.w-.Pwh..w0.Pwh..w..Pwh..w..Pw.(.w".Pw#..w+.Pw..Qw..Pw#..w=.Pw#..w&.Pw#..w/.Pw#..w/.Pw...w/.Pw#..w/.PwRich..Pw................PE..L...az.W...........!.........@......d.....................................................@..........................e......Pm...................................<..p...8............................A..@............................................text............................... ..`.rdata..^...........................@..@.data...............................@....rsrc...............................@..@.reloc...<.......>..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCAlarm.lib (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	13908
Entropy (8bit):	5.428822268377484
Encrypted:	false
SSDEEP:	384:Su8VYXvazOb99Hcii0jhA+PxDpEmWglTheWfnJOk2hOkb9rVcy/qJ5+r8FKepjG6:SjVYXvazOb99Hcii0jhA+PxDpEmWglTL
MD5:	7CA21868FA90974E05C472AD8145837D
SHA1:	96A5C9DB0F9E8874D51234E1A2E43A9872E77129
SHA-256:	1F22EDE89356E5F200E100FF05BBC7CE377FE7D25B4F7489C4BEC89CA6685ACD
SHA-512:	20A3B230D7CF7CC69D055F2080DEEC8CE5936F1C9C55DDF7621D594B9873D0F63357820550469A687BA170204AC978635E95C0D4A5EE347991ADF7CD9FF6B10E
Malicious:	false
Preview:	!<arch>./ 1473149536 0 3451 `....R...........$..2D..2D..1Z..1Z..4...4...5t..5t..4...4...5...5...4...4...3...3...3$..3$..2...2...0...0...1...1...%...%...%...%...$...$...+r..+r..$...$.........!...!...(@..(@.."~.."~..(...(...#...#...)...)...#...#...)N..)N..^..^..,...,... v.. v..&...&...&"..&"..!\|..!\|..'...'... ... ...',..',..0`../...-....t../l......,...-...-.__IMPORT_DESCRIPTOR_HCAlarm.__NULL_IMPORT_DESCRIPTOR..HCAlarm_NULL_THUNK_DATA._COM_Alarm_Init@0.__imp__COM_Alarm_Init@0._COM_Alarm_Fini@0.__imp__COM_Alarm_Fini@0._COM_StartListen@8.__imp__COM_StartListen@8._COM_StopListen@0.__imp__COM_StopListen@0._COM_StartListen_V30@16.__imp__COM_StartListen_V30@16._COM_StopListen_V30@4.__imp__COM_StopListen_V30@4._COM_StartRecvNakedDataListen@8.__imp__COM_StartRecvNakedDataListen@8._COM_SetNakedDataRecvCallBack@12.__imp__COM_SetNakedDataRecvCallBack@12._COM_OpenAlarmChan@8.__imp__COM_OpenAlarmChan@8._COM_CloseAlarmChan@4.__imp__COM_CloseAlarmChan@4._COM_Ala

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCC95A3.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808448
Entropy (8bit):	6.700858080526708
Encrypted:	false
SSDEEP:	24576:+KdJyLw+4JfK5Hv/2XqiwIWtJzbAXTKVn:+KdJyiG/5hdAXTKh
MD5:	91CA99153A084D8F7502EBE12A6A6E37
SHA1:	B224338CCD72198D69002D384BEFBAC33AD1E3FB
SHA-256:	C4B47327EB06017FD425B2C3566D698BA3F21A860FC5AF8542136B2BD5686417
SHA-512:	262FE6036BEF9B275899111ACBE5D5E0E287F1A1672FCC88F41687A3EB0F904A76E09E15B98E13454017BB58F546E00AF1F70C6E53752D314F55CB950354E281
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.....v...v...v..O....v.P...4.v.P...X.v.P.....v.......v.q....v.......v...w...v.......v.......v.......v.......v.......v.......v.Rich..v.................PE..L...$z.W...........!.........f............................................................@.............................I&..L...................................8t......8...........................@...@............................................text............................... ..`.rdata..&...........................@..@.data.... .......*..................@....rsrc...............................@..@.reloc..8t.......v..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCCoreDevCfg.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808448
Entropy (8bit):	6.700858080526708
Encrypted:	false
SSDEEP:	24576:+KdJyLw+4JfK5Hv/2XqiwIWtJzbAXTKVn:+KdJyiG/5hdAXTKh
MD5:	91CA99153A084D8F7502EBE12A6A6E37
SHA1:	B224338CCD72198D69002D384BEFBAC33AD1E3FB
SHA-256:	C4B47327EB06017FD425B2C3566D698BA3F21A860FC5AF8542136B2BD5686417
SHA-512:	262FE6036BEF9B275899111ACBE5D5E0E287F1A1672FCC88F41687A3EB0F904A76E09E15B98E13454017BB58F546E00AF1F70C6E53752D314F55CB950354E281
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.....v...v...v..O....v.P...4.v.P...X.v.P.....v.......v.q....v.......v...w...v.......v.......v.......v.......v.......v.......v.Rich..v.................PE..L...$z.W...........!.........f............................................................@.............................I&..L...................................8t......8...........................@...@............................................text............................... ..`.rdata..&...........................@..@.data.... .......*..................@....rsrc...............................@..@.reloc..8t.......v..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCD95D2.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	607232
Entropy (8bit):	6.668588656301604
Encrypted:	false
SSDEEP:	12288:mXiMFVGV1SpTOmGkuBimnPLJdqRgHDCo+B2E8vFo:mdFVGVYpLGZPL7qaHDD+UNF
MD5:	CC0028D68C510EE090C2E4B6F67F615F
SHA1:	774AD25B3AC600CE11320E2C13EC7F3EDD35CCE2
SHA-256:	F67480539CEAAF46A4B47847F8EA239EA2C9BC8CCE1D0B9A742F2829542AB029
SHA-512:	96B2C8FD64D52AAFAC02B34DB97957E7C43AEBF4877406C7F436F63112C6710F10719300757187C0142C43A766182F095208C94EA05FFDD5CBB0B23C9351CB3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9..I....9...h...9...h..C9...h...9......9...k...9...9~..8...k...9...k...9...k...9...k...9...9..9...k...9..Rich.9..................PE..L...{z.W...........!................=........................................`............@......................... ............................................H..@...8...........................x{..@............................................text...]........................... ..`.rdata...+.......,..................@..@.data...............................@....rsrc...............................@..@.reloc...H.......J..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCDisplay.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	607232
Entropy (8bit):	6.668588656301604
Encrypted:	false
SSDEEP:	12288:mXiMFVGV1SpTOmGkuBimnPLJdqRgHDCo+B2E8vFo:mdFVGVYpLGZPL7qaHDD+UNF
MD5:	CC0028D68C510EE090C2E4B6F67F615F
SHA1:	774AD25B3AC600CE11320E2C13EC7F3EDD35CCE2
SHA-256:	F67480539CEAAF46A4B47847F8EA239EA2C9BC8CCE1D0B9A742F2829542AB029
SHA-512:	96B2C8FD64D52AAFAC02B34DB97957E7C43AEBF4877406C7F436F63112C6710F10719300757187C0142C43A766182F095208C94EA05FFDD5CBB0B23C9351CB3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9..I....9...h...9...h..C9...h...9......9...k...9...9~..8...k...9...k...9...k...9...k...9...9..9...k...9..Rich.9..................PE..L...{z.W...........!................=........................................`............@......................... ............................................H..@...8...........................x{..@............................................text...]........................... ..`.rdata...+.......,..................@..@.data...............................@....rsrc...............................@..@.reloc...H.......J..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCG95F3.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	962560
Entropy (8bit):	6.695796603206582
Encrypted:	false
SSDEEP:	24576:LheT/3xZL5SW7UmU6kEqNltsOihXnw5XlgTAo/:LheT/HL5SWQt0h0yb/
MD5:	6927CFAED9888771A99B773AD36130AE
SHA1:	4ED56F4B91D1C346C7CCC760D3CF53D3D5D20896
SHA-256:	A5913B5D4679A32A0F7D352AFB5ED763A39B4940EA85F444736F540ED028028B
SHA-512:	8DF774D8EF5BE9E93057EA3AA8EA9A44823B433C9972C7DE2FDF1D1ED7B6E0CFCA2A7C2B5B3B03835FD3DCCEA115E7C1E0A89F91D575D02E19532178530D3C1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g...~...~...~.......~..W....~..W....~..W....~.F.....~..T....~.......~..T....~..T....~..T....~..T....~.....~..T....~.Rich..~.................PE..L....z.W...........!................\.....................................................@..........................................P.......................`..t}......8............................s..@...............L............................text............................... ..`.rdata..D".......$..................@..@.data...,....0......................@....rsrc........P......................@..@.reloc..t}...`...~...2..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCG9632.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	48280
Entropy (8bit):	5.37788744883527
Encrypted:	false
SSDEEP:	768:NVXvazOb99Hcii0jhA+PxDpEmWglTheWfnJOk2hOkb9/qJ5+r8FlFM+yIN3QPFiZ:NVXvazOb99Hcii0jhA+PxDpEmWglThem
MD5:	7E8C03E39DDA7148D57046F61E6F3DF2
SHA1:	CFE194E99AF5FF8D0AA7DCDBE5BF5D07D99F70F6
SHA-256:	AEF4711330824A95FC07886A547BE00AB502A758BEA39B79AAFA4B2C125F1020
SHA-512:	8BF71B92F47990F3DE451C60A793C7424CB72E882702B34B4B46FAE853B245F8B152228ECD15C18590A5ABDB7AF7CC6A32BA317502A187789DDC2D28CED8D755
Malicious:	false
Preview:	!<arch>./ 1473149571 0 11858 `....Y.._...b...cF...................h...h...................N...N..........x:..x:...................n...n...h...h..}...}............V...V...................\...\...L...L...v...v..........\|&..\|&...........................................................X...X...........p...p..........~...~............\|...\|...f...f...................................:...:...........................r...r...&...&...........f...f...................P...P...........v...v.........................................................^...^...:...:...:...:...................................................................d...d...........4...4..........................~...~....................h...h..........y4..y4..x...x...y...y....\|...\|...........p...p...........................$...$...L...L...................................................,...,...v...v..z...z...{,..{,..z6..z6...p...p...X...X...........L...L...........L...L...........D...D..........

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCGeneralCfgMgr.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	962560
Entropy (8bit):	6.695796603206582
Encrypted:	false
SSDEEP:	24576:LheT/3xZL5SW7UmU6kEqNltsOihXnw5XlgTAo/:LheT/HL5SWQt0h0yb/
MD5:	6927CFAED9888771A99B773AD36130AE
SHA1:	4ED56F4B91D1C346C7CCC760D3CF53D3D5D20896
SHA-256:	A5913B5D4679A32A0F7D352AFB5ED763A39B4940EA85F444736F540ED028028B
SHA-512:	8DF774D8EF5BE9E93057EA3AA8EA9A44823B433C9972C7DE2FDF1D1ED7B6E0CFCA2A7C2B5B3B03835FD3DCCEA115E7C1E0A89F91D575D02E19532178530D3C1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g...~...~...~.......~..W....~..W....~..W....~.F.....~..T....~.......~..T....~..T....~..T....~..T....~.....~..T....~.Rich..~.................PE..L....z.W...........!................\.....................................................@..........................................P.......................`..t}......8............................s..@...............L............................text............................... ..`.rdata..D".......$..................@..@.data...,....0......................@....rsrc........P......................@..@.reloc..t}...`...~...2..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCGeneralCfgMgr.lib (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	48280
Entropy (8bit):	5.37788744883527
Encrypted:	false
SSDEEP:	768:NVXvazOb99Hcii0jhA+PxDpEmWglTheWfnJOk2hOkb9/qJ5+r8FlFM+yIN3QPFiZ:NVXvazOb99Hcii0jhA+PxDpEmWglThem
MD5:	7E8C03E39DDA7148D57046F61E6F3DF2
SHA1:	CFE194E99AF5FF8D0AA7DCDBE5BF5D07D99F70F6
SHA-256:	AEF4711330824A95FC07886A547BE00AB502A758BEA39B79AAFA4B2C125F1020
SHA-512:	8BF71B92F47990F3DE451C60A793C7424CB72E882702B34B4B46FAE853B245F8B152228ECD15C18590A5ABDB7AF7CC6A32BA317502A187789DDC2D28CED8D755
Malicious:	false
Preview:	!<arch>./ 1473149571 0 11858 `....Y.._...b...cF...................h...h...................N...N..........x:..x:...................n...n...h...h..}...}............V...V...................\...\...L...L...v...v..........\|&..\|&...........................................................X...X...........p...p..........~...~............\|...\|...f...f...................................:...:...........................r...r...&...&...........f...f...................P...P...........v...v.........................................................^...^...:...:...:...:...................................................................d...d...........4...4..........................~...~....................h...h..........y4..y4..x...x...y...y....\|...\|...........p...p...........................$...$...L...L...................................................,...,...v...v..z...z...{,..{,..z6..z6...p...p...X...X...........L...L...........L...L...........D...D..........

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCI9643.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	705024
Entropy (8bit):	6.687930527724055
Encrypted:	false
SSDEEP:	12288:6ZkE6R+l63FZY6QjzmvYFnX8ds/PEJ2Q7EVNiomBR0lEr0S08L/:TE6RcrBX8r2LVNvmBR4Ebv
MD5:	741EE76213C6F725DD88B178FFF469DF
SHA1:	084AAAED36C8675926E1AF486A48BB584DD2A538
SHA-256:	8D28BE6923F05DC2FE2D8E21BE9DD5A0F0B141A635CA818A7487611AB7E59E37
SHA-512:	86FE3F8BE9552485B2517D22FF03E61F0F311E6EE7766CDD4FDF5CFFEEBA135D625AC5D558FB58BDA2F4CF30BE521D06C4D420296BF018F2D51845C9C247EC58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7Z.xs;.+s;.+s;.+.l+p;.+5jt+S;.+5jK+.;.+5jJ+3;.+..`+.;.+~iv+v;.+s;.+3:.+~iN+b;.+~iJ+S;.+~iw+r;.+~ip+r;.+s;<+r;.+~iu+r;.+Richs;.+........PE..L....z.W...........!.................n.......0............................................@..........................#......\|B..................................(N...5..8...........................p...@............0.. ............................text............................... ..`.rdata...6...0...8..................@..@.data...l....p.......T..............@....rsrc................n..............@..@.reloc..(N.......P...r..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCIndustry.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	705024
Entropy (8bit):	6.687930527724055
Encrypted:	false
SSDEEP:	12288:6ZkE6R+l63FZY6QjzmvYFnX8ds/PEJ2Q7EVNiomBR0lEr0S08L/:TE6RcrBX8r2LVNvmBR4Ebv
MD5:	741EE76213C6F725DD88B178FFF469DF
SHA1:	084AAAED36C8675926E1AF486A48BB584DD2A538
SHA-256:	8D28BE6923F05DC2FE2D8E21BE9DD5A0F0B141A635CA818A7487611AB7E59E37
SHA-512:	86FE3F8BE9552485B2517D22FF03E61F0F311E6EE7766CDD4FDF5CFFEEBA135D625AC5D558FB58BDA2F4CF30BE521D06C4D420296BF018F2D51845C9C247EC58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7Z.xs;.+s;.+s;.+.l+p;.+5jt+S;.+5jK+.;.+5jJ+3;.+..`+.;.+~iv+v;.+s;.+3:.+~iN+b;.+~iJ+S;.+~iw+r;.+~ip+r;.+s;<+r;.+~iu+r;.+Richs;.+........PE..L....z.W...........!.................n.......0............................................@..........................#......\|B..................................(N...5..8...........................p...@............0.. ............................text............................... ..`.rdata...6...0...8..................@..@.data...l....p.......T..............@....rsrc................n..............@..@.reloc..(N.......P...r..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCP9663.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415744
Entropy (8bit):	6.623908012002475
Encrypted:	false
SSDEEP:	6144:U2pI1EaXJcDFlPB1FKlddhmkKG9X1vFnfP/xiANdVWLQUUR9m:U2pI1EaXJcHUldTX/nfPpZv8LQR9m
MD5:	E34C0B677F83336E8D31A79F436F2752
SHA1:	277CA656006475C94EC777E87599F64DE9732BFD
SHA-256:	D45DF1F012B64D4BB7C9353AAD6B9A523AE8BBB1226A2A71DBDCD381869717B0
SHA-512:	F59FEBB87DC7FC15D67C72E34F5B5AB1D6088EA8A3BA62ED99125317482BF04652E59ED4FBEF08FD729EC2E05108DD4F01F2830988DEC77525C189932DC19554
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X29.9\j.9\j.9\jn..j.9\j.h.j.9\j.h.j`9\j.h.j.9\j-.j.9\j.k.j.9\j.9]j.8\j.k.j.9\j.k.j.9\j.k.j.9\j.k.j.9\j.9.j.9\j.k.j.9\jRich.9\j................PE..L...kz.W...........!.........F.............. ............................................@..........................................@.......................P...;..@%..8...............................@............ ...............................text............................... ..`.rdata....... ......................@..@.data........ ......................@....rsrc........@......................@..@.reloc...;...P...<..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCP9683.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	618496
Entropy (8bit):	6.646565615568588
Encrypted:	false
SSDEEP:	12288:UTtjzuoPNNVN/fjhVlqDrthdMGf2LFxcSETO/M9mV3nXZCg0D:e/uoPFh1j6rthd9GFmSmOk963n+
MD5:	8F98B99B19313CF0FCB4DDA115023915
SHA1:	57192D9E146FE7B7D747DCCCCDA786457F3CC39B
SHA-256:	E331BC1D887E7448F87EB712BFECE1E72B488491AF4EAC0E1529AA0B31D1C662
SHA-512:	4A39B33300BE1D47355A0CF19BD494B1295B7ADEF67434967000FBA645039F3FEE1D9BDB8B0E3E704244BB81182693C2AB30AD820187297F4B3E7D2875389E6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."...".;....".......".......".....s.".id...."......."...#...".......".......".......".......".......".......".Rich..".........................PE..L...fz.W...........!.....b...........~....................................................@.........................p...+............0.......................@...]......8............................K..@...............@............................text...h`.......b.................. ..`.rdata...\|.......~...f..............@..@.data..............................@....rsrc........0......................@..@.reloc...]...@...^..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCP96B3.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	36634
Entropy (8bit):	5.471998245055127
Encrypted:	false
SSDEEP:	768:nRM9nSHXvazOb99Hcii0jhA+PxDpEmWglTheWfnJOk2hOkb9+E8fQz4C/qJ5+r8g:R6SHXvazOb99Hcii0jhA+PxDpEmWglTY
MD5:	73CAE3097DAF5CAFF335804469663DF1
SHA1:	DF006AFB1C3A7C7BE054232C6ACE306360BE1EAB
SHA-256:	05043412D9E2EA22C26DBAD48242EFC6343446C375C62FA79F30B24E45B96B45
SHA-512:	CF599BA8EE5700D780A8578F20B09F3840AE6E0A6DE3A5D8D742525AB0635B9DB1BC14AFFFD5EC371B220C0DC5C85E1F5A57BD6D60C78C3173B37C2B76239DBF
Malicious:	false
Preview:	!<arch>./ 1473149540 0 9214 `.......J...L2..Mj..~(..~(..}6..}6...@...@..........\|...\|...jl..jl..~...~............f...f..r...r...s..s..o...o...it..it..i...i...p...p....V...V...<...<...t...t...........&...&..s...s...j...j...t...t...kN..kN...f...f..qX..qX...r...r..m...m............................................&...&..........g...g...f"..f"..f...f...oz..oz..g...g...rB..rB...b...b..q...q....................N...N..........h...h...........t...t...e...e...k...k...........l...l...pj..pj..h...h...l:..l:...................H...H..........................wV..wV..t...t...o...o...n...n...n ..n ..vb..vb..uj..uj..y(..y(..z...z...w...w...x...x...................{j..{j..\|J..\|J..z...z...z...z...m...m....~...~..v...v...y...y...x>..x>..{...{...u...u...}...}...h...h...W...W...U...U...T...T...^...^...R...R...]...]...P...P...Z...Z...QX..QX..[T..[T..Rd..Rd..\h..\h..Q...Q...[...[...\...\..._0.._0..O...O...Y...Y...Y4..Y4..PR..PR..ZB..ZB..W...W...S...S...Sl..Sl..^...^...d.

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCPlayBack.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415744
Entropy (8bit):	6.623908012002475
Encrypted:	false
SSDEEP:	6144:U2pI1EaXJcDFlPB1FKlddhmkKG9X1vFnfP/xiANdVWLQUUR9m:U2pI1EaXJcHUldTX/nfPpZv8LQR9m
MD5:	E34C0B677F83336E8D31A79F436F2752
SHA1:	277CA656006475C94EC777E87599F64DE9732BFD
SHA-256:	D45DF1F012B64D4BB7C9353AAD6B9A523AE8BBB1226A2A71DBDCD381869717B0
SHA-512:	F59FEBB87DC7FC15D67C72E34F5B5AB1D6088EA8A3BA62ED99125317482BF04652E59ED4FBEF08FD729EC2E05108DD4F01F2830988DEC77525C189932DC19554
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X29.9\j.9\j.9\jn..j.9\j.h.j.9\j.h.j`9\j.h.j.9\j-.j.9\j.k.j.9\j.9]j.8\j.k.j.9\j.k.j.9\j.k.j.9\j.k.j.9\j.9.j.9\j.k.j.9\jRich.9\j................PE..L...kz.W...........!.........F.............. ............................................@..........................................@.......................P...;..@%..8...............................@............ ...............................text............................... ..`.rdata....... ......................@..@.data........ ......................@....rsrc........@......................@..@.reloc...;...P...<..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCPreview.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	618496
Entropy (8bit):	6.646565615568588
Encrypted:	false
SSDEEP:	12288:UTtjzuoPNNVN/fjhVlqDrthdMGf2LFxcSETO/M9mV3nXZCg0D:e/uoPFh1j6rthd9GFmSmOk963n+
MD5:	8F98B99B19313CF0FCB4DDA115023915
SHA1:	57192D9E146FE7B7D747DCCCCDA786457F3CC39B
SHA-256:	E331BC1D887E7448F87EB712BFECE1E72B488491AF4EAC0E1529AA0B31D1C662
SHA-512:	4A39B33300BE1D47355A0CF19BD494B1295B7ADEF67434967000FBA645039F3FEE1D9BDB8B0E3E704244BB81182693C2AB30AD820187297F4B3E7D2875389E6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."...".;....".......".......".....s.".id...."......."...#...".......".......".......".......".......".......".Rich..".........................PE..L...fz.W...........!.....b...........~....................................................@.........................p...+............0.......................@...]......8............................K..@...............@............................text...h`.......b.................. ..`.rdata...\|.......~...f..............@..@.data..............................@....rsrc........0......................@..@.reloc...]...@...^..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCPreview.lib (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	36634
Entropy (8bit):	5.471998245055127
Encrypted:	false
SSDEEP:	768:nRM9nSHXvazOb99Hcii0jhA+PxDpEmWglTheWfnJOk2hOkb9+E8fQz4C/qJ5+r8g:R6SHXvazOb99Hcii0jhA+PxDpEmWglTY
MD5:	73CAE3097DAF5CAFF335804469663DF1
SHA1:	DF006AFB1C3A7C7BE054232C6ACE306360BE1EAB
SHA-256:	05043412D9E2EA22C26DBAD48242EFC6343446C375C62FA79F30B24E45B96B45
SHA-512:	CF599BA8EE5700D780A8578F20B09F3840AE6E0A6DE3A5D8D742525AB0635B9DB1BC14AFFFD5EC371B220C0DC5C85E1F5A57BD6D60C78C3173B37C2B76239DBF
Malicious:	false
Preview:	!<arch>./ 1473149540 0 9214 `.......J...L2..Mj..~(..~(..}6..}6...@...@..........\|...\|...jl..jl..~...~............f...f..r...r...s..s..o...o...it..it..i...i...p...p....V...V...<...<...t...t...........&...&..s...s...j...j...t...t...kN..kN...f...f..qX..qX...r...r..m...m............................................&...&..........g...g...f"..f"..f...f...oz..oz..g...g...rB..rB...b...b..q...q....................N...N..........h...h...........t...t...e...e...k...k...........l...l...pj..pj..h...h...l:..l:...................H...H..........................wV..wV..t...t...o...o...n...n...n ..n ..vb..vb..uj..uj..y(..y(..z...z...w...w...x...x...................{j..{j..\|J..\|J..z...z...z...z...m...m....~...~..v...v...y...y...x>..x>..{...{...u...u...}...}...h...h...W...W...U...U...T...T...^...^...R...R...]...]...P...P...Z...Z...QX..QX..[T..[T..Rd..Rd..\h..\h..Q...Q...[...[...\...\..._0.._0..O...O...Y...Y...Y4..Y4..PR..PR..ZB..ZB..W...W...S...S...Sl..Sl..^...^...d.

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCV96C4.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	603136
Entropy (8bit):	6.666062778846685
Encrypted:	false
SSDEEP:	12288:t32Mx87Ohuiu2/OJS+c+BkQriTWqWlrG3mmmxHEQdU4h5sDvfFAVoPe9iDGyhJY/:t32M2dknJPe9iRCt1fTyGSE
MD5:	8A2981A9DAFF963146A520FC25273A75
SHA1:	F307DAED5CD93F3B70F589432B0D2CA587D4C49C
SHA-256:	2908DA72D5DB5B5EFD3F835ABCDB9B0127533F47E0F31093CC377FF65D28A91B
SHA-512:	4CC5B815B9D47E12768BE3AA316BE2A894756F5414B6F9625FFC3D81473129FF24E7FA795DD7D7934B3120F5B19CED7A92B50CCCF3EC15E1AE369389AEFE35B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.............qQ..qQ..qQ`.{Q..qQ.AQ..qQ...Q..qQ..Q..qQ..Q..qQ..QM.qQUH.Q..qQ..Q..qQ..pQw.qQ..Q..qQ..Q..qQ..Q..qQ..Q..qQ...Q..qQ..Q..qQRich..qQ........................PE..L...gz.W...........!.................W....... ...............................`............@..........................0......`;..................................DX...$..8...............................@............ ...............................text............................... ..`.rdata..:8... ...:..................@..@.data........`.......H..............@....rsrc...............................@..@.reloc..DX.......Z..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\HCVoiceTalk.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	603136
Entropy (8bit):	6.666062778846685
Encrypted:	false
SSDEEP:	12288:t32Mx87Ohuiu2/OJS+c+BkQriTWqWlrG3mmmxHEQdU4h5sDvfFAVoPe9iDGyhJY/:t32M2dknJPe9iRCt1fTyGSE
MD5:	8A2981A9DAFF963146A520FC25273A75
SHA1:	F307DAED5CD93F3B70F589432B0D2CA587D4C49C
SHA-256:	2908DA72D5DB5B5EFD3F835ABCDB9B0127533F47E0F31093CC377FF65D28A91B
SHA-512:	4CC5B815B9D47E12768BE3AA316BE2A894756F5414B6F9625FFC3D81473129FF24E7FA795DD7D7934B3120F5B19CED7A92B50CCCF3EC15E1AE369389AEFE35B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.............qQ..qQ..qQ`.{Q..qQ.AQ..qQ...Q..qQ..Q..qQ..Q..qQ..QM.qQUH.Q..qQ..Q..qQ..pQw.qQ..Q..qQ..Q..qQ..Q..qQ..Q..qQ...Q..qQ..Q..qQRich..qQ........................PE..L...gz.W...........!.................W....... ...............................`............@..........................0......`;..................................DX...$..8...............................@............ ...............................text............................... ..`.rdata..:8... ...:..................@..@.data........`.......H..............@....rsrc...............................@..@.reloc..DX.......Z..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Ope9753.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	427008
Entropy (8bit):	6.90258779602995
Encrypted:	false
SSDEEP:	6144:rXv1/ktv9QkVZN/Ju8sBfwvixrahNybEsl2ufvtgp2HlofevpQZjNAOs+D1Q3:rXv1Mok7N/mBfwMxbEsrHthLhQZjNVa
MD5:	52C83A72943B529B7F495B0606C117B6
SHA1:	DCC74F5109A09C4CEC8274F2968159C80016002D
SHA-256:	B21AE0059A8182A51D1645A44F403429E60E26453353C0D708D7F501557CA01C
SHA-512:	17179685E6E65C9130CCAEA16C8953BE818E4C6502595CB2E6DABEBBC05F904E98B1797173E880DDFB64276CB0B53D48D8CAAE28457D1531160810AF90EB6706
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........ZX...X...X.....w.Z...F.e.{...F.t.j....A..S...X......F.b....F.s.Y...F.p.Y...RichX...........................PE..L...N..Q...........!................=................................................z....@.........................p-.......!..x................................-......................................@............................................text...J........................... ..`.rdata..}K.......L..................@..@.data....;...@.......0..............@....rsrc................J..............@..@.reloc...7.......8...L..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\OpenAL32.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	427008
Entropy (8bit):	6.90258779602995
Encrypted:	false
SSDEEP:	6144:rXv1/ktv9QkVZN/Ju8sBfwvixrahNybEsl2ufvtgp2HlofevpQZjNAOs+D1Q3:rXv1Mok7N/mBfwMxbEsrHthLhQZjNVa
MD5:	52C83A72943B529B7F495B0606C117B6
SHA1:	DCC74F5109A09C4CEC8274F2968159C80016002D
SHA-256:	B21AE0059A8182A51D1645A44F403429E60E26453353C0D708D7F501557CA01C
SHA-512:	17179685E6E65C9130CCAEA16C8953BE818E4C6502595CB2E6DABEBBC05F904E98B1797173E880DDFB64276CB0B53D48D8CAAE28457D1531160810AF90EB6706
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........ZX...X...X.....w.Z...F.e.{...F.t.j....A..S...X......F.b....F.s.Y...F.p.Y...RichX...........................PE..L...N..Q...........!................=................................................z....@.........................p-.......!..x................................-......................................@............................................text...J........................... ..`.rdata..}K.......L..................@..@.data....;...@.......0..............@....rsrc................J..............@..@.reloc...7.......8...L..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Str9774.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	409088
Entropy (8bit):	6.640655014673325
Encrypted:	false
SSDEEP:	12288:klvCj8kGuvL/Zqy87c3ylxMrm87mj7jwMu:V3GsL/Zqy87YOGrm87mHu
MD5:	A595F1A326C9B156FF86F3EAC18C5EE0
SHA1:	098EF941CC15AD173AAFB19025CF579A26BC5ADB
SHA-256:	9EE74600E0FDE967881828555D0438EC52E3BFB5671622391E5D584114EA7909
SHA-512:	C300715352F66B4BEB1F6868F72B3C7C4FB825F537270F561FB7C8102D38E8528859D75F263300E9F3B343AF2C00ACBEE09D9AD2ADA8A9A0A91DDE846A61C817
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.............,1.....D.).....D.....D...B....s=.............................*.......-.......a.......(.....Rich....................PE..L....j{W...........!.........f.......G....................................................@..........................................0.......................@...9.. ...8...............................@............................................text............................... ..`.rdata..T...........................@..@.data...,-..........................@....rsrc........0......................@..@.reloc...9...@...:..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\StreamTransClient.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	409088
Entropy (8bit):	6.640655014673325
Encrypted:	false
SSDEEP:	12288:klvCj8kGuvL/Zqy87c3ylxMrm87mj7jwMu:V3GsL/Zqy87YOGrm87mHu
MD5:	A595F1A326C9B156FF86F3EAC18C5EE0
SHA1:	098EF941CC15AD173AAFB19025CF579A26BC5ADB
SHA-256:	9EE74600E0FDE967881828555D0438EC52E3BFB5671622391E5D584114EA7909
SHA-512:	C300715352F66B4BEB1F6868F72B3C7C4FB825F537270F561FB7C8102D38E8528859D75F263300E9F3B343AF2C00ACBEE09D9AD2ADA8A9A0A91DDE846A61C817
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.............,1.....D.).....D.....D...B....s=.............................*.......-.......a.......(.....Rich....................PE..L....j{W...........!.........f.......G....................................................@..........................................0.......................@...9.. ...8...............................@............................................text............................... ..`.rdata..T...........................@..@.data...,-..........................@....rsrc........0......................@..@.reloc...9...@...:..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\Sys9794.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507904
Entropy (8bit):	6.479804569799614
Encrypted:	false
SSDEEP:	6144:Q+W2J+dFRMAs/0uRPm5Yus2ZPlUnbkIPHXjT2xrsl:8rRMAs/jYlUbk4jaxQl
MD5:	ECEC3AD22B8FF0FB938389F6FB3399B9
SHA1:	8579F3C3D4B167BE8417F6E80D2C2631F51867BB
SHA-256:	C0591C22C9FD867999A265C15CA6DD6F13C7B10E686C1DCD5140C2D8B40BC558
SHA-512:	C6CE7697E17FEF1F84A7FBD80D461B43D722F9814E0DF1AAE1F93B4535DC92759ABDD34832CA64D9E84A992409AB7E9158D1FA64175184C839A59B1F7D1311DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................5.................).....#.....$.....2.....4.....1....Rich...........PE..L......W...........!.................m..............................................(................................q..n....g..<...............................,+...................................;..@............................................text............................... ..`.rdata..............................@..@.data...@I...........^..............@....rsrc...............................@..@.reloc..N-..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\SystemTransform.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507904
Entropy (8bit):	6.479804569799614
Encrypted:	false
SSDEEP:	6144:Q+W2J+dFRMAs/0uRPm5Yus2ZPlUnbkIPHXjT2xrsl:8rRMAs/jYlUbk4jaxQl
MD5:	ECEC3AD22B8FF0FB938389F6FB3399B9
SHA1:	8579F3C3D4B167BE8417F6E80D2C2631F51867BB
SHA-256:	C0591C22C9FD867999A265C15CA6DD6F13C7B10E686C1DCD5140C2D8B40BC558
SHA-512:	C6CE7697E17FEF1F84A7FBD80D461B43D722F9814E0DF1AAE1F93B4535DC92759ABDD34832CA64D9E84A992409AB7E9158D1FA64175184C839A59B1F7D1311DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................5.................).....#.....$.....2.....4.....1....Rich...........PE..L......W...........!.................m..............................................(................................q..n....g..<...............................,+...................................;..@............................................text............................... ..`.rdata..............................@..@.data...@I...........^..............@....rsrc...............................@..@.reloc..N-..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\lib96F4.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	978432
Entropy (8bit):	7.389576051888232
Encrypted:	false
SSDEEP:	24576:Mf0TfklyKuJGavkg3Ny4WbbbVKHYsa4QhBAUZLYr5vx:AaayKuJGaXFQK4sDQhBAUZLYrtx
MD5:	FD1DC6C680299A2ED1EEDCC3EABDA601
SHA1:	E702404882B03014ABEB2ADEAD38A9E87AD90046
SHA-256:	CB016E794D3311C71F21D87803E10A0E1133995F62A485EB37B321CD9B9E1087
SHA-512:	2AED2D9F2D086A52A25F320DF3F2BDA144C6ADDE7D7F3BB8974EBCDEE7D65130246B357A54E383DAA88C22578193009EF0AC1F627C7094C413DC157ADCBC3DF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.mA..........."...8...........................h.........................@................ .........................l............ .......................0.......................................................................................text...............................`..`.data...@...........................@....bss.....................................edata..l................................idata..............................@....rsrc........ ......................@....reloc.......0..................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\libiconv2.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	978432
Entropy (8bit):	7.389576051888232
Encrypted:	false
SSDEEP:	24576:Mf0TfklyKuJGavkg3Ny4WbbbVKHYsa4QhBAUZLYr5vx:AaayKuJGaXFQK4sDQhBAUZLYrtx
MD5:	FD1DC6C680299A2ED1EEDCC3EABDA601
SHA1:	E702404882B03014ABEB2ADEAD38A9E87AD90046
SHA-256:	CB016E794D3311C71F21D87803E10A0E1133995F62A485EB37B321CD9B9E1087
SHA-512:	2AED2D9F2D086A52A25F320DF3F2BDA144C6ADDE7D7F3BB8974EBCDEE7D65130246B357A54E383DAA88C22578193009EF0AC1F627C7094C413DC157ADCBC3DF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.mA..........."...8...........................h.........................@................ .........................l............ .......................0.......................................................................................text...............................`..`.data...@...........................@....bss.....................................edata..l................................idata..............................@....rsrc........ ......................@....reloc.......0..................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\msv9724.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655872
Entropy (8bit):	6.890407230950918
Encrypted:	false
SSDEEP:	12288:1hr4UCeeHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axPFmRyy6aE:5e2g5gmO791I0E5uO9FAN9mRyyzE
MD5:	4D03CA609E68F4C90CF66515218017F8
SHA1:	545E440940073D5EC49D47FEFD421730F8B33EFB
SHA-256:	CF420ACED0D810E1D75F6811DD986F2D9FDED2FBB8D61FC9A7024520C475FEBB
SHA-512:	1B52D09F94BD37850D098AE7222E85E16A4F6DF14CFDFC28526CD98B81FB009865FA75774EE4FEAA2E5D5861BEA27759FE4FB979C902F8EA60AFA8C3E1F723FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L......H...........!.....Z..........@-.......p....Rx.........................0......!f....@.........................`....\|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetSDKCom\msvcr90.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655872
Entropy (8bit):	6.890407230950918
Encrypted:	false
SSDEEP:	12288:1hr4UCeeHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axPFmRyy6aE:5e2g5gmO791I0E5uO9FAN9mRyyzE
MD5:	4D03CA609E68F4C90CF66515218017F8
SHA1:	545E440940073D5EC49D47FEFD421730F8B33EFB
SHA-256:	CF420ACED0D810E1D75F6811DD986F2D9FDED2FBB8D61FC9A7024520C475FEBB
SHA-512:	1B52D09F94BD37850D098AE7222E85E16A4F6DF14CFDFC28526CD98B81FB009865FA75774EE4FEAA2E5D5861BEA27759FE4FB979C902F8EA60AFA8C3E1F723FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L......H...........!.....Z..........@-.......p....Rx.........................0......!f....@.........................`....\|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HCNetUtils.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	660480
Entropy (8bit):	6.6232964458681005
Encrypted:	false
SSDEEP:	12288:HQWeFMu6FueK1YKCZo6pNk27sIeN/VwGlGO5stiHyZiWdlK8AZYAwB:HQWeFMBKuKCaUNkesIcCPOugHyQWdHAO
MD5:	1F9EA54A536FC6E92092F5BA38275386
SHA1:	0451687D6B3BC4F4AA54F2879CE6B06585BDFF83
SHA-256:	0DC4F2E06FCFDF3822DB197822215DC8233E0D3B3705484425131939A5CF20F8
SHA-512:	4FEA86A9BFA82291C70E8B2BD5AF4E75111C7E97874CC4CDECCBE351A28B226084508E01A3148C226C8CF479B1BA469BC4852F38F57A8FCCD060ED10C65F23A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..gw..4w..4w..4.>#4r..41.;4U..41..4;..41..4...4...4...4...4r..4#..4g..4z..44..4w..4..4.a/4x..4z..4...4z.84v..4z.?4v..4w.s4v..4z.:4v..4Richw..4........PE..L....S.Z...........!.....@..........K........P............................... !...........@..........................R.......`..d..... ....................... ..k...R..8...............................@............P..$............................text...\|?.......@.................. ..`.rdata.......P.......D..............@..@.data....%...p...D...`..............@....rsrc......... .....................@..@.reloc...k.... ..l..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HDF8747.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	480768
Entropy (8bit):	5.831634335256444
Encrypted:	false
SSDEEP:	6144:3GgfAq5Kxua3LJoVszUxI0870TB4SO1b1xJ:WgF5KUMa6zUxJ8wT61bzJ
MD5:	3B99AB2D7585EED9BCF5A559CC630659
SHA1:	7299DBE0EE14AB576A429A03B768B3F77419958B
SHA-256:	B1C1037099F67D6782B8D395881892498D5EB90136F24408B66D92BF768CABB0
SHA-512:	3B98BC22FAA7A2D051D1AD34D1780BEAC5149C0B447DBF79457928D27FC0677BF173CE8B644BCC46AD0AF490AC9B034E27B974B15AC360C743FD0C90F0804CF0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[...:...:...:..i.7..:..k/..:..k..b:..k...:..*.;..:...%...:...:..:...h...:...h,..:...h+..:...:g..:...h...:..Rich.:..........PE..L...a.[X...........!......................................................................@..................................R..<....`.......................p..h3..p...8...........................h...@............P...............................text............................... ..`.rdata..7...........................@..@.data...dR......."..................@....idata.......P......................@..@.rsrc........`......................@..@.reloc..E:...p...<..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HDFileSDK.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	480768
Entropy (8bit):	5.831634335256444
Encrypted:	false
SSDEEP:	6144:3GgfAq5Kxua3LJoVszUxI0870TB4SO1b1xJ:WgF5KUMa6zUxJ8wT61bzJ
MD5:	3B99AB2D7585EED9BCF5A559CC630659
SHA1:	7299DBE0EE14AB576A429A03B768B3F77419958B
SHA-256:	B1C1037099F67D6782B8D395881892498D5EB90136F24408B66D92BF768CABB0
SHA-512:	3B98BC22FAA7A2D051D1AD34D1780BEAC5149C0B447DBF79457928D27FC0677BF173CE8B644BCC46AD0AF490AC9B034E27B974B15AC360C743FD0C90F0804CF0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[...:...:...:..i.7..:..k/..:..k..b:..k...:..*.;..:...%...:...:..:...h...:...h,..:...h+..:...:g..:...h...:..Rich.:..........PE..L...a.[X...........!......................................................................@..................................R..<....`.......................p..h3..p...8...........................h...@............P...............................text............................... ..`.rdata..7...........................@..@.data...dR......."..................@....idata.......P......................@..@.rsrc........`......................@..@.reloc..E:...p...<..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HWD8787.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1325056
Entropy (8bit):	6.538912426398886
Encrypted:	false
SSDEEP:	24576:U+hcnIflk51vNrhW2ORXffWXCphzIciJk44wBP5+o0erXwMmwb1E:U0cnklkDz27zTiJn4wRZZ5mwbu
MD5:	F83C16A2E9274F2118E1734A9B9B1B5E
SHA1:	384F66EE3E055AC0418921820396A5948793718D
SHA-256:	DEE59B389BC51ED2950FAAB315FEFA3FE9609F6833224D53D28E789475B4BFBE
SHA-512:	4A2AD713B789190D5D305CCF8190EF33C221F0DC5C4A216C768348D53406EC43528D307FBBC966231CA0CCA5CA23DBDA669C3E230FB6C22ECDC39E8062A10F1D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tt~w0..$0..$0..$.Z.$2..$9m.$...$9m.$...$..}$1..$9m.$b..$..k$!..$0..$E..$9m.$s..$9m.$1..$.G.$1..$9m.$1..$Rich0..$........PE..L...JW.Z...........!.....l................................................................@.........................`...........................................W..................................P...@............................................text...sj.......l.................. ..`.rdata...0.......2...p..............@..@.data...l...........................@....rsrc...............................@..@.reloc...r.......t..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\HWDecode.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1325056
Entropy (8bit):	6.538912426398886
Encrypted:	false
SSDEEP:	24576:U+hcnIflk51vNrhW2ORXffWXCphzIciJk44wBP5+o0erXwMmwb1E:U0cnklkDz27zTiJn4wRZZ5mwbu
MD5:	F83C16A2E9274F2118E1734A9B9B1B5E
SHA1:	384F66EE3E055AC0418921820396A5948793718D
SHA-256:	DEE59B389BC51ED2950FAAB315FEFA3FE9609F6833224D53D28E789475B4BFBE
SHA-512:	4A2AD713B789190D5D305CCF8190EF33C221F0DC5C4A216C768348D53406EC43528D307FBBC966231CA0CCA5CA23DBDA669C3E230FB6C22ECDC39E8062A10F1D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tt~w0..$0..$0..$.Z.$2..$9m.$...$9m.$...$..}$1..$9m.$b..$..k$!..$0..$E..$9m.$s..$9m.$1..$.G.$1..$9m.$1..$Rich0..$........PE..L...JW.Z...........!.....l................................................................@.........................`...........................................W..................................P...@............................................text...sj.......l.................. ..`.rdata...0.......2...p..............@..@.data...l...........................@....rsrc...............................@..@.reloc...r.......t..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Loc8846.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1877776
Entropy (8bit):	6.000877176191461
Encrypted:	false
SSDEEP:	24576:0WoSzQAdzAz/rDqvxnRVfW/1eTLUzy/WB9yqmPfaixUYnXqRkdCkF:Gr/rO5zfaaQzy0zmPfaiKEqRkdCkF
MD5:	7DE44B22F47E7F2B625C6A3611FE7471
SHA1:	80893DEFE3D6068CEED8A9B548BA4F172C583297
SHA-256:	748D5EF6DE8489A5C6F50BE564FCFC168904C6F0763E770F733D82532AD31493
SHA-512:	E1B3ED0FFDFD1FEF482C7A5EF85C61DF7826BA30FABFB524158CC09D8938F10A790FA95FCEE6ED7759495880F8DC349E43A1446EBEAA9E45AA5F8F7D512C704D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......KC.."..."..."...pE.."...pz.."...p{.."...Z..."..\|..."......."...Z..."...pG.."...G.."..."...$...{.h"...F.."...pA.."..."..."...D.."..Rich."..........PE..L...^..[..........................................@..................................3....@.........................@...\...$t..h.......@4...........b...E...0...I..P...8...........................PS..@............P..$$...........................text............................... ..`.rdata...S.......T..................@..@.data....'... ...$..................@....idata.......P....... ..............@..@.rsrc...@4.......6..................@..@.reloc...r...0...t..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Loc8895.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	169466
Entropy (8bit):	5.011896474150415
Encrypted:	false
SSDEEP:	1536:J7VOd8Q8yfK55KB80aZ2TLPefte9uTefo:tGCz
MD5:	5EA6E0DD700332E9E10AF3A8F10D08B9
SHA1:	6511DAF074607CEE697E22CE48E5C087D95E94D3
SHA-256:	02DB37EF810D55B86CB980E0A8E0D42CA165EB28CD778E55A151BB0CA1EDCCA0
SHA-512:	EFDB31480E55A68A316EF705FC2E9DE79725E4795AE2CAD51F3C5DFE70A656435F3136360A6A41391C3C0BAD988A336C0B5DDD63D80B128CA82358F068671385
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<?xml-stylesheet type="text/xsl" href="is.xsl" ?>..<!DOCTYPE msi [.. <!ELEMENT msi (summary,table*)>.. <!ATTLIST msi version CDATA #REQUIRED>.. <!ATTLIST msi xmlns:dt CDATA #IMPLIED.. codepage CDATA #IMPLIED.. compression (MSZIP\|LZX\|none) "LZX">.. .. <!ELEMENT summary (codepage?,title?,subject?,author?,keywords?,comments?,.. template,lastauthor?,revnumber,lastprinted?,.. createdtm?,lastsavedtm?,pagecount,wordcount,.. charcount?,appname?,security?)>.. .. <!ELEMENT codepage (#PCDATA)>.. <!ELEMENT title (#PCDATA)>.. <!ELEMENT subject (#PCDATA)>.. <!ELEMENT author (#PCDATA)>.. <!ELEMENT keywords (#PCDATA)>.. <!ELEMENT comments (#PCDATA)>.. <!ELEMENT template (#PCDATA)>.. <!ELEMENT lastauthor (#PCDATA)>.. <!ELEM

C:\Program Files (x86)\LocalPlayback\Loc88B5.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1313724
Entropy (8bit):	7.97888331073617
Encrypted:	false
SSDEEP:	24576:/XgUF+N5wC+cAXNmaXsFpC2oDauf1ThP99WL6wDQlKItxGJe5szLc9E2dC:vg6uocImaXsi11Tt9906yQwItAKszLci
MD5:	D29177A3341ADE2BB1E3ECF8BDCF48A0
SHA1:	FFA97A58AE8445CB25D958DC91CAB5AEAA768BE0
SHA-256:	2B6B0CD5D8E1EE7FAF7F1E5C1454D84F1D972D93EFCAD551846AABCDBE963DAE
SHA-512:	2E2B42FDD2467BDC01C48FFCF05DEFC7BB452DA717C6622F555617258BFA30B8B7C3C3A33C1B59A3260AE1795D886A2B72C8349A1A7570B870355134E04A9869
Malicious:	false
Preview:	PK........J\RC@.`.B....7......80_ST_V22.xml.[ms.6......?f.B.%.A.%;.e...k...a.c....-...^I...'.k.k:..}v...`./d..M.y.,'4}w...=..tIc......\.99.ux..x.H..tA.....(0<x..PN.#.........'.pe$....%.Q........$.Q...0.@P...[..A.Rv...Q...\|6..I..g............eu;?..G..'.^$(_..xx.API.%.(!.^Y..gL......WV...S).@`....$Z.=...1...DG...1q.X..d...bU...).......=..".....i.p.]#O.R...h...'e..2...D....v....0..A..x:........y.u$.....{.....<pN.y[LM.....c35..(w.s$.5m8QJ...5}.s&.De..t[(..<../..C..N..{rI.F..T...!u..f....cWC...y...gTd..Y..\r........:...WsG......9..n......{}5.9..b./s..{..vv.wE.'..\|..xrea..\|..=......P.p.%X.....nW.....y.S...D...M...d..e.................p'..(.....$.g..8u....n..1>.-.N....H.%]>8.uH..p.8.$..6...y..^:".uJ.Z..~$..q..A................/..>.N..I.+F.lD.{..V>.l.V..pE...=......Hc...?.%e.4j`:g`....Ju.D.ldSue...1.....8{.t%.9..6.h.%O+,.6Aml.W2.T.M.....y...[.]...U.S..J=..I...5..Sq.....N..S..F2M.V5D..1,m\.t.2...\|2.\|6q].n.f..MU.......).b.,ZP5w.?y h.*@P.KL...~kD7

C:\Program Files (x86)\LocalPlayback\LocC2F3.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PDF document, version 1.5, 13 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	1163462
Entropy (8bit):	7.970147315271677
Encrypted:	false
SSDEEP:	24576:AjjC1qLKi4WC2C/Ss0+/O/iMd6hmqV4b/3vTCfnjjsbk7yC:+WqLKoL/xD37vO/jjs+
MD5:	FA54C55073E00E381169D89B3349BD37
SHA1:	15041FC61C41547A462B909FB57DFE29CC8A6CEF
SHA-256:	87C60861488CBDFE8F7A35AD9AEF83CA690E5868CE18D4769957252AE50A51AA
SHA-512:	98F232F9A137C758BE48190D1101CA8C9758AED339602F59AD6F79E930009D1F8052E147865F6BB8D51488663C65C93E5079F74EB61441B848F1C55A7FBBA3CF
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(zh-CN) /Outlines 126 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 13/Kids[ 3 0 R 10 0 R 20 0 R 23 0 R 29 0 R 32 0 R 34 0 R 35 0 R 36 0 R 39 0 R 41 0 R 43 0 R 123 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 8 0 R>>/XObject<</Image7 7 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 404>>..stream..x..TMO.1..o..a.]..v.N.W...&..x .V...#....m...v.....n...ym.H...................b.&.fq.I....K.\|.]..V......].\.....]]....#M.7.l...j....0....E9.8..`......... ...z.&.N...C..t...C.58.7...e.......H..JS...w.....H...........-.(..A,-.V...(....s.c.1.z.4&e...{....:.sf..d.maY<.Q.e..w9?w..mk.'.U..,..x..@. .....kJ..v.$}hMF. ..E....O.p..f....4J..\.......j..q..E..8....A:..(6.R..nF......?9-'...endstream..endobj..5 0 obj..<</Type/Font/Subtype/T

C:\Program Files (x86)\LocalPlayback\Local Playback User Manual.pdf (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PDF document, version 1.5, 13 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	1163462
Entropy (8bit):	7.970147315271677
Encrypted:	false
SSDEEP:	24576:AjjC1qLKi4WC2C/Ss0+/O/iMd6hmqV4b/3vTCfnjjsbk7yC:+WqLKoL/xD37vO/jjs+
MD5:	FA54C55073E00E381169D89B3349BD37
SHA1:	15041FC61C41547A462B909FB57DFE29CC8A6CEF
SHA-256:	87C60861488CBDFE8F7A35AD9AEF83CA690E5868CE18D4769957252AE50A51AA
SHA-512:	98F232F9A137C758BE48190D1101CA8C9758AED339602F59AD6F79E930009D1F8052E147865F6BB8D51488663C65C93E5079F74EB61441B848F1C55A7FBBA3CF
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(zh-CN) /Outlines 126 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 13/Kids[ 3 0 R 10 0 R 20 0 R 23 0 R 29 0 R 32 0 R 34 0 R 35 0 R 36 0 R 39 0 R 41 0 R 43 0 R 123 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 8 0 R>>/XObject<</Image7 7 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 404>>..stream..x..TMO.1..o..a.]..v.N.W...&..x .V...#....m...v.....n...ym.H...................b.&.fq.I....K.\|.]..V......].\.....]]....#M.7.l...j....0....E9.8..`......... ...z.&.N...C..t...C.58.7...e.......H..JS...w.....H...........-.(..A,-.V...(....s.c.1.z.4&e...{....:.sf..d.maY<.Q.e..w9?w..mk.'.U..,..x..@. .....kJ..v.$}hMF. ..E....O.p..f....4J..\.......j..q..E..8....A:..(6.R..nF......?9-'...endstream..endobj..5 0 obj..<</Type/Font/Subtype/T

C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1877776
Entropy (8bit):	6.000877176191461
Encrypted:	false
SSDEEP:	24576:0WoSzQAdzAz/rDqvxnRVfW/1eTLUzy/WB9yqmPfaixUYnXqRkdCkF:Gr/rO5zfaaQzy0zmPfaiKEqRkdCkF
MD5:	7DE44B22F47E7F2B625C6A3611FE7471
SHA1:	80893DEFE3D6068CEED8A9B548BA4F172C583297
SHA-256:	748D5EF6DE8489A5C6F50BE564FCFC168904C6F0763E770F733D82532AD31493
SHA-512:	E1B3ED0FFDFD1FEF482C7A5EF85C61DF7826BA30FABFB524158CC09D8938F10A790FA95FCEE6ED7759495880F8DC349E43A1446EBEAA9E45AA5F8F7D512C704D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......KC.."..."..."...pE.."...pz.."...p{.."...Z..."..\|..."......."...Z..."...pG.."...G.."..."...$...{.h"...F.."...pA.."..."..."...D.."..Rich."..........PE..L...^..[..........................................@..................................3....@.........................@...\...$t..h.......@4...........b...E...0...I..P...8...........................PS..@............P..$$...........................text............................... ..`.rdata...S.......T..................@..@.data....'... ...$..................@....idata.......P....... ..............@..@.rsrc...@4.......6..................@..@.reloc...r...0...t..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\LocalPlayback.ism.771 (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	169466
Entropy (8bit):	5.011896474150415
Encrypted:	false
SSDEEP:	1536:J7VOd8Q8yfK55KB80aZ2TLPefte9uTefo:tGCz
MD5:	5EA6E0DD700332E9E10AF3A8F10D08B9
SHA1:	6511DAF074607CEE697E22CE48E5C087D95E94D3
SHA-256:	02DB37EF810D55B86CB980E0A8E0D42CA165EB28CD778E55A151BB0CA1EDCCA0
SHA-512:	EFDB31480E55A68A316EF705FC2E9DE79725E4795AE2CAD51F3C5DFE70A656435F3136360A6A41391C3C0BAD988A336C0B5DDD63D80B128CA82358F068671385
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<?xml-stylesheet type="text/xsl" href="is.xsl" ?>..<!DOCTYPE msi [.. <!ELEMENT msi (summary,table*)>.. <!ATTLIST msi version CDATA #REQUIRED>.. <!ATTLIST msi xmlns:dt CDATA #IMPLIED.. codepage CDATA #IMPLIED.. compression (MSZIP\|LZX\|none) "LZX">.. .. <!ELEMENT summary (codepage?,title?,subject?,author?,keywords?,comments?,.. template,lastauthor?,revnumber,lastprinted?,.. createdtm?,lastsavedtm?,pagecount,wordcount,.. charcount?,appname?,security?)>.. .. <!ELEMENT codepage (#PCDATA)>.. <!ELEMENT title (#PCDATA)>.. <!ELEMENT subject (#PCDATA)>.. <!ELEMENT author (#PCDATA)>.. <!ELEMENT keywords (#PCDATA)>.. <!ELEMENT comments (#PCDATA)>.. <!ELEMENT template (#PCDATA)>.. <!ELEMENT lastauthor (#PCDATA)>.. <!ELEM

C:\Program Files (x86)\LocalPlayback\LocalXml.zip (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1313724
Entropy (8bit):	7.97888331073617
Encrypted:	false
SSDEEP:	24576:/XgUF+N5wC+cAXNmaXsFpC2oDauf1ThP99WL6wDQlKItxGJe5szLc9E2dC:vg6uocImaXsi11Tt9906yQwItAKszLci
MD5:	D29177A3341ADE2BB1E3ECF8BDCF48A0
SHA1:	FFA97A58AE8445CB25D958DC91CAB5AEAA768BE0
SHA-256:	2B6B0CD5D8E1EE7FAF7F1E5C1454D84F1D972D93EFCAD551846AABCDBE963DAE
SHA-512:	2E2B42FDD2467BDC01C48FFCF05DEFC7BB452DA717C6622F555617258BFA30B8B7C3C3A33C1B59A3260AE1795D886A2B72C8349A1A7570B870355134E04A9869
Malicious:	false
Preview:	PK........J\RC@.`.B....7......80_ST_V22.xml.[ms.6......?f.B.%.A.%;.e...k...a.c....-...^I...'.k.k:..}v...`./d..M.y.,'4}w...=..tIc......\.99.ux..x.H..tA.....(0<x..PN.#.........'.pe$....%.Q........$.Q...0.@P...[..A.Rv...Q...\|6..I..g............eu;?..G..'.^$(_..xx.API.%.(!.^Y..gL......WV...S).@`....$Z.=...1...DG...1q.X..d...bU...).......=..".....i.p.]#O.R...h...'e..2...D....v....0..A..x:........y.u$.....{.....<pN.y[LM.....c35..(w.s$.5m8QJ...5}.s&.De..t[(..<../..C..N..{rI.F..T...!u..f....cWC...y...gTd..Y..\r........:...WsG......9..n......{}5.9..b./s..{..vv.wE.'..\|..xrea..\|..=......P.p.%X.....nW.....y.S...D...M...d..e.................p'..(.....$.g..8u....n..1>.-.N....H.%]>8.uH..p.8.$..6...y..^:".uJ.Z..~$..q..A................/..>.N..I.+F.lD.{..V>.l.V..pE...=......Hc...?.%e.4j`:g`....Ju.D.ldSue...1.....8{.t%.9..6.h.%O+,.6Aml.W2.T.M.....y...[.]...U.S..J=..I...5..Sq.....N..S..F2M.V5D..1,m\.t.2...\|2.\|6q].n.f..MU.......).b.,ZP5w.?y h.*@P.KL...~kD7

C:\Program Files (x86)\LocalPlayback\MP_8904.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	355328
Entropy (8bit):	6.752689314552392
Encrypted:	false
SSDEEP:	6144:VomZnWdHeHvtQO5Dc0iwVx7vr9SR5cNiSC+qv9x8Wh:Vomh2ePtQO5tiOf9S5cN7CPvB
MD5:	83E1227642FAAA1BE6F31FB9693341FF
SHA1:	C34F9BAAB6DFE675015CD80ECB72FABE1F9A204B
SHA-256:	0EEC645CBEC837F0B8CAD028E2E4E8CB456045C20735B6391EAED3BE0FFE9332
SHA-512:	F8D013DECF93D85559195C2FCE5B6E2A3039DD2862C5BE0A3D26FFD9C5FF62E899FF86A0B1898B0BF4B7C8278AF8F4A381C2C55BFA8A1FDBBC1769D74CD16231
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z...>j..>j..>j...8g.<j..7.n..j..7.x..j......7j..>j..Rj..7...~j..7.i.?j.. 8o.?j..7.j.?j..Rich>j..................PE..L...{.;Z...........!................................................................@................................7..\...t-..x................................&..P...................................@............................................text............................... ..`.rdata..L;.......<..................@..@.data...\|\|...@.......&..............@....rsrc................>..............@..@.reloc..*'.......(...D..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\MP_8925.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3399749
Entropy (8bit):	6.433290435488982
Encrypted:	false
SSDEEP:	49152:MWcOLf2zTASjTxgu4gufguTJ7hMDkfiY2Qeo43:MWcOLf2zT5rHzp3
MD5:	3CE35056FD3EBF0F6BE6036D6388105A
SHA1:	6880362715B51D41594908AF51B594BE8FC4B023
SHA-256:	46AD3ED7D65AB8094097757A157654EFAF37C0625946603D88C70D33668374BC
SHA-512:	334480285B7C4A3FEAB9584FFEDAB13627620164AE91D37A513F9C84E371612C85C2EB166EC64401D249FFD5176EA3B89A7745123B1CBD2A15C3FEAD98D951F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R?<..^R..^R..^R..B\..^R.yAX..^R.yAV..^R..^S..^R.tAA..^R..AX.4^R..R..>^R.1./..^R..^R.=[R.B}c..^R..XT..^R..~V..^R.Rich.^R.........PE..L....:.Q...........!.....@2.........{........P2...............................3......................................,3......3.<....P3......................`3.tk..`P2..............................................P2.L............................text....82......@2................. ..`.rdata.......P2......P2.............@..@.data...8....03.. ...03.............@....rsrc........P3......P3.............@..@.reloc..{...`3......`3.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\MP_Render.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	355328
Entropy (8bit):	6.752689314552392
Encrypted:	false
SSDEEP:	6144:VomZnWdHeHvtQO5Dc0iwVx7vr9SR5cNiSC+qv9x8Wh:Vomh2ePtQO5tiOf9S5cN7CPvB
MD5:	83E1227642FAAA1BE6F31FB9693341FF
SHA1:	C34F9BAAB6DFE675015CD80ECB72FABE1F9A204B
SHA-256:	0EEC645CBEC837F0B8CAD028E2E4E8CB456045C20735B6391EAED3BE0FFE9332
SHA-512:	F8D013DECF93D85559195C2FCE5B6E2A3039DD2862C5BE0A3D26FFD9C5FF62E899FF86A0B1898B0BF4B7C8278AF8F4A381C2C55BFA8A1FDBBC1769D74CD16231
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z...>j..>j..>j...8g.<j..7.n..j..7.x..j......7j..>j..Rj..7...~j..7.i.?j.. 8o.?j..7.j.?j..Rich>j..................PE..L...{.;Z...........!................................................................@................................7..\...t-..x................................&..P...................................@............................................text............................... ..`.rdata..L;.......<..................@..@.data...\|\|...@.......&..............@....rsrc................>..............@..@.reloc..*'.......(...D..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\MP_VIE.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3399749
Entropy (8bit):	6.433290435488982
Encrypted:	false
SSDEEP:	49152:MWcOLf2zTASjTxgu4gufguTJ7hMDkfiY2Qeo43:MWcOLf2zT5rHzp3
MD5:	3CE35056FD3EBF0F6BE6036D6388105A
SHA1:	6880362715B51D41594908AF51B594BE8FC4B023
SHA-256:	46AD3ED7D65AB8094097757A157654EFAF37C0625946603D88C70D33668374BC
SHA-512:	334480285B7C4A3FEAB9584FFEDAB13627620164AE91D37A513F9C84E371612C85C2EB166EC64401D249FFD5176EA3B89A7745123B1CBD2A15C3FEAD98D951F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R?<..^R..^R..^R..B\..^R.yAX..^R.yAV..^R..^S..^R.tAA..^R..AX.4^R..R..>^R.1./..^R..^R.=[R.B}c..^R..XT..^R..~V..^R.Rich.^R.........PE..L....:.Q...........!.....@2.........{........P2...............................3......................................,3......3.<....P3......................`3.tk..`P2..............................................P2.L............................text....82......@2................. ..`.rdata.......P2......P2.............@..@.data...8....03.. ...03.............@....rsrc........P3......P3.............@..@.reloc..{...`3......`3.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Netural\Cn\,0.>(7.(K..pdf (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PDF document, version 1.5, 17 pages
Category:	dropped
Size (bytes):	1077840
Entropy (8bit):	7.852262336490523
Encrypted:	false
SSDEEP:	24576:wa11siwSOz46h6vC+X457R3KyAPDF32HvMCE/2Ldeff:7hwSQ46hwCO4b3KyAx2HvJdyf
MD5:	27FBA8E7B282AA8DEE862D381A0A6208
SHA1:	A1D2B6A8DC92E9BEFE47D0B6F65C7E0D827FE733
SHA-256:	F78D59A1ABC1700207CC3B54BADBB10DB18C66806F44387F561DFC5D2B8F8063
SHA-512:	6F44150BF9FE2D0AE196A9753DA33277DF831E4D5F977B57607D935D225A1B50F333CDED27E059F38CF4AC208D00296071C89D83D490ECB6DEA1EE0F2141353E
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(zh-CN) /StructTreeRoot 153 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 17/Kids[ 3 0 R 26 0 R 42 0 R 44 0 R 49 0 R 54 0 R 56 0 R 60 0 R 61 0 R 62 0 R 64 0 R 65 0 R 66 0 R 68 0 R 69 0 R 143 0 R 148 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 10 0 R/F3 12 0 R/F4 14 0 R/F5 17 0 R/F6 22 0 R/F7 24 0 R>>/XObject<</Image16 16 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 942>>..stream..x..Kk.A......:...4o0....@J]z09..Is...C.f.v..>..^.%.I..I...F...F..zz5.9..d6...^2.0....`.6.5.i.e.K./z....^.l..Ww.h.r.].}]..e.x.~..~~_.7....j.....,zI..!.. H.A0Jx..H....z...Hx.K.#....Y)gr..;....]/......X.A....-.08}......F41..u..D....J..j.3G%.D2Yv........,../`.......4.4..ptX......).PL...+v..^......1I./...s.x..T....

C:\Program Files (x86)\LocalPlayback\Netural\Cn\???A80F.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PDF document, version 1.5, 17 pages
Category:	dropped
Size (bytes):	1077840
Entropy (8bit):	7.852262336490523
Encrypted:	false
SSDEEP:	24576:wa11siwSOz46h6vC+X457R3KyAPDF32HvMCE/2Ldeff:7hwSQ46hwCO4b3KyAx2HvJdyf
MD5:	27FBA8E7B282AA8DEE862D381A0A6208
SHA1:	A1D2B6A8DC92E9BEFE47D0B6F65C7E0D827FE733
SHA-256:	F78D59A1ABC1700207CC3B54BADBB10DB18C66806F44387F561DFC5D2B8F8063
SHA-512:	6F44150BF9FE2D0AE196A9753DA33277DF831E4D5F977B57607D935D225A1B50F333CDED27E059F38CF4AC208D00296071C89D83D490ECB6DEA1EE0F2141353E
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(zh-CN) /StructTreeRoot 153 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 17/Kids[ 3 0 R 26 0 R 42 0 R 44 0 R 49 0 R 54 0 R 56 0 R 60 0 R 61 0 R 62 0 R 64 0 R 65 0 R 66 0 R 68 0 R 69 0 R 143 0 R 148 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 10 0 R/F3 12 0 R/F4 14 0 R/F5 17 0 R/F6 22 0 R/F7 24 0 R>>/XObject<</Image16 16 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 942>>..stream..x..Kk.A......:...4o0....@J]z09..Is...C.f.v..>..^.%.I..I...F...F..zz5.9..d6...^2.0....`.6.5.i.e.K./z....^.l..Ww.h.r.].}]..e.x.~..~~_.7....j.....,zI..!.. H.A0Jx..H....z...Hx.K.#....Y)gr..;....]/......X.A....-.08}......F41..u..D....J..j.3G%.D2Yv........,../`.......4.4..ptX......).PL...+v..^......1I./...s.x..T....

C:\Program Files (x86)\LocalPlayback\Netural\En\LocA83F.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PDF document, version 1.5, 13 pages
Category:	dropped
Size (bytes):	1105699
Entropy (8bit):	7.967290272202782
Encrypted:	false
SSDEEP:	24576:kw4h3BbSJnCsq+/OZiQWn7G3/VRwYgQfTAabk7yq:ARLZn4GPVRYmAa2
MD5:	A6FF897C3AD4469A0EBB6046676838E8
SHA1:	0E099366CEB596FEABFD52CA56C3C37A12648405
SHA-256:	E7244575BA26F81F6642246F2E7F6307D2E78C0FAC9DE63F956627DAF9C80E75
SHA-512:	3DE91A9D8A8A88E692E022B289C89072EC23EC70D67E6619130DAC6237496A308BB490904F9456AD75C064F057E0A162CD547332CEA6520A25509FB94EB548E6
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(zh-CN) /Outlines 125 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 13/Kids[ 3 0 R 10 0 R 14 0 R 17 0 R 23 0 R 26 0 R 28 0 R 29 0 R 30 0 R 33 0 R 35 0 R 37 0 R 122 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</XObject<</Image4 4 0 R>>/Font<</F1 6 0 R/F2 8 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 5 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Type/XObject/Subtype/Image/Width 1647/Height 2347/ColorSpace/DeviceRGB/BitsPerComponent 8/Interpolate false/Filter/FlateDecode/Length 201610>>..stream..x........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Netural\En\Local Playback User Manual.pdf (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PDF document, version 1.5, 13 pages
Category:	dropped
Size (bytes):	1105699
Entropy (8bit):	7.967290272202782
Encrypted:	false
SSDEEP:	24576:kw4h3BbSJnCsq+/OZiQWn7G3/VRwYgQfTAabk7yq:ARLZn4GPVRYmAa2
MD5:	A6FF897C3AD4469A0EBB6046676838E8
SHA1:	0E099366CEB596FEABFD52CA56C3C37A12648405
SHA-256:	E7244575BA26F81F6642246F2E7F6307D2E78C0FAC9DE63F956627DAF9C80E75
SHA-512:	3DE91A9D8A8A88E692E022B289C89072EC23EC70D67E6619130DAC6237496A308BB490904F9456AD75C064F057E0A162CD547332CEA6520A25509FB94EB548E6
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(zh-CN) /Outlines 125 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 13/Kids[ 3 0 R 10 0 R 14 0 R 17 0 R 23 0 R 26 0 R 28 0 R 29 0 R 30 0 R 33 0 R 35 0 R 37 0 R 122 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</XObject<</Image4 4 0 R>>/Font<</F1 6 0 R/F2 8 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 5 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Type/XObject/Subtype/Image/Width 1647/Height 2347/ColorSpace/DeviceRGB/BitsPerComponent 8/Interpolate false/Filter/FlateDecode/Length 201610>>..stream..x........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Ope89B2.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389632
Entropy (8bit):	7.108177458898846
Encrypted:	false
SSDEEP:	6144:58gFgdxE58yLAjV5VFESI131c5yD0Y7Ayc5/g1WUq44Cj:qyWbV5v5yoYMyc54kUq4Bj
MD5:	5B271763E92A610669622CCDD05CEAAD
SHA1:	CED9F998650AB528FE19B4174F332D08D4B0FF9E
SHA-256:	C9635809BA05D551502A24192AAD4DBECBE67C4EC54D819E01034BE6E9A022AF
SHA-512:	6E5230DF0C154BDD58E1A24F386C508C3E9EFD642DEF0FBDDAFE63941AA2DA0B9BC3B214CA18EE70AC9F8D44AAB8A5228D7BCB6864DA98D917A4515C3FD8E68B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:...~d{.~d{.~d{....\|d{..*.\|d{....vd{....\|d{.w..ud{.~dz..d{....Dd{......d{.....d{.Rich~d{.................PE..L...42.Y...........!.........H...............................................0............@............................!......................................./.....................................@...............h............................text............................... ..`.rdata..............................@..@.data...4...........................@....rsrc...............................@..@.reloc...6.......8..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\OpenAL32.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389632
Entropy (8bit):	7.108177458898846
Encrypted:	false
SSDEEP:	6144:58gFgdxE58yLAjV5VFESI131c5yD0Y7Ayc5/g1WUq44Cj:qyWbV5v5yoYMyc54kUq4Bj
MD5:	5B271763E92A610669622CCDD05CEAAD
SHA1:	CED9F998650AB528FE19B4174F332D08D4B0FF9E
SHA-256:	C9635809BA05D551502A24192AAD4DBECBE67C4EC54D819E01034BE6E9A022AF
SHA-512:	6E5230DF0C154BDD58E1A24F386C508C3E9EFD642DEF0FBDDAFE63941AA2DA0B9BC3B214CA18EE70AC9F8D44AAB8A5228D7BCB6864DA98D917A4515C3FD8E68B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:...~d{.~d{.~d{....\|d{..*.\|d{....vd{....\|d{.w..ud{.~dz..d{....Dd{......d{.....d{.Rich~d{.................PE..L...42.Y...........!.........H...............................................0............@............................!......................................./.....................................@...............h............................text............................... ..`.rdata..............................@..@.data...4...........................@....rsrc...............................@..@.reloc...6.......8..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Pla89D3.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3400704
Entropy (8bit):	6.5975320903831145
Encrypted:	false
SSDEEP:	49152:qDypNO2uqmDY4AaD/1uf313fC2zJfuZdvbApjb6td6MvXFPqlPmkjXpIIM:GypkqmDnVkzuZh1XFhkjXpVM
MD5:	1663FAC5A3270F29B97A928905A06A1E
SHA1:	C1FAAF96BA38098AF92DD30015C8CA958650D62F
SHA-256:	B2CF993B362FD58F1894447FB8FF58FB134E95C9A29C09D373FFB43B3D366CBD
SHA-512:	6CD8FA8F9A973193A2DF9DC44330BE76390F5C1104A58F70C502B2BD2758BF652E01D3153EFAC6E562988C68AF710F7939223DA3DB34DC41CD35BB9CDD2A24FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$..........R..............2.....A.1.......2.....w........-......^i...._i...........4.......4.........Z.....................$.....$.c.....#......#.......5.......3.......6.....Rich....................PE..L...X.CZ...........!......)...........&......................................7.......4...............................0..2..$.0.......6.......................6.\... ..............................................................................text.....).......)................. ..`.rodata.@.....).......)............. ..`.rdata...............).............@..@.data.........1.......0.............@....data1...s....5..t...z2.............@..._RDATA..@....p6.......2.............@..@.rsrc.........6.......2.............@..@.reloc.. .....6.......2.............@..B........................................................................................................

C:\Program Files (x86)\LocalPlayback\PlayCtrl.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3400704
Entropy (8bit):	6.5975320903831145
Encrypted:	false
SSDEEP:	49152:qDypNO2uqmDY4AaD/1uf313fC2zJfuZdvbApjb6td6MvXFPqlPmkjXpIIM:GypkqmDnVkzuZh1XFhkjXpVM
MD5:	1663FAC5A3270F29B97A928905A06A1E
SHA1:	C1FAAF96BA38098AF92DD30015C8CA958650D62F
SHA-256:	B2CF993B362FD58F1894447FB8FF58FB134E95C9A29C09D373FFB43B3D366CBD
SHA-512:	6CD8FA8F9A973193A2DF9DC44330BE76390F5C1104A58F70C502B2BD2758BF652E01D3153EFAC6E562988C68AF710F7939223DA3DB34DC41CD35BB9CDD2A24FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$..........R..............2.....A.1.......2.....w........-......^i...._i...........4.......4.........Z.....................$.....$.c.....#......#.......5.......3.......6.....Rich....................PE..L...X.CZ...........!......)...........&......................................7.......4...............................0..2..$.0.......6.......................6.\... ..............................................................................text.....).......)................. ..`.rodata.@.....).......)............. ..`.rdata...............).............@..@.data.........1.......0.............@....data1...s....5..t...z2.............@..._RDATA..@....p6.......2.............@..@.rsrc.........6.......2.............@..@.reloc.. .....6.......2.............@..B........................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt58AAE.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4666368
Entropy (8bit):	6.805414593357907
Encrypted:	false
SSDEEP:	98304:8dS/SBS/PayG3fVkp9TJsv6tWKFdu9CPD:nwfVUTJsv6tWKFdu9CP
MD5:	2D81D68B483F41AF22B7117A43BBC143
SHA1:	8E28E13CCC27058618A69B9F5404ED1BF2E000D0
SHA-256:	F4D158D4E67083A4B6FBECDB5418C46DF1D5E1B2FB563A3D7963D23884A2FAA3
SHA-512:	19305A7AA9E42EEFC4633A88A7A40035DD9D92E1049EE5126CE9B98D1112F936CC032ACDD8B26EB0E30695DBA0479CDDDF6A26CDE5605382B54743A11E66BCCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c.]..............[......PC......P\|......PA......P}.....<.R.....<.L.....<.W.............T.\|.....T.}.....T.@......PG.............T.B.....Rich............PE..L...i*.V...........!.....>$.. #.....PI"......P$....g..........................G...........@.........................p.?.7.....E...... F......................0F..Q...................................9=.@............P$..............................text...Z<$......>$................. ..`.rdata..Xg!..P$..h!..B$.............@..@.data....^....E..2....E.............@....rsrc........ F.......E.............@..@.reloc...Q...0F..R....E.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt58B6B.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5013504
Entropy (8bit):	6.807583607598403
Encrypted:	false
SSDEEP:	49152:ocLeg66Ry8jdAYbppzo7Tzj1/JrRbkwW6Ydzzr3YCWizxCqDRkU9i4g1/JAy:NLrBpr1o7bRyfdzzxz0NTA
MD5:	1EBED79E43E535D550AEAF329980382E
SHA1:	E16220879A48C52AE37B012D11D9BF389348E8C3
SHA-256:	D1D78071E7B15091E293CE1EC6009B5174CD43BCD0AAA67F9C1DFFEDC6FA1EBA
SHA-512:	D5EC860F4BA5E7B889DCA059BD5EF2CC95562EDE02FB241334512FEB96D3B3B821EDFE284248BF3FC23C68A60C21C718F403323B5E1E170021546914E411400F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............s..s..s.r....s....s....s....s....s.Y ...s.1A...s..r...s.Y ....s.Y ...s.Y ...s....s....s.Y ...s.Rich.s.........PE..L....+.V...........!......,...........,.......,...............................L...........@.........................p.1..K....I.......J.......................J.."..................................hd1.@.............,.t............................text.....,.......,................. ..`.rdata........,.......,.............@..@.data...H.....J..b....I.............@..._RDATA..0.....J......TJ.............@..@.rsrc.........J......VJ.............@..@.reloc..."....J..$...\J.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt58C27.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	851968
Entropy (8bit):	6.633639694400161
Encrypted:	false
SSDEEP:	12288:7fGeWXoifZwygBFp9RsVqSA3jk1x5X+JPnk4PpazkoLhVY9hqivwlsBNzARfG:7fGeWXoiBwHbHEgqM9BNzARfG
MD5:	255871994E82EFE4E8451C7895C0D331
SHA1:	4433FC5123535B56B015512A974A6254E8ADFE0A
SHA-256:	C8FFB561048F93DE74DE9F8836DBB5832F12D1D5E9DAD714941B4A6005DB55DB
SHA-512:	687FDD81C35B2520E51ACF397B7F39BA1C9E86C6A4CDCC2CF6A4B5199EA374A763453B5FC926731A8D71F9098AD00F8C0BA41267D621395C353914C6B9C6A5E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^......B...B...B...B...B..%B...B...B...B..$B...B...B...B.h.B...B...Bp..B..$Br..B...B...B...B...B..RB...B...B...BRich...B........PE..L....*.V...........!.........D......}..............d.........................`............@..............................#......................................\....................................`..@............................................text............................... ..`.rdata...;.......<..................@..@.data....>...@......."..............@....rsrc................8..............@..@.reloc..\............>..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt58C67.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268288
Entropy (8bit):	6.847419116852789
Encrypted:	false
SSDEEP:	6144:mSP+ioAwI7/07kzr96nZshcD3I95H035AJMujBAciQkOLwEvCZ+vIrf2VM/+w2Cv:mSP+ioAwI7xz0ZZp
MD5:	7224E4F2BF8C42B63E9DE7DAE4043F2C
SHA1:	8A69AE8DBE4BA9C358309251699D01EADBDF53D6
SHA-256:	ED1D118C451E64EA77115D89727C522340891CC9FC77899382BED238381B974A
SHA-512:	18AE424B346724F0BDC9EFD32B5EFC657D4D435C1EA4228C7C6E8404613C234B4A0F523F8E9128339C853C0094F4D55CA4D80C5665FF239F5865C0F0D208BF2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w`Kp.3Kp.3Kp.3F".3Op.3F".3Gp.3F".3Op.3F".3Op.3...3Ap.3...3Lp.3Kp.3xt.3...3^p.3...3Jp.3F".3Jp.3Kp.3Jp.3...3Jp.3RichKp.3........PE..L....,.V...........!.........`..............................................P............@.........................p....k...$...................................4.................................. ...@............................................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc...4.......6..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt58C87.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4459008
Entropy (8bit):	6.831158884790277
Encrypted:	false
SSDEEP:	49152:khk8cs4FhK1FKBxR8Lcdm0OTqZ7uA/GrXHIaTU+cDZ0V37SU:uk8ymoBxKAdmL8yONaQi32U
MD5:	CA3B4FFB2DF4E5FC626E2A445D7E134D
SHA1:	B85D9C40B9078B4C3B96956585B0A858ED4CB612
SHA-256:	09D216A5590E9B2C3B6A57A481CA06730EA304FEB5EFE1A1F4F8A76F12FDBFFD
SHA-512:	184726D0CF7311CAB212D9BD7E28188CC500BA9D864CC240E4F7D731A963B5A3DAFE5DD1D2D236380140D72A32EBE63B8B1BEA2A8A09F56595D7660659C44890
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u...............F.......F-......F.......F,.....Z.......2..........."...Z.,.....Z........F........Z.....Z.......Rich............PE..L....,.V...........!.....0+.........U2+......@+....e.........................@D...........@..........................)6....H.=.......@.......................@..k...................................G5.@............@+..2...........................text.....+......0+................. ..`.rdata.......@+......4+.............@..@.data...\h...P@..`...8@.............@....rsrc.........@.......@.............@..@.reloc...k....@..l....@.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt58D82.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	6.613107044045588
Encrypted:	false
SSDEEP:	3072:NKAPgHp1hC3MYUxAnLkbMnJgCU0UATJ6xQr539R:NwYMxbSJ1rJ6xQr/
MD5:	88EE57BA66FFB2B4BB751009C6DBAFD4
SHA1:	DF8DBBE252DC1200450BABABD6A3F573EE7C1007
SHA-256:	52232298855C84EEA1639EFD2953B57FA2387B3BA91C6D5A1CC85564B1B29B25
SHA-512:	47533DCE4194EAE85882A97BF957575F5AD93D3F7B5939CEB9B2CB92CE274EBEFE0807B2D75E100A74801954A281FFF7386250432F68737885A0B5F1E79C193B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}..............<........N.......N6......N7......N......T...........J...T.7.....T........N........A.....T.......Rich............PE..L...w*.V...........!.....\|.........................a......................................@.............................T\......d....P.......................`.. ...................................X...@............................................text...kz.......\|.................. ..`.rdata..h...........................@..@.data........@......."..............@....rsrc........P.......(..............@..@.reloc.. ....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt5Core.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4666368
Entropy (8bit):	6.805414593357907
Encrypted:	false
SSDEEP:	98304:8dS/SBS/PayG3fVkp9TJsv6tWKFdu9CPD:nwfVUTJsv6tWKFdu9CP
MD5:	2D81D68B483F41AF22B7117A43BBC143
SHA1:	8E28E13CCC27058618A69B9F5404ED1BF2E000D0
SHA-256:	F4D158D4E67083A4B6FBECDB5418C46DF1D5E1B2FB563A3D7963D23884A2FAA3
SHA-512:	19305A7AA9E42EEFC4633A88A7A40035DD9D92E1049EE5126CE9B98D1112F936CC032ACDD8B26EB0E30695DBA0479CDDDF6A26CDE5605382B54743A11E66BCCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c.]..............[......PC......P\|......PA......P}.....<.R.....<.L.....<.W.............T.\|.....T.}.....T.@......PG.............T.B.....Rich............PE..L...i*.V...........!.....>$.. #.....PI"......P$....g..........................G...........@.........................p.?.7.....E...... F......................0F..Q...................................9=.@............P$..............................text...Z<$......>$................. ..`.rdata..Xg!..P$..h!..B$.............@..@.data....^....E..2....E.............@....rsrc........ F.......E.............@..@.reloc...Q...0F..R....E.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt5Gui.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5013504
Entropy (8bit):	6.807583607598403
Encrypted:	false
SSDEEP:	49152:ocLeg66Ry8jdAYbppzo7Tzj1/JrRbkwW6Ydzzr3YCWizxCqDRkU9i4g1/JAy:NLrBpr1o7bRyfdzzxz0NTA
MD5:	1EBED79E43E535D550AEAF329980382E
SHA1:	E16220879A48C52AE37B012D11D9BF389348E8C3
SHA-256:	D1D78071E7B15091E293CE1EC6009B5174CD43BCD0AAA67F9C1DFFEDC6FA1EBA
SHA-512:	D5EC860F4BA5E7B889DCA059BD5EF2CC95562EDE02FB241334512FEB96D3B3B821EDFE284248BF3FC23C68A60C21C718F403323B5E1E170021546914E411400F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............s..s..s.r....s....s....s....s....s.Y ...s.1A...s..r...s.Y ....s.Y ...s.Y ...s....s....s.Y ...s.Rich.s.........PE..L....+.V...........!......,...........,.......,...............................L...........@.........................p.1..K....I.......J.......................J.."..................................hd1.@.............,.t............................text.....,.......,................. ..`.rdata........,.......,.............@..@.data...H.....J..b....I.............@..._RDATA..0.....J......TJ.............@..@.rsrc.........J......VJ.............@..@.reloc..."....J..$...\J.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt5Network.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	851968
Entropy (8bit):	6.633639694400161
Encrypted:	false
SSDEEP:	12288:7fGeWXoifZwygBFp9RsVqSA3jk1x5X+JPnk4PpazkoLhVY9hqivwlsBNzARfG:7fGeWXoiBwHbHEgqM9BNzARfG
MD5:	255871994E82EFE4E8451C7895C0D331
SHA1:	4433FC5123535B56B015512A974A6254E8ADFE0A
SHA-256:	C8FFB561048F93DE74DE9F8836DBB5832F12D1D5E9DAD714941B4A6005DB55DB
SHA-512:	687FDD81C35B2520E51ACF397B7F39BA1C9E86C6A4CDCC2CF6A4B5199EA374A763453B5FC926731A8D71F9098AD00F8C0BA41267D621395C353914C6B9C6A5E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^......B...B...B...B...B..%B...B...B...B..$B...B...B...B.h.B...B...Bp..B..$Br..B...B...B...B...B..RB...B...B...BRich...B........PE..L....*.V...........!.........D......}..............d.........................`............@..............................#......................................\....................................`..@............................................text............................... ..`.rdata...;.......<..................@..@.data....>...@......."..............@....rsrc................8..............@..@.reloc..\............>..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt5PrintSupport.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268288
Entropy (8bit):	6.847419116852789
Encrypted:	false
SSDEEP:	6144:mSP+ioAwI7/07kzr96nZshcD3I95H035AJMujBAciQkOLwEvCZ+vIrf2VM/+w2Cv:mSP+ioAwI7xz0ZZp
MD5:	7224E4F2BF8C42B63E9DE7DAE4043F2C
SHA1:	8A69AE8DBE4BA9C358309251699D01EADBDF53D6
SHA-256:	ED1D118C451E64EA77115D89727C522340891CC9FC77899382BED238381B974A
SHA-512:	18AE424B346724F0BDC9EFD32B5EFC657D4D435C1EA4228C7C6E8404613C234B4A0F523F8E9128339C853C0094F4D55CA4D80C5665FF239F5865C0F0D208BF2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w`Kp.3Kp.3Kp.3F".3Op.3F".3Gp.3F".3Op.3F".3Op.3...3Ap.3...3Lp.3Kp.3xt.3...3^p.3...3Jp.3F".3Jp.3Kp.3Jp.3...3Jp.3RichKp.3........PE..L....,.V...........!.........`..............................................P............@.........................p....k...$...................................4.................................. ...@............................................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc...4.......6..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt5Widgets.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4459008
Entropy (8bit):	6.831158884790277
Encrypted:	false
SSDEEP:	49152:khk8cs4FhK1FKBxR8Lcdm0OTqZ7uA/GrXHIaTU+cDZ0V37SU:uk8ymoBxKAdmL8yONaQi32U
MD5:	CA3B4FFB2DF4E5FC626E2A445D7E134D
SHA1:	B85D9C40B9078B4C3B96956585B0A858ED4CB612
SHA-256:	09D216A5590E9B2C3B6A57A481CA06730EA304FEB5EFE1A1F4F8A76F12FDBFFD
SHA-512:	184726D0CF7311CAB212D9BD7E28188CC500BA9D864CC240E4F7D731A963B5A3DAFE5DD1D2D236380140D72A32EBE63B8B1BEA2A8A09F56595D7660659C44890
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u...............F.......F-......F.......F,.....Z.......2..........."...Z.,.....Z........F........Z.....Z.......Rich............PE..L....,.V...........!.....0+.........U2+......@+....e.........................@D...........@..........................)6....H.=.......@.......................@..k...................................G5.@............@+..2...........................text.....+......0+................. ..`.rdata.......@+......4+.............@..@.data...\h...P@..`...8@.............@....rsrc.........@.......@.............@..@.reloc...k....@..l....@.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Qt5Xml.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	6.613107044045588
Encrypted:	false
SSDEEP:	3072:NKAPgHp1hC3MYUxAnLkbMnJgCU0UATJ6xQr539R:NwYMxbSJ1rJ6xQr/
MD5:	88EE57BA66FFB2B4BB751009C6DBAFD4
SHA1:	DF8DBBE252DC1200450BABABD6A3F573EE7C1007
SHA-256:	52232298855C84EEA1639EFD2953B57FA2387B3BA91C6D5A1CC85564B1B29B25
SHA-512:	47533DCE4194EAE85882A97BF957575F5AD93D3F7B5939CEB9B2CB92CE274EBEFE0807B2D75E100A74801954A281FFF7386250432F68737885A0B5F1E79C193B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}..............<........N.......N6......N7......N......T...........J...T.7.....T........N........A.....T.......Rich............PE..L...w*.V...........!.....\|.........................a......................................@.............................T\......d....P.......................`.. ...................................X...@............................................text...kz.......\|.................. ..`.rdata..h...........................@..@.data........@......."..............@....rsrc........P.......(..............@..@.reloc.. ....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Set8DB2.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.602482849464873
Encrypted:	false
SSDEEP:	12:TMHdBO1HKhSNeH1IsSNeI26YO1G+SqDYOIsS/iEDUO1G+SkUOiEmsSSYb:2dA+ieV3iev6VLhXcDRLPvNI
MD5:	0F09BD92760A30866F5B5F1B26E9804C
SHA1:	AF9C16671493A33168CD11E61BF3BC8041556371
SHA-256:	5209CDDA75CDCED0B4F146B3DBD2FCDF92C480E608DAA36F70506BCF7740484F
SHA-512:	E8327F64060BDF2433686FF63A1B20C286172A46B2C43605BB533AECA53601ADBB33860254C4165C04733FD1A1B8A1E12362404011FDCE1F587869B045A1C476
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Settings>.. <CaptureSaveType>.. <Value>0</Value>.. </CaptureSaveType>.. <CaptureSavePath>.. <Value>C:/</Value>.. </CaptureSavePath>.. <ClipPackageSize>.. <Value>7</Value>.. </ClipPackageSize>.. <ClipSavePath>.. <Value>C:/</Value>.. </ClipSavePath>.. <DownloadPackageSize>.. <Value>7</Value>.. </DownloadPackageSize>.. <DownloadSavePath>.. <Value>C:/</Value>.. </DownloadSavePath>..</Settings>

C:\Program Files (x86)\LocalPlayback\Set8DB3.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.79370143429073
Encrypted:	false
SSDEEP:	6:TM3i0bB9LDYR9zg++RPczg+LnV3zg+0xDXq3vJ++:TM3i0bBNYnh+lQhL9h08c+
MD5:	16E6F308D482E99FBDBCF92265FDCAC1
SHA1:	0698E47E2040A2BD61487BF2E5D0EE2569D0C7AC
SHA-256:	E29757AAEAEDEF80BDE5AF75F82D8F768595EC8C192D2455E41DB006F6E3E25C
SHA-512:	8421CA37CCF2DD0CC0BEA5625D5F60A29D0D5AC0193289F522C6DB76AE56EC40001BC846ED107725550CDE85995060E66293F34D05F5F086C6587A16F8C5C83C
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8'?>.<Configs>..<Translator>...<Value>0</Value>..</Translator>..<LogLevel>...<Value>0</Value>..</LogLevel>..<VersionType>...<Value>0</Value>..</VersionType>..<Skin>...<Value>CommonSkin</Value>..</Skin>.</Configs>

C:\Program Files (x86)\LocalPlayback\SetC2E3.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	262
Entropy (8bit):	4.832996419715382
Encrypted:	false
SSDEEP:	6:TMVBd/pmRjz0zg+oPmRjQjzg+oPjIVuHzg+oPsxuITq3vJ+oPiN:TMHdBmKhsmG3hsjLhsmKcsc
MD5:	3B334A3B7167E41C12F4F68FB7185056
SHA1:	EDB887C5FAB40378E455899C52E548D1F10A6A50
SHA-256:	D40F7B546B8946B73DC50552CDF24AE4F083272379709624A264D1B4053195DE
SHA-512:	07941632801BED5F5EEC0DECEDD78CF908668B09201CC37D133E81C8F2E26F31C8992C77DDE35E30BB19ECB04DDF16E76A25EFA7279C57572F173A526E9723D3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Configs>...<Translator>....<Value>0</Value>...</Translator>...<LogLevel>....<Value>0</Value>...</LogLevel>...<VersionType>....<Value>0</Value>...</VersionType>...<Skin>....<Value>CommonSkin</Value>...</Skin>..</Configs>..

C:\Program Files (x86)\LocalPlayback\Settings.xml (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.602482849464873
Encrypted:	false
SSDEEP:	12:TMHdBO1HKhSNeH1IsSNeI26YO1G+SqDYOIsS/iEDUO1G+SkUOiEmsSSYb:2dA+ieV3iev6VLhXcDRLPvNI
MD5:	0F09BD92760A30866F5B5F1B26E9804C
SHA1:	AF9C16671493A33168CD11E61BF3BC8041556371
SHA-256:	5209CDDA75CDCED0B4F146B3DBD2FCDF92C480E608DAA36F70506BCF7740484F
SHA-512:	E8327F64060BDF2433686FF63A1B20C286172A46B2C43605BB533AECA53601ADBB33860254C4165C04733FD1A1B8A1E12362404011FDCE1F587869B045A1C476
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Settings>.. <CaptureSaveType>.. <Value>0</Value>.. </CaptureSaveType>.. <CaptureSavePath>.. <Value>C:/</Value>.. </CaptureSavePath>.. <ClipPackageSize>.. <Value>7</Value>.. </ClipPackageSize>.. <ClipSavePath>.. <Value>C:/</Value>.. </ClipSavePath>.. <DownloadPackageSize>.. <Value>7</Value>.. </DownloadPackageSize>.. <DownloadSavePath>.. <Value>C:/</Value>.. </DownloadSavePath>..</Settings>

C:\Program Files (x86)\LocalPlayback\Setup.xml (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.79370143429073
Encrypted:	false
SSDEEP:	6:TM3i0bB9LDYR9zg++RPczg+LnV3zg+0xDXq3vJ++:TM3i0bBNYnh+lQhL9h08c+
MD5:	16E6F308D482E99FBDBCF92265FDCAC1
SHA1:	0698E47E2040A2BD61487BF2E5D0EE2569D0C7AC
SHA-256:	E29757AAEAEDEF80BDE5AF75F82D8F768595EC8C192D2455E41DB006F6E3E25C
SHA-512:	8421CA37CCF2DD0CC0BEA5625D5F60A29D0D5AC0193289F522C6DB76AE56EC40001BC846ED107725550CDE85995060E66293F34D05F5F086C6587A16F8C5C83C
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8'?>.<Configs>..<Translator>...<Value>0</Value>..</Translator>..<LogLevel>...<Value>0</Value>..</LogLevel>..<VersionType>...<Value>0</Value>..</VersionType>..<Skin>...<Value>CommonSkin</Value>..</Skin>.</Configs>

C:\Program Files (x86)\LocalPlayback\Standard\Cn\,0.>(7.(K..pdf (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PDF document, version 1.5, 16 pages
Category:	dropped
Size (bytes):	935331
Entropy (8bit):	7.841446792645387
Encrypted:	false
SSDEEP:	24576:gOBdiOvix46jqqd7XC8WyAPDbAeaV+++p/2Ldefap:PaOvA46jzd7CxyAXaU+Pdyap
MD5:	1E887E326C1F909ABF7A76B8A4F97D2C
SHA1:	E2949ED01AFB5B78A2ABD8D29383011C8465633F
SHA-256:	01619E0CEE79811969BCE5103EC202CB61918368953CBE863FE18C7F7AA0E44D
SHA-512:	F37A6705CDD05D5CB889AB51C4F53DEF3547C6067CBEE8271157C68496BA0DE8AAC9139ADE953631B75B28A8120414149290666E6715D1F747F75772993F8533
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(zh-CN) /StructTreeRoot 149 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 16/Kids[ 3 0 R 26 0 R 43 0 R 48 0 R 53 0 R 55 0 R 59 0 R 60 0 R 61 0 R 63 0 R 64 0 R 65 0 R 67 0 R 68 0 R 140 0 R 145 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 10 0 R/F3 12 0 R/F4 14 0 R/F5 17 0 R/F6 22 0 R/F7 24 0 R>>/XObject<</Image16 16 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 976>>..stream..x..K..H......:z.nuU......Y6...=.9..gv..d...~.%.#.zd... 4..UUW..U....4..x..9..\|....Q6.0....`.6.5.i.e7...2X._@....x..;D.o...../...O.n....v.....~{x\|..m..,..!..~.!H.C0Jx..H..._G...H.}.m..4...R....v5.....l.Jkta..........K........x..ws..^4*.V..........%T.L...............9oA.M.A.G.Y...Y....d...bgj..\..x.....R.x.C.1.RmP...dol

C:\Program Files (x86)\LocalPlayback\Standard\Cn\???A900.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PDF document, version 1.5, 16 pages
Category:	dropped
Size (bytes):	935331
Entropy (8bit):	7.841446792645387
Encrypted:	false
SSDEEP:	24576:gOBdiOvix46jqqd7XC8WyAPDbAeaV+++p/2Ldefap:PaOvA46jzd7CxyAXaU+Pdyap
MD5:	1E887E326C1F909ABF7A76B8A4F97D2C
SHA1:	E2949ED01AFB5B78A2ABD8D29383011C8465633F
SHA-256:	01619E0CEE79811969BCE5103EC202CB61918368953CBE863FE18C7F7AA0E44D
SHA-512:	F37A6705CDD05D5CB889AB51C4F53DEF3547C6067CBEE8271157C68496BA0DE8AAC9139ADE953631B75B28A8120414149290666E6715D1F747F75772993F8533
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(zh-CN) /StructTreeRoot 149 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 16/Kids[ 3 0 R 26 0 R 43 0 R 48 0 R 53 0 R 55 0 R 59 0 R 60 0 R 61 0 R 63 0 R 64 0 R 65 0 R 67 0 R 68 0 R 140 0 R 145 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 10 0 R/F3 12 0 R/F4 14 0 R/F5 17 0 R/F6 22 0 R/F7 24 0 R>>/XObject<</Image16 16 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 976>>..stream..x..K..H......:z.nuU......Y6...=.9..gv..d...~.%.#.zd... 4..UUW..U....4..x..9..\|....Q6.0....`.6.5.i.e7...2X._@....x..;D.o...../...O.n....v.....~{x\|..m..,..!..~.!H.C0Jx..H..._G...H.}.m..4...R....v5.....l.Jkta..........K........x..ws..^4*.V..........%T.L...............9oA.M.A.G.Y...Y....d...bgj..\..x.....R.x.C.1.RmP...dol

C:\Program Files (x86)\LocalPlayback\Standard\En\LocA92F.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PDF document, version 1.5, 13 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	1163462
Entropy (8bit):	7.970147315271677
Encrypted:	false
SSDEEP:	24576:AjjC1qLKi4WC2C/Ss0+/O/iMd6hmqV4b/3vTCfnjjsbk7yC:+WqLKoL/xD37vO/jjs+
MD5:	FA54C55073E00E381169D89B3349BD37
SHA1:	15041FC61C41547A462B909FB57DFE29CC8A6CEF
SHA-256:	87C60861488CBDFE8F7A35AD9AEF83CA690E5868CE18D4769957252AE50A51AA
SHA-512:	98F232F9A137C758BE48190D1101CA8C9758AED339602F59AD6F79E930009D1F8052E147865F6BB8D51488663C65C93E5079F74EB61441B848F1C55A7FBBA3CF
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(zh-CN) /Outlines 126 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 13/Kids[ 3 0 R 10 0 R 20 0 R 23 0 R 29 0 R 32 0 R 34 0 R 35 0 R 36 0 R 39 0 R 41 0 R 43 0 R 123 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 8 0 R>>/XObject<</Image7 7 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 404>>..stream..x..TMO.1..o..a.]..v.N.W...&..x .V...#....m...v.....n...ym.H...................b.&.fq.I....K.\|.]..V......].\.....]]....#M.7.l...j....0....E9.8..`......... ...z.&.N...C..t...C.58.7...e.......H..JS...w.....H...........-.(..A,-.V...(....s.c.1.z.4&e...{....:.sf..d.maY<.Q.e..w9?w..mk.'.U..,..x..@. .....kJ..v.$}hMF. ..E....O.p..f....4J..\.......j..q..E..8....A:..(6.R..nF......?9-'...endstream..endobj..5 0 obj..<</Type/Font/Subtype/T

C:\Program Files (x86)\LocalPlayback\Standard\En\Local Playback User Manual.pdf (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PDF document, version 1.5, 13 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	1163462
Entropy (8bit):	7.970147315271677
Encrypted:	false
SSDEEP:	24576:AjjC1qLKi4WC2C/Ss0+/O/iMd6hmqV4b/3vTCfnjjsbk7yC:+WqLKoL/xD37vO/jjs+
MD5:	FA54C55073E00E381169D89B3349BD37
SHA1:	15041FC61C41547A462B909FB57DFE29CC8A6CEF
SHA-256:	87C60861488CBDFE8F7A35AD9AEF83CA690E5868CE18D4769957252AE50A51AA
SHA-512:	98F232F9A137C758BE48190D1101CA8C9758AED339602F59AD6F79E930009D1F8052E147865F6BB8D51488663C65C93E5079F74EB61441B848F1C55A7FBBA3CF
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(zh-CN) /Outlines 126 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 13/Kids[ 3 0 R 10 0 R 20 0 R 23 0 R 29 0 R 32 0 R 34 0 R 35 0 R 36 0 R 39 0 R 41 0 R 43 0 R 123 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 8 0 R>>/XObject<</Image7 7 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 404>>..stream..x..TMO.1..o..a.]..v.N.W...&..x .V...#....m...v.....n...ym.H...................b.&.fq.I....K.\|.]..V......].\.....]]....#M.7.l...j....0....E9.8..`......... ...z.&.N...C..t...C.58.7...e.......H..JS...w.....H...........-.(..A,-.V...(....s.c.1.z.4&e...{....:.sf..d.maY<.Q.e..w9?w..mk.'.U..,..x..@. .....kJ..v.$}hMF. ..E....O.p..f....4J..\.......j..q..E..8....A:..(6.R..nF......?9-'...endstream..endobj..5 0 obj..<</Type/Font/Subtype/T

C:\Program Files (x86)\LocalPlayback\Sup8DC4.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	352256
Entropy (8bit):	6.649493440237477
Encrypted:	false
SSDEEP:	6144:L72gcrJp/DoniS2gliYopwDhnjNeKP2nJtSCr8:/2g2//D01Zoy9njc8
MD5:	D3D7B7FD9B65DD099BADAE8374372792
SHA1:	1664DBA53CA60D67BB70D5E1E301056D038E0221
SHA-256:	87352F614146AAF9AFE98DC11099E1B4CC2FFFFDD65CED0467D05AB283480AD2
SHA-512:	3A18D30C0A93FBA8641A56374812F399F30A208A34F33C53A5A1E5622C23718838FE164DF52D5556271EB9F4AAD36C220102561840610A6784A3FFD174F54445
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h....A...A...A...A...A...A...A..}A...A..A...AB..A...A...A:..A...A...A..6A...A...A...A...A...A...A...A...A...ARich...A........PE..L...-{?Z...........!.....P...................p...............................P.......f..........................................x............................ ..P)..pr...............................................p...............................text....:.......<.................. ..`.rodata......P.......@.............. ..`.rdata..c....p.......T..............@..@.data...`.... ...0..................@....rsrc................*..............@..@.reloc....... ...0...0..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\SuperRender.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	352256
Entropy (8bit):	6.649493440237477
Encrypted:	false
SSDEEP:	6144:L72gcrJp/DoniS2gliYopwDhnjNeKP2nJtSCr8:/2g2//D01Zoy9njc8
MD5:	D3D7B7FD9B65DD099BADAE8374372792
SHA1:	1664DBA53CA60D67BB70D5E1E301056D038E0221
SHA-256:	87352F614146AAF9AFE98DC11099E1B4CC2FFFFDD65CED0467D05AB283480AD2
SHA-512:	3A18D30C0A93FBA8641A56374812F399F30A208A34F33C53A5A1E5622C23718838FE164DF52D5556271EB9F4AAD36C220102561840610A6784A3FFD174F54445
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h....A...A...A...A...A...A...A..}A...A..A...AB..A...A...A:..A...A...A..6A...A...A...A...A...A...A...A...A...ARich...A........PE..L...-{?Z...........!.....P...................p...............................P.......f..........................................x............................ ..P)..pr...............................................p...............................text....:.......<.................. ..`.rodata......P.......@.............. ..`.rdata..c....p.......T..............@..@.data...`.... ...0..................@....rsrc................*..............@..@.reloc....... ...0...0..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Too8DD4.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2170368
Entropy (8bit):	6.6369765600957775
Encrypted:	false
SSDEEP:	49152:mLPmSWrG/3/v034LEQNxnND4fNW6BSSHjFYWirLmlLqHFJeqAb3MWLrG:h34fzD41qtje
MD5:	318671122B5B3D034361605BD065450B
SHA1:	2086F18FC18112130790ECD6669628929A41742E
SHA-256:	F4370B2C3E43F05D950C49EFC2890B2FC3001D6FAFD96E957A6A95148DA8B992
SHA-512:	9E45A85FBA2AE44BF34DB684EBECDE4E6FB864AABB38D71A4C2D579D908B0113F0ECDA3D33C120AF6C258E0F514FE5BF5C2536923522DAA0394B4E6E3A4E38DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*/.dD\|.dD\|.dD\|..\|.dD\|.6.\|.dD\|.6.\|.dD\|.6.\|.dD\|.6.\|.dD\|F..\|.dD\|...\|.dD\|.dE\|.oD\|...\|.dD\|...\|.eD\|...\|.dD\|.6.\|.dD\|.d.\|.dD\|...\|.dD\|Rich.dD\|........PE..L......[...........!.........................................................`!...........@.........................0...\.................................... ...3......8...........................X...@...............X-...........................text............................... ..`.rdata..n...........................@..@.data........0......................@....rsrc...............................@..@.reloc...3... ...4..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Too8EB0.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147968
Entropy (8bit):	5.325043563478829
Encrypted:	false
SSDEEP:	3072:RYqfrmg1h+6ooHN922cDGw91Bk+Oc0RgZqnR6:Rf/430j2tD1Bk+OcKfR6
MD5:	A2E983EAEC9546DF90FA1E25A5D16BDB
SHA1:	612730494ADC98E52159AF4D43B38F24FE115AB3
SHA-256:	23D15418B5CE3CAC109121E13B4C34493AF8D57F6EE4714B77B0FC2B58FFE30A
SHA-512:	CFDF936CFCBD4A2B836853CF125DE22BE733E3F0444FD8E62BE57521F372E2A9BB2734FB1ABC78DF20F828F410B5F2299FFC53F91FED1FA41ACFA5E28BC06936
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.\|.+.\|.+.\|.&...).\|.&...'.\|.&.../.\|.&.../.\|....).\|."...).\|.K.. .\|.+.}.\|.\|.K..&.\|.K...\|.&....\|.+....\|.K..*.\|.Rich+.\|.........................PE..L......[...........!.....b................................................................@.........................0................@.......................P......P...8...............................@............................................text....a.......b.................. ..`.rdata...\.......^...f..............@..@.data...$...........................@....idata...I.......J..................@..@.rsrc........@......................@..@.reloc..."...P...$..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Too8F2E.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	7914
Entropy (8bit):	5.188100939150191
Encrypted:	false
SSDEEP:	96:OpC08Ct5bGVRuageAsO4ykd0CG6bRmKp8KkAXBK16tMbspAMg4iNCXCvlu31/jZR:OAXw6UsWMgTNWkE1/jZXAy
MD5:	5591319938E5D48EF8773F23BF95ED6E
SHA1:	83999F61F2B871908DDD8F0EF1269E3249AAE758
SHA-256:	B6ED61E68C2E62D198D694F1792C75F10572FE56F9E0F055558A3F9AFD408369
SHA-512:	388EB26F1EAD9136A431BDAC09DD2D9EBBB2112D866B100B50759C2EE47A30E0300E2B33A4EFD45E48512636B6622B03FF911140F2A4DC8A3F5C11AF13288E4E
Malicious:	false
Preview:	!<arch>./ 1481160801 0 1951 `....$.......f...............................T...T...................$...$...................\...\...X...X...,...,...................................6__IMPORT_DESCRIPTOR_ToolShareModule.__NULL_IMPORT_DESCRIPTOR..ToolShareModule_NULL_THUNK_DATA.??0ToolApplicationHull@apt@@AAE@XZ.__imp_??0ToolApplicationHull@apt@@AAE@XZ.??1ToolApplicationHull@apt@@EAE@XZ.__imp_??1ToolApplicationHull@apt@@EAE@XZ.?instance@ToolApplicationHull@apt@@SAPAV12@XZ.__imp_?instance@ToolApplicationHull@apt@@SAPAV12@XZ.?application@ToolApplicationHull@apt@@QBEPAVQApplication@@XZ.__imp_?application@ToolApplicationHull@apt@@QBEPAVQApplication@@XZ.?distory@ToolApplicationHull@apt@@QAEXXZ.__imp_?distory@ToolApplicationHull@apt@@QAEXXZ.?notify@ToolApplicationHull@apt@@QAE_NPAVQObject@@PAVQEvent@@@Z.__imp_?notify@ToolApplicationHull@apt@@QAE_NPAVQObject@@PAVQEvent@@@Z.?initialize@ToolApplicationHull@apt@@QAEXHPAPADABVQString@@1_N@Z.__imp_?initialize@ToolApp

C:\Program Files (x86)\LocalPlayback\ToolGuiToolkit.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2170368
Entropy (8bit):	6.6369765600957775
Encrypted:	false
SSDEEP:	49152:mLPmSWrG/3/v034LEQNxnND4fNW6BSSHjFYWirLmlLqHFJeqAb3MWLrG:h34fzD41qtje
MD5:	318671122B5B3D034361605BD065450B
SHA1:	2086F18FC18112130790ECD6669628929A41742E
SHA-256:	F4370B2C3E43F05D950C49EFC2890B2FC3001D6FAFD96E957A6A95148DA8B992
SHA-512:	9E45A85FBA2AE44BF34DB684EBECDE4E6FB864AABB38D71A4C2D579D908B0113F0ECDA3D33C120AF6C258E0F514FE5BF5C2536923522DAA0394B4E6E3A4E38DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*/.dD\|.dD\|.dD\|..\|.dD\|.6.\|.dD\|.6.\|.dD\|.6.\|.dD\|.6.\|.dD\|F..\|.dD\|...\|.dD\|.dE\|.oD\|...\|.dD\|...\|.eD\|...\|.dD\|.6.\|.dD\|.d.\|.dD\|...\|.dD\|Rich.dD\|........PE..L......[...........!.........................................................`!...........@.........................0...\.................................... ...3......8...........................X...@...............X-...........................text............................... ..`.rdata..n...........................@..@.data........0......................@....rsrc...............................@..@.reloc...3... ...4..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\ToolShareModule.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147968
Entropy (8bit):	5.325043563478829
Encrypted:	false
SSDEEP:	3072:RYqfrmg1h+6ooHN922cDGw91Bk+Oc0RgZqnR6:Rf/430j2tD1Bk+OcKfR6
MD5:	A2E983EAEC9546DF90FA1E25A5D16BDB
SHA1:	612730494ADC98E52159AF4D43B38F24FE115AB3
SHA-256:	23D15418B5CE3CAC109121E13B4C34493AF8D57F6EE4714B77B0FC2B58FFE30A
SHA-512:	CFDF936CFCBD4A2B836853CF125DE22BE733E3F0444FD8E62BE57521F372E2A9BB2734FB1ABC78DF20F828F410B5F2299FFC53F91FED1FA41ACFA5E28BC06936
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.\|.+.\|.+.\|.&...).\|.&...'.\|.&.../.\|.&.../.\|....).\|."...).\|.K.. .\|.+.}.\|.\|.K..&.\|.K...\|.&....\|.+....\|.K..*.\|.Rich+.\|.........................PE..L......[...........!.....b................................................................@.........................0................@.......................P......P...8...............................@............................................text....a.......b.................. ..`.rdata...\.......^...f..............@..@.data...$...........................@....idata...I.......J..................@..@.rsrc........@......................@..@.reloc..."...P...$..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\ToolShareModule.lib (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	7914
Entropy (8bit):	5.188100939150191
Encrypted:	false
SSDEEP:	96:OpC08Ct5bGVRuageAsO4ykd0CG6bRmKp8KkAXBK16tMbspAMg4iNCXCvlu31/jZR:OAXw6UsWMgTNWkE1/jZXAy
MD5:	5591319938E5D48EF8773F23BF95ED6E
SHA1:	83999F61F2B871908DDD8F0EF1269E3249AAE758
SHA-256:	B6ED61E68C2E62D198D694F1792C75F10572FE56F9E0F055558A3F9AFD408369
SHA-512:	388EB26F1EAD9136A431BDAC09DD2D9EBBB2112D866B100B50759C2EE47A30E0300E2B33A4EFD45E48512636B6622B03FF911140F2A4DC8A3F5C11AF13288E4E
Malicious:	false
Preview:	!<arch>./ 1481160801 0 1951 `....$.......f...............................T...T...................$...$...................\...\...X...X...,...,...................................6__IMPORT_DESCRIPTOR_ToolShareModule.__NULL_IMPORT_DESCRIPTOR..ToolShareModule_NULL_THUNK_DATA.??0ToolApplicationHull@apt@@AAE@XZ.__imp_??0ToolApplicationHull@apt@@AAE@XZ.??1ToolApplicationHull@apt@@EAE@XZ.__imp_??1ToolApplicationHull@apt@@EAE@XZ.?instance@ToolApplicationHull@apt@@SAPAV12@XZ.__imp_?instance@ToolApplicationHull@apt@@SAPAV12@XZ.?application@ToolApplicationHull@apt@@QBEPAVQApplication@@XZ.__imp_?application@ToolApplicationHull@apt@@QBEPAVQApplication@@XZ.?distory@ToolApplicationHull@apt@@QAEXXZ.__imp_?distory@ToolApplicationHull@apt@@QAEXXZ.?notify@ToolApplicationHull@apt@@QAE_NPAVQObject@@PAVQEvent@@@Z.__imp_?notify@ToolApplicationHull@apt@@QAE_NPAVQObject@@PAVQEvent@@@Z.?initialize@ToolApplicationHull@apt@@QAEXHPAPADABVQString@@1_N@Z.__imp_?initialize@ToolApp

C:\Program Files (x86)\LocalPlayback\Upg8FDB.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	6.158324090911315
Encrypted:	false
SSDEEP:	768:CgckvM19qBKnNhjBQBJpBp9HZIQuSNSgjfUPgve0kWAbg0XtDSf:GqWynpP9HZIqSgvTkWAMgpS
MD5:	E7BBAE30397FE7391B43B850BAED7E39
SHA1:	9DAAF21CF9ADC82317AA4CBEF034E74964315970
SHA-256:	CEB6F6B37DAB633A00A3F625E5F8D1339E3DF6E0C82C86F3CC1732D34CF8BD59
SHA-512:	8A3671A1AA4E883A5F563F8ECA1A20964F5439131B49D07FAF66FCB3A0DD3E8B019B5140BACCF8EAE99C6E3E58B6E5BD904CD48BB9E4E7781A787811D427B694
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................K...........................................M.....M.....H.'....M.....Rich...........................PE..L.....[...........!.........>............................................... ............@.............................8...8...........................................p...........................0...@............................................text...;........................... ..`.rdata...&.......(..................@..@.data...,...........................@....gfids..H...........................@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Upg901A.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.075928267820056
Encrypted:	false
SSDEEP:	3:vFWWMNCmXyKgCC6bynLQSTjWMvZozDMuK4JlEgzov02AfWMvZfR1U00ov01XKI7B:TM3i0bSjRZozDUKEso8nfRZfR1ULo815
MD5:	B36CA3B4EFEF278555CB39E2C0A52A67
SHA1:	4528C8567603C5CE07F48BBDCAD2BD67049DE7FD
SHA-256:	559B46E78352C8E603E8E9B3638088A1DB91FCDFB7F38FC85435FDE84942C1D1
SHA-512:	49785E7C08022530653EBBC524A651B87C64DDC73108DB13FF462EE1B01ED29006923A563C670E26974AA49B764133774C94BCFA0B95CEAB047AB31C1643571D
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8'?>..<Configs>..<ServerAddress>..<Value>http://hikdownload.hik-connect.com</Value>..</ServerAddress>..<Prompt>..<Value>1</Value>..</Prompt>..</Configs>..

C:\Program Files (x86)\LocalPlayback\Upgrade.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	6.158324090911315
Encrypted:	false
SSDEEP:	768:CgckvM19qBKnNhjBQBJpBp9HZIQuSNSgjfUPgve0kWAbg0XtDSf:GqWynpP9HZIqSgvTkWAMgpS
MD5:	E7BBAE30397FE7391B43B850BAED7E39
SHA1:	9DAAF21CF9ADC82317AA4CBEF034E74964315970
SHA-256:	CEB6F6B37DAB633A00A3F625E5F8D1339E3DF6E0C82C86F3CC1732D34CF8BD59
SHA-512:	8A3671A1AA4E883A5F563F8ECA1A20964F5439131B49D07FAF66FCB3A0DD3E8B019B5140BACCF8EAE99C6E3E58B6E5BD904CD48BB9E4E7781A787811D427B694
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................K...........................................M.....M.....H.'....M.....Rich...........................PE..L.....[...........!.........>............................................... ............@.............................8...8...........................................p...........................0...@............................................text...;........................... ..`.rdata...&.......(..................@..@.data...,...........................@....gfids..H...........................@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\Upgrade.xml (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.075928267820056
Encrypted:	false
SSDEEP:	3:vFWWMNCmXyKgCC6bynLQSTjWMvZozDMuK4JlEgzov02AfWMvZfR1U00ov01XKI7B:TM3i0bSjRZozDUKEso8nfRZfR1ULo815
MD5:	B36CA3B4EFEF278555CB39E2C0A52A67
SHA1:	4528C8567603C5CE07F48BBDCAD2BD67049DE7FD
SHA-256:	559B46E78352C8E603E8E9B3638088A1DB91FCDFB7F38FC85435FDE84942C1D1
SHA-512:	49785E7C08022530653EBBC524A651B87C64DDC73108DB13FF462EE1B01ED29006923A563C670E26974AA49B764133774C94BCFA0B95CEAB047AB31C1643571D
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8'?>..<Configs>..<ServerAddress>..<Value>http://hikdownload.hik-connect.com</Value>..</ServerAddress>..<Prompt>..<Value>1</Value>..</Prompt>..</Configs>..

C:\Program Files (x86)\LocalPlayback\YUV9415.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	424448
Entropy (8bit):	6.797089059484714
Encrypted:	false
SSDEEP:	12288:fSV3/oggpJPKHQwwa9gcRmRLrW87tL2LgAN4:f2PogeJTwfKu87ticj
MD5:	123C59F5BD7502754946E9325FF24D90
SHA1:	C754F36E9B19B55CC56FFBBE2659782C5D8C6848
SHA-256:	A065906F697C174AB9AAF38D9468F90F4390A6A810C083123DE84999EF3B02D3
SHA-512:	AD27CC896A41A37A2708B8B37D59C46EF4C9A8E9EC65A2C91AAD5556C01697DF925FB300C5E966201AD0069B53568F962F9201DE20ECCC429B63D66D8B570145
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................A....]............W......P.....F.....@.....E....Rich....................PE..L.....Y...........!......................................................................@..........................A......<;..(...............................l...`................................5..@...............(............................text............................... ..`.rdata...r.......t..................@..@.data...\0...P.......8..............@....rsrc................N..............@..@.reloc..F$.......&...T..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\YUVProcess.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	424448
Entropy (8bit):	6.797089059484714
Encrypted:	false
SSDEEP:	12288:fSV3/oggpJPKHQwwa9gcRmRLrW87tL2LgAN4:f2PogeJTwfKu87ticj
MD5:	123C59F5BD7502754946E9325FF24D90
SHA1:	C754F36E9B19B55CC56FFBBE2659782C5D8C6848
SHA-256:	A065906F697C174AB9AAF38D9468F90F4390A6A810C083123DE84999EF3B02D3
SHA-512:	AD27CC896A41A37A2708B8B37D59C46EF4C9A8E9EC65A2C91AAD5556C01697DF925FB300C5E966201AD0069B53568F962F9201DE20ECCC429B63D66D8B570145
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................A....]............W......P.....F.....@.....E....Rich....................PE..L.....Y...........!......................................................................@..........................A......<;..(...............................l...`................................5..@...............(............................text............................... ..`.rdata...r.......t..................@..@.data...\0...P.......8..............@....rsrc................N..............@..@.reloc..F$.......&...T..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\cal8412.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80384
Entropy (8bit):	6.2971783297680375
Encrypted:	false
SSDEEP:	1536:8yabaHgD5PI/OKfza+2BFP3GCc8CPrsWjcdC8n26:8ya+Hy5m7a+2RCsC8nl
MD5:	242398B0CBE7F733EE122BF7E2C07E61
SHA1:	3ACA9A0636F5DCEC2B76EDEE34E077A22B29DCFD
SHA-256:	4787DDD3CB9FC9676E66E870108F81FB276A42F725277AD5E1B34B7F9A9F9FC6
SHA-512:	85646BF9BD5CAD0154B2B429207F2B85ED8306942D4C37357042AAE2599B7A85195625317C4B34F6590E3F804D38FB29DC4CD654715766D0F9D80F7E9CE27AF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................glJ...........`.....^.....a.....a....]....Z...._...Rich............................PE..L.....V...........!.................,....................................................@.........................."......."..<....p..............................p...8........................... ...@...............4............................text...D........................... ..`.rdata...H.......J..................@..@.data...@1...0......................@....rsrc........p.......(..............@..@.reloc...............,..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\calib.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80384
Entropy (8bit):	6.2971783297680375
Encrypted:	false
SSDEEP:	1536:8yabaHgD5PI/OKfza+2BFP3GCc8CPrsWjcdC8n26:8ya+Hy5m7a+2RCsC8nl
MD5:	242398B0CBE7F733EE122BF7E2C07E61
SHA1:	3ACA9A0636F5DCEC2B76EDEE34E077A22B29DCFD
SHA-256:	4787DDD3CB9FC9676E66E870108F81FB276A42F725277AD5E1B34B7F9A9F9FC6
SHA-512:	85646BF9BD5CAD0154B2B429207F2B85ED8306942D4C37357042AAE2599B7A85195625317C4B34F6590E3F804D38FB29DC4CD654715766D0F9D80F7E9CE27AF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................glJ...........`.....^.....a.....a....]....Z...._...Rich............................PE..L.....V...........!.................,....................................................@.........................."......."..<....p..............................p...8........................... ...@...............4............................text...D........................... ..`.rdata...H.......J..................@..@.data...@1...0......................@....rsrc........p.......(..............@..@.reloc...............,..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\gdi85CC.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1645320
Entropy (8bit):	6.787752063353702
Encrypted:	false
SSDEEP:	24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
MD5:	871C903A90C45CA08A9D42803916C3F7
SHA1:	D962A12BC15BFB4C505BB63F603CA211588958DB
SHA-256:	F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
SHA-512:	985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..\|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\gdiplus.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1645320
Entropy (8bit):	6.787752063353702
Encrypted:	false
SSDEEP:	24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
MD5:	871C903A90C45CA08A9D42803916C3F7
SHA1:	D962A12BC15BFB4C505BB63F603CA211588958DB
SHA-256:	F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
SHA-512:	985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..\|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\hpr.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108032
Entropy (8bit):	6.4285822614939
Encrypted:	false
SSDEEP:	3072:84WsbIq7yk/9+z4p6OwfTPIHigAVxKtIhOQ6OtS8ejup:84RbByk/pptwKA6OtQM
MD5:	D3D51B79AFCAE454AB11A5DE8928B377
SHA1:	86BD5F7C0965F53EB2CAFC9B20491A7DA80F38E1
SHA-256:	1248E45905A9EF3E9C4E50C2EB333A04B5BB21A3C0AD201C4C9335F09A31750F
SHA-512:	FA894AA0164CED19223E59EF3BA1BE0BDF28AA087076B0E0DEBC50FE7B3CF3E4F44C2324D2EBE43DA92EA8BEE7E7CC518E3A6E7AE798D33800C657B8C7BB1882
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.o.zp..zp..zp..s...~p...?..~p..s...sp..s...up..s...rp..zp...p..].z.wp..s...Yp..s...{p..d"..{p..s...{p..Richzp..................PE..L...._.S...........!................[........ ......................................oc....@.........................@Q...=..H;.......p...............................#.............................../..@............ ..`............................text............................... ..`.rdata...o... ...p..................@..@.data................\|..............@....rsrc........p......................@..@.reloc..v........ ..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\hpr8777.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108032
Entropy (8bit):	6.4285822614939
Encrypted:	false
SSDEEP:	3072:84WsbIq7yk/9+z4p6OwfTPIHigAVxKtIhOQ6OtS8ejup:84RbByk/pptwKA6OtQM
MD5:	D3D51B79AFCAE454AB11A5DE8928B377
SHA1:	86BD5F7C0965F53EB2CAFC9B20491A7DA80F38E1
SHA-256:	1248E45905A9EF3E9C4E50C2EB333A04B5BB21A3C0AD201C4C9335F09A31750F
SHA-512:	FA894AA0164CED19223E59EF3BA1BE0BDF28AA087076B0E0DEBC50FE7B3CF3E4F44C2324D2EBE43DA92EA8BEE7E7CC518E3A6E7AE798D33800C657B8C7BB1882
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.o.zp..zp..zp..s...~p...?..~p..s...sp..s...up..s...rp..zp...p..].z.wp..s...Yp..s...{p..d"..{p..s...{p..Richzp..................PE..L...._.S...........!................[........ ......................................oc....@.........................@Q...=..H;.......p...............................#.............................../..@............ ..`............................text............................... ..`.rdata...o... ...p..................@..@.data................\|..............@....rsrc........p......................@..@.reloc..v........ ..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\ico87D7.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	888832
Entropy (8bit):	7.332816074914905
Encrypted:	false
SSDEEP:	24576:Vf2VfWlcKu6Gavkg3NydIbbbI4IBAUZLY:ZuscKu6GaXUT4IBAUZLY
MD5:	73AF5773BF5627FE771BF6809EC839F9
SHA1:	69D9597991DD0D1C6B478174AAA85B0E8175D0A7
SHA-256:	6CD69191469BF13F0CEA70837BAC9B1E7871C116F5F6F18BEF5A6A9575C020C9
SHA-512:	64B631454D1D16709AE96CCA95E8E3DD6049841C53EF6C4643B1A5B28A32FE6BFACB86337E93B5F9F2ABF43D0233B094646B8065D3C1FAFEAAB7C3D6E371B864
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A... . . .(... ..(. ..(... . . ..(... .,... .,... .m+... .,... .Rich. .................PE..L...0.YD...........!................................................................................................0K.......I..<....`.......................p..........................................................P............................text............................... ..`.rdata..1\|..........................@..@.data...X....P.......P..............@....rsrc........`.......`..............@..@.reloc..F....p... ...p..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\iconv.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	888832
Entropy (8bit):	7.332816074914905
Encrypted:	false
SSDEEP:	24576:Vf2VfWlcKu6Gavkg3NydIbbbI4IBAUZLY:ZuscKu6GaXUT4IBAUZLY
MD5:	73AF5773BF5627FE771BF6809EC839F9
SHA1:	69D9597991DD0D1C6B478174AAA85B0E8175D0A7
SHA-256:	6CD69191469BF13F0CEA70837BAC9B1E7871C116F5F6F18BEF5A6A9575C020C9
SHA-512:	64B631454D1D16709AE96CCA95E8E3DD6049841C53EF6C4643B1A5B28A32FE6BFACB86337E93B5F9F2ABF43D0233B094646B8065D3C1FAFEAAB7C3D6E371B864
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A... . . .(... ..(. ..(... . . ..(... .,... .,... .m+... .,... .Rich. .................PE..L...0.YD...........!................................................................................................0K.......I..<....`.......................p..........................................................P............................text............................... ..`.rdata..1\|..........................@..@.data...X....P.......P..............@....rsrc........`.......`..............@..@.reloc..F....p... ...p..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qdd97B4.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	6.367490162985529
Encrypted:	false
SSDEEP:	768:M2cu2Izzl95wF36BhInlpnEIK3GeB7r3qgLgac:y0zl9u36BinbnEIK2eB7r6gUac
MD5:	E4EA9C31F306AB12B3F573E5E831BA70
SHA1:	CF3438734959F9BA0DD9D197E66619A0E37D65DE
SHA-256:	C6612B7C6090CC5E0C72A04A7AE0499FF8FEF396065A5248FED71ACB76E1AED1
SHA-512:	7D07A29611564091ED8D80F21D9A186E6D543D09880EBDB924EE9016B197DF12DD53921A8EBFE8E94DECD9574493F86CB5796D828BF1BE0845B8FA54D6E41FB7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x...x...x..0.>..x...*..x......x......x...(..x..X.(..x...x..x..X....x..X.)..x...*...x..X.+..x..Rich.x..........PE..L...[b.V...........!.....^...8.......g.......p............................................@.............................q...T...x.......8............................................................~..@............p...............................text...t].......^.................. ..`.rdata...#...p...$...b..............@..@.data...............................@....qtmetad$...........................@..P.rsrc...8...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qdd97C5.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	5.018034012037364
Encrypted:	false
SSDEEP:	1536:tNCAoKae4GPX5O9mMVjadEAQ8g1g1aBzCZGu:GfePX5O9mMVjatQ88UaBzCZj
MD5:	61BC809A6F0C570104E95D52EFF11DAC
SHA1:	FFDBFF5C542F4F6742C1E6C53E774758D6D10360
SHA-256:	9547AB0E079E6A8E3BD3693047E3B8251ADCC719466B49C77A0E5FBC311BE403
SHA-512:	37ACE590D3F8CF142AA35ADAB00CC20AEACFDC805B2D700132C9DC5C0417FD0A532D8E32491B43665B1C2C9EA2793E8BF914E135B93E6E7CF1BC241C7699803D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............r...r...r.<?....r.....r.....r.....r.....r.T^....r...s.i.r.T^....r.T^....r.....r.T^....r.Rich..r.........PE..L...\b.V...........!.........t......`.....................................................@..........................E......`c..x...............................\|...p...8............................6..@............`..`............................text............................... ..`.rdata...7.......8..................@..@.data...p....P.......8..............@....idata.......`.......<..............@..@.qtmetad^............X..............@..P.rsrc................\..............@..@.reloc..5............b..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qdd97D5.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*387 bytes
Category:	dropped
Size (bytes):	1585152
Entropy (8bit):	5.24106379488492
Encrypted:	false
SSDEEP:	24576:0jHdg8/85V6FgCk8VyZO08BcwO8TDvJcpJOpKUj52QG:0j0V6FgCk8VyjUK
MD5:	A809C5A3807CA479F06976F3C1331E85
SHA1:	3810448F796B6632E3E37AFAB74FA997FC7C8E5C
SHA-256:	B9659A88F27232BCA06CD8B31A3948401DD9EF4DDC1B4D4C4BB0635170556E40
SHA-512:	1035BCC56FA74E32D2770FEEC82C833D0BD49F68968FDD3EA94C30641174EFFFD1ECF0EA6F760DC5E3FAE4B7A52E2ABECACC15401BA77BB9027D30D90FF031C0
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qdds.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	6.367490162985529
Encrypted:	false
SSDEEP:	768:M2cu2Izzl95wF36BhInlpnEIK3GeB7r3qgLgac:y0zl9u36BinbnEIK2eB7r6gUac
MD5:	E4EA9C31F306AB12B3F573E5E831BA70
SHA1:	CF3438734959F9BA0DD9D197E66619A0E37D65DE
SHA-256:	C6612B7C6090CC5E0C72A04A7AE0499FF8FEF396065A5248FED71ACB76E1AED1
SHA-512:	7D07A29611564091ED8D80F21D9A186E6D543D09880EBDB924EE9016B197DF12DD53921A8EBFE8E94DECD9574493F86CB5796D828BF1BE0845B8FA54D6E41FB7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x...x...x..0.>..x...*..x......x......x...(..x..X.(..x...x..x..X....x..X.)..x...*...x..X.+..x..Rich.x..........PE..L...[b.V...........!.....^...8.......g.......p............................................@.............................q...T...x.......8............................................................~..@............p...............................text...t].......^.................. ..`.rdata...#...p...$...b..............@..@.data...............................@....qtmetad$...........................@..P.rsrc...8...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qddsd.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	5.018034012037364
Encrypted:	false
SSDEEP:	1536:tNCAoKae4GPX5O9mMVjadEAQ8g1g1aBzCZGu:GfePX5O9mMVjatQ88UaBzCZj
MD5:	61BC809A6F0C570104E95D52EFF11DAC
SHA1:	FFDBFF5C542F4F6742C1E6C53E774758D6D10360
SHA-256:	9547AB0E079E6A8E3BD3693047E3B8251ADCC719466B49C77A0E5FBC311BE403
SHA-512:	37ACE590D3F8CF142AA35ADAB00CC20AEACFDC805B2D700132C9DC5C0417FD0A532D8E32491B43665B1C2C9EA2793E8BF914E135B93E6E7CF1BC241C7699803D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............r...r...r.<?....r.....r.....r.....r.....r.T^....r...s.i.r.T^....r.T^....r.....r.T^....r.Rich..r.........PE..L...\b.V...........!.........t......`.....................................................@..........................E......`c..x...............................\|...p...8............................6..@............`..`............................text............................... ..`.rdata...7.......8..................@..@.data...p....P.......8..............@....idata.......`.......<..............@..@.qtmetad^............X..............@..P.rsrc................\..............@..@.reloc..5............b..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qddsd.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*387 bytes
Category:	dropped
Size (bytes):	1585152
Entropy (8bit):	5.24106379488492
Encrypted:	false
SSDEEP:	24576:0jHdg8/85V6FgCk8VyZO08BcwO8TDvJcpJOpKUj52QG:0j0V6FgCk8VyjUK
MD5:	A809C5A3807CA479F06976F3C1331E85
SHA1:	3810448F796B6632E3E37AFAB74FA997FC7C8E5C
SHA-256:	B9659A88F27232BCA06CD8B31A3948401DD9EF4DDC1B4D4C4BB0635170556E40
SHA-512:	1035BCC56FA74E32D2770FEEC82C833D0BD49F68968FDD3EA94C30641174EFFFD1ECF0EA6F760DC5E3FAE4B7A52E2ABECACC15401BA77BB9027D30D90FF031C0
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qgi9815.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.955190501946951
Encrypted:	false
SSDEEP:	384:ktBEIE7N/yeCZ/OnllfzlPOY9HhYv0i5024vNkNvMI9LQLj9HUch:+EIE7zOufzpO8hY7OvWlMwQLFUch
MD5:	850358AB62020FC39914B6A12127352F
SHA1:	A5AFFF0B328925798450B41DC4F874BAB541B180
SHA-256:	0660C5335F5CAED74ED8B0D97188906F876B674B06F05D44923B6E6166C703C9
SHA-512:	655408CEAF802924B640FF259A01E4097B72A3932BA03A70C927FDE573FBD43453310898131717F6D2E90256B48E89FEBB71262F3D35A23369AC43B148528CB6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.t.}...}...}...f......p.......p...q...p...y...p...x.......x...}...........~.......\|...p...\|.......\|...Rich}...........................PE..L....,.V...........!.....6...*.......=.......P............................................@..........................W..q....X..x.......8.......................,....................................S..@............P...............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......R..............@....qtmetad ............T..............@..P.rsrc...8............V..............@..@.reloc..,............Z..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qgi9826.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	75264
Entropy (8bit):	4.755797136863966
Encrypted:	false
SSDEEP:	768:HCesfdtYYZNzPZ5OPu3TnXKEU+GcBpMtVDj+W/xlhoGL7TId:EZZ3TXKpFcBpMtVDj+W/nhoGX0
MD5:	A8DE692BDA55C6437B9346847DC129F4
SHA1:	3ACDA6341984816E80D012ACE550C3CF5CF08C54
SHA-256:	D9244748A7E4A4874A959E3A7EB8C41019E19D8E914B3305B7FE82CBCD82D546
SHA-512:	41E6A55F238F335D7BB19AC76DA9276DB900837A4B82466E3FA895A4B7B7A2DADCAEA3574E853CFEEA7075A53326B73F26F73913B5091FA3F02BF11B4D7445AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./.%.k.K.k.K.k.K....i.K.f...j.K.f...g.K.f...o.K.f...n.K..k..n.K.k.J...K..k..h.K..k..j.K.f...j.K..k..j.K.Richk.K.................PE..L....,.V...........!.........d...............................................p............@.................................."..x....P.......................`......p...8...........................p...@............ ...............................text............................... ..`.rdata.../.......0..................@..@.data...\...........................@....idata../.... ......................@..@.qtmetadY....@......................@..P.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qgi9836.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*365 bytes
Category:	dropped
Size (bytes):	1495040
Entropy (8bit):	5.2856094482805895
Encrypted:	false
SSDEEP:	24576:fj3dg8/85s9mWXf8a3r8ozAOd8WcJOKacADvJcpXx4HK:fjEs9mWXf8a3r8o1crx4
MD5:	FE86F85A3932C87F1F3F8C1BFFE8B3A1
SHA1:	42BC655453431805D1B70264D85A780428C4B7D8
SHA-256:	42BB89F93E9F9421D82AD46C30C9386FEE3210B10337A277158BBDDE44E24C6E
SHA-512:	D35E922C0F0B84C069576F069E779CCA169E89313BACBE93778B3A9D0E34226AF49A6DE6A10EE6696CD427B22453511AA7965B86061B023E64539EBBC71945DB
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........m...L.......l...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qgif.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.955190501946951
Encrypted:	false
SSDEEP:	384:ktBEIE7N/yeCZ/OnllfzlPOY9HhYv0i5024vNkNvMI9LQLj9HUch:+EIE7zOufzpO8hY7OvWlMwQLFUch
MD5:	850358AB62020FC39914B6A12127352F
SHA1:	A5AFFF0B328925798450B41DC4F874BAB541B180
SHA-256:	0660C5335F5CAED74ED8B0D97188906F876B674B06F05D44923B6E6166C703C9
SHA-512:	655408CEAF802924B640FF259A01E4097B72A3932BA03A70C927FDE573FBD43453310898131717F6D2E90256B48E89FEBB71262F3D35A23369AC43B148528CB6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.t.}...}...}...f......p.......p...q...p...y...p...x.......x...}...........~.......\|...p...\|.......\|...Rich}...........................PE..L....,.V...........!.....6...*.......=.......P............................................@..........................W..q....X..x.......8.......................,....................................S..@............P...............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......R..............@....qtmetad ............T..............@..P.rsrc...8............V..............@..@.reloc..,............Z..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qgifd.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	75264
Entropy (8bit):	4.755797136863966
Encrypted:	false
SSDEEP:	768:HCesfdtYYZNzPZ5OPu3TnXKEU+GcBpMtVDj+W/xlhoGL7TId:EZZ3TXKpFcBpMtVDj+W/nhoGX0
MD5:	A8DE692BDA55C6437B9346847DC129F4
SHA1:	3ACDA6341984816E80D012ACE550C3CF5CF08C54
SHA-256:	D9244748A7E4A4874A959E3A7EB8C41019E19D8E914B3305B7FE82CBCD82D546
SHA-512:	41E6A55F238F335D7BB19AC76DA9276DB900837A4B82466E3FA895A4B7B7A2DADCAEA3574E853CFEEA7075A53326B73F26F73913B5091FA3F02BF11B4D7445AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./.%.k.K.k.K.k.K....i.K.f...j.K.f...g.K.f...o.K.f...n.K..k..n.K.k.J...K..k..h.K..k..j.K.f...j.K..k..j.K.Richk.K.................PE..L....,.V...........!.........d...............................................p............@.................................."..x....P.......................`......p...8...........................p...@............ ...............................text............................... ..`.rdata.../.......0..................@..@.data...\...........................@....idata../.... ......................@..@.qtmetadY....@......................@..P.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qgifd.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*365 bytes
Category:	dropped
Size (bytes):	1495040
Entropy (8bit):	5.2856094482805895
Encrypted:	false
SSDEEP:	24576:fj3dg8/85s9mWXf8a3r8ozAOd8WcJOKacADvJcpXx4HK:fjEs9mWXf8a3r8o1crx4
MD5:	FE86F85A3932C87F1F3F8C1BFFE8B3A1
SHA1:	42BC655453431805D1B70264D85A780428C4B7D8
SHA-256:	42BB89F93E9F9421D82AD46C30C9386FEE3210B10337A277158BBDDE44E24C6E
SHA-512:	D35E922C0F0B84C069576F069E779CCA169E89313BACBE93778B3A9D0E34226AF49A6DE6A10EE6696CD427B22453511AA7965B86061B023E64539EBBC71945DB
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........m...L.......l...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qic9885.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	6.236293908090551
Encrypted:	false
SSDEEP:	768:IIz31g+6jT06+WEFnZqGVPJWJzvincpC9qcF6xsb0yJsY:/Jg+6jT06+WEFRxJWJzvscIrF6abvJsY
MD5:	2CD20995D081EC4850138F5F85C3EBC7
SHA1:	C93E8301D4E3A25A25064384286C731569E0C4B4
SHA-256:	A550F8CA914D8555B1DE74E44A94F7100F7F0F702CDE7F10436D8DB41420F3D6
SHA-512:	25FD2E520AC14E260766A2124747674821653215CBACE45AA0915D6EE8E7488ADD3EE3F581B87226E4E92A59018CCC6DC63BE94126308D0A708946ED4C39B12F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............~...~...~.......~......~......~......~......~.lc....~.....].~.lc....~.lc....~......~.lc....~.Rich..~.........PE..L...Zb.V...........!.....>...:.......F.......P............................................@..........................^..r....^..x.......8...........................................................HZ..@............P.. ............................text....=.......>.................. ..`.rdata...#...P...$...B..............@..@.data...,............f..............@....qtmetad(............l..............@..P.rsrc...8............n..............@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qic9896.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	5.069799768701058
Encrypted:	false
SSDEEP:	1536:1WNxQ5OjMvzptfzsV0hJW0EPUaNe+fzpny:1WN2S+9tfJcne+fzpny
MD5:	857BFBF7221573D1594B1CFD4ECAC10A
SHA1:	00A44AE4A14861FD9FB32D0849842ACCBB313169
SHA-256:	9DEF8BD650DBD0EAD458311CDF8C7E8BCB888C3379CB1508572DEDBC653E3EE0
SHA-512:	EDA72A7EE4FC3CCA95BBDD1EC3C7BF74EBCDB49E3DD0092F1A90E1720174EBE1DBF2BEFAF2ADE2687760D7E6467D3A40C18D7C9C8798BF21295B2D3D9B78E77B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Y.n.Y.n.Y.n....[.n.T...[.n.T...U.n.T...].n.T...].n..`..\.n.Y.o...n..`..[.n..`..X.n.T...X.n..`..X.n.RichY.n.........................PE..L...Zb.V...........!......................................................................@..........................H.......c..x...................................p...8...........................(:..@............`...............................text............................... ..`.rdata..j:.......<..................@..@.data...t....P.......:..............@....idata.......`... ...>..............@..@.qtmetadc............^..............@..P.rsrc................b..............@..@.reloc...............h..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qic98B6.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*379 bytes
Category:	dropped
Size (bytes):	1552384
Entropy (8bit):	5.267467912977898
Encrypted:	false
SSDEEP:	24576:HjeXSO9AKtE+01ehVKEZW6+cO78AcJOb/99DSTh3P:HjWtE+0shVKEZW6
MD5:	E033C0A502F8E281EB2B63FEE2B3D25C
SHA1:	187BB02456242D226A54983414301FC0E7B8A62A
SHA-256:	07CC4D33D7CBED77DEF7D4BE8F5DA248CB19056498477CB744970B6CE13B03EE
SHA-512:	60192C3200AC65C13321506C0F490562E511D3EECD723A5702763DA0820208164598F1A6C82D46A3181B078AF40C7D3A214E264BEFE620A53BB233525A1AE587
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........{...........z...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qic98F6.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.118566391576064
Encrypted:	false
SSDEEP:	768:/FTME5fbPFzbvG+pnu8dZ8E28M2UQ1gLWm:/6YbPFG4nuKmE/HUAg6m
MD5:	212F86EB86A6AC4E329DAA33FC42D684
SHA1:	99F0F0344D2AA2D161E911A935EEAEBF38E8228A
SHA-256:	AD820F067DB4C8C8C1E37BCCC1C84EADBF5610172224362D795D0C70FFFA2EB7
SHA-512:	1DD0267E3C350DE0E467A417428A10D9F09897864EE853893D6F28F6B151054B5EAAD6F2CA2A0ED30A156777EDE0569E81FA737FFDDAD884FBFAE7AF60C82E41
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.d.}...}...}...^......p.......p...q...p...y...p...x....?..x...}........?..~....?..\|...p...\|....?..\|...Rich}...................PE..L....,.V...........!.....4...........;.......P............................................@..........................X..q....Y..x.......8...........................................................`T..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...,....p.......T..............@....qtmetad<............V..............@..P.rsrc...8............X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qic9916.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	4.879255965170767
Encrypted:	false
SSDEEP:	384:94Wbu78cFofjVXVCqxAQzNQSZv0I0LxmVUhy5NuPZzh6CJVNMbv99Kkv5uG3EDEU:ZbthBAQ5Q9h23BRu5NVeU+Ny2Y+iLz
MD5:	9E712EE91C4F1836CEC23C33F4D5F8AC
SHA1:	A56EBC14068CA69CBFC846F2B8952A4457E00B9A
SHA-256:	006C4753A1A990B1716DFF99E3CACA58084BE59085FAE8021000F2CB13AC8B58
SHA-512:	7C97D8C1DAEB77C8B0E726BE9D6C632B8A536310A2964DE6705F62B869BE37D058155A1893D30BCA4F41878659BF91DE5B11B937170D716CBF99B525288E9BE6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.%.c.K.c.K.c.K....a.K.n...b.K.n...o.K.n...g.K.n...f.K..k..f.K.c.J...K..k..`.K..k..b.K.n...b.K..k..b.K.Richc.K.........PE..L....,.V...........!.........l...............................................p............@.........................@.......h#..x....P.......................`......p...8...............................@............ ..h............................text............................... ..`.rdata...2.......4..................@..@.data...............................@....idata....... ......................@..@.qtmetad{....@......................@..P.rsrc........P......................@..@.reloc..B....`......................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qic9927.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*389 bytes
Category:	dropped
Size (bytes):	1593344
Entropy (8bit):	5.281763153930087
Encrypted:	false
SSDEEP:	24576:pj3dg8/85sxqoYKctYm82Ox8CcfONacbDvJcpS3aom5z:pjEscoYKctYm8qc7aoK
MD5:	16C9E8CBB1270B76B76A491DE5247AEC
SHA1:	15AB3AF5718E6FF9F6B877C591B26398844E1F3C
SHA-256:	5A9B0D4BCC040A90C7F1E36CBD15B9BEC7D30227AE2E094C71C9BA1198961D6E
SHA-512:	69BC77DE16EA38D42003D6999F9E5FF32D38A3F0DB1C8175857A55FCBF01942C73F1362A3111A3016B36675A3FF961A318CF439CBECFF9E04530D5C6D15CAE94
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qicns.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	6.236293908090551
Encrypted:	false
SSDEEP:	768:IIz31g+6jT06+WEFnZqGVPJWJzvincpC9qcF6xsb0yJsY:/Jg+6jT06+WEFRxJWJzvscIrF6abvJsY
MD5:	2CD20995D081EC4850138F5F85C3EBC7
SHA1:	C93E8301D4E3A25A25064384286C731569E0C4B4
SHA-256:	A550F8CA914D8555B1DE74E44A94F7100F7F0F702CDE7F10436D8DB41420F3D6
SHA-512:	25FD2E520AC14E260766A2124747674821653215CBACE45AA0915D6EE8E7488ADD3EE3F581B87226E4E92A59018CCC6DC63BE94126308D0A708946ED4C39B12F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............~...~...~.......~......~......~......~......~.lc....~.....].~.lc....~.lc....~......~.lc....~.Rich..~.........PE..L...Zb.V...........!.....>...:.......F.......P............................................@..........................^..r....^..x.......8...........................................................HZ..@............P.. ............................text....=.......>.................. ..`.rdata...#...P...$...B..............@..@.data...,............f..............@....qtmetad(............l..............@..P.rsrc...8............n..............@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qicnsd.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	5.069799768701058
Encrypted:	false
SSDEEP:	1536:1WNxQ5OjMvzptfzsV0hJW0EPUaNe+fzpny:1WN2S+9tfJcne+fzpny
MD5:	857BFBF7221573D1594B1CFD4ECAC10A
SHA1:	00A44AE4A14861FD9FB32D0849842ACCBB313169
SHA-256:	9DEF8BD650DBD0EAD458311CDF8C7E8BCB888C3379CB1508572DEDBC653E3EE0
SHA-512:	EDA72A7EE4FC3CCA95BBDD1EC3C7BF74EBCDB49E3DD0092F1A90E1720174EBE1DBF2BEFAF2ADE2687760D7E6467D3A40C18D7C9C8798BF21295B2D3D9B78E77B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Y.n.Y.n.Y.n....[.n.T...[.n.T...U.n.T...].n.T...].n..`..\.n.Y.o...n..`..[.n..`..X.n.T...X.n..`..X.n.RichY.n.........................PE..L...Zb.V...........!......................................................................@..........................H.......c..x...................................p...8...........................(:..@............`...............................text............................... ..`.rdata..j:.......<..................@..@.data...t....P.......:..............@....idata.......`... ...>..............@..@.qtmetadc............^..............@..P.rsrc................b..............@..@.reloc...............h..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qicnsd.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*379 bytes
Category:	dropped
Size (bytes):	1552384
Entropy (8bit):	5.267467912977898
Encrypted:	false
SSDEEP:	24576:HjeXSO9AKtE+01ehVKEZW6+cO78AcJOb/99DSTh3P:HjWtE+0shVKEZW6
MD5:	E033C0A502F8E281EB2B63FEE2B3D25C
SHA1:	187BB02456242D226A54983414301FC0E7B8A62A
SHA-256:	07CC4D33D7CBED77DEF7D4BE8F5DA248CB19056498477CB744970B6CE13B03EE
SHA-512:	60192C3200AC65C13321506C0F490562E511D3EECD723A5702763DA0820208164598F1A6C82D46A3181B078AF40C7D3A214E264BEFE620A53BB233525A1AE587
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........{...........z...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qico.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.118566391576064
Encrypted:	false
SSDEEP:	768:/FTME5fbPFzbvG+pnu8dZ8E28M2UQ1gLWm:/6YbPFG4nuKmE/HUAg6m
MD5:	212F86EB86A6AC4E329DAA33FC42D684
SHA1:	99F0F0344D2AA2D161E911A935EEAEBF38E8228A
SHA-256:	AD820F067DB4C8C8C1E37BCCC1C84EADBF5610172224362D795D0C70FFFA2EB7
SHA-512:	1DD0267E3C350DE0E467A417428A10D9F09897864EE853893D6F28F6B151054B5EAAD6F2CA2A0ED30A156777EDE0569E81FA737FFDDAD884FBFAE7AF60C82E41
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.d.}...}...}...^......p.......p...q...p...y...p...x....?..x...}........?..~....?..\|...p...\|....?..\|...Rich}...................PE..L....,.V...........!.....4...........;.......P............................................@..........................X..q....Y..x.......8...........................................................`T..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...,....p.......T..............@....qtmetad<............V..............@..P.rsrc...8............X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qicod.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	4.879255965170767
Encrypted:	false
SSDEEP:	384:94Wbu78cFofjVXVCqxAQzNQSZv0I0LxmVUhy5NuPZzh6CJVNMbv99Kkv5uG3EDEU:ZbthBAQ5Q9h23BRu5NVeU+Ny2Y+iLz
MD5:	9E712EE91C4F1836CEC23C33F4D5F8AC
SHA1:	A56EBC14068CA69CBFC846F2B8952A4457E00B9A
SHA-256:	006C4753A1A990B1716DFF99E3CACA58084BE59085FAE8021000F2CB13AC8B58
SHA-512:	7C97D8C1DAEB77C8B0E726BE9D6C632B8A536310A2964DE6705F62B869BE37D058155A1893D30BCA4F41878659BF91DE5B11B937170D716CBF99B525288E9BE6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.%.c.K.c.K.c.K....a.K.n...b.K.n...o.K.n...g.K.n...f.K..k..f.K.c.J...K..k..`.K..k..b.K.n...b.K..k..b.K.Richc.K.........PE..L....,.V...........!.........l...............................................p............@.........................@.......h#..x....P.......................`......p...8...............................@............ ..h............................text............................... ..`.rdata...2.......4..................@..@.data...............................@....idata....... ......................@..@.qtmetad{....@......................@..P.rsrc........P......................@..@.reloc..B....`......................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qicod.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*389 bytes
Category:	dropped
Size (bytes):	1593344
Entropy (8bit):	5.281763153930087
Encrypted:	false
SSDEEP:	24576:pj3dg8/85sxqoYKctYm82Ox8CcfONacbDvJcpS3aom5z:pjEscoYKctYm8qc7aoK
MD5:	16C9E8CBB1270B76B76A491DE5247AEC
SHA1:	15AB3AF5718E6FF9F6B877C591B26398844E1F3C
SHA-256:	5A9B0D4BCC040A90C7F1E36CBD15B9BEC7D30227AE2E094C71C9BA1198961D6E
SHA-512:	69BC77DE16EA38D42003D6999F9E5FF32D38A3F0DB1C8175857A55FCBF01942C73F1362A3111A3016B36675A3FF961A318CF439CBECFF9E04530D5C6D15CAE94
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qjp9985.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	243200
Entropy (8bit):	6.5010076353608355
Encrypted:	false
SSDEEP:	6144:xoozp27baTENcrXotvHuOyaPB9Jhjf18JSCHsoWhpfWJA6Xnb1j:5zp2Deou5aPB9Jhj9A/M
MD5:	5417DCAD42CB731669E36F2B49C695B5
SHA1:	DC3FCFC849A5B24A6E6F06871BDF32F24746B5FC
SHA-256:	9A59C0A2546400E64F0533D43230AB8A3AED3F1D52A05A6071D6EE66A971DCE7
SHA-512:	0BF9974B9EC21313771C69FA69B56678A0B1610C59341E47411E7A216ABBBB47D81DCE48CA8F7FE994464599280BA492A8E097CDE7D2C0D521285E98DEA59FBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A..........R................8.............9....v3........y...v38....v39.....v3............v3.....Rich...................PE..L....-.V...........!.....N...h.......W.......`............................................@.............................r.......x.......8..............................................................@............`...............................text....L.......N.................. ..`.rdata..NL...`...N...R..............@..@.data...............................@....qtmetad@...........................@..P.rsrc...8...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qjp99A6.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434688
Entropy (8bit):	5.456670801522545
Encrypted:	false
SSDEEP:	6144:5dN9W8wkTD6Ph3pKJMpk3WjZn9GM1496GXfSkP0zrEBhSre92/RXHs4eSq82ifO7:5dN9W8DTGPh3s+pk3Wd5XLm
MD5:	47CB3CC0FF9134853580612F79C6D406
SHA1:	46B9B23483F7B0C6C71D79EF7FA6CAE87BC5AA63
SHA-256:	6CF94C3F082BE70BF56532F1B5D63D06090E61B8E22CD7520F8F38963C5103E5
SHA-512:	450929F42E548708FEC0CF0F51801505B3720387298014E0C57551BBF167CFDB4C2EB9CB2D07E53915CFB76BD0033DF3E5B1D3CBDEF7ABAF014995470C8504FB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^............h&<.......(.............................G.........S....G.......G.......G+.......,......G).....Rich............................PE..L....-.V...........!................P.....................................................@..........................Q......$...x...................................p...8........................... C..@...............$............................text...Y........................... ..`.rdata..jC.......D..................@..@.data...`....`.......:..............@....idata..k+.......,...V..............@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qjp99E5.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*529 bytes
Category:	dropped
Size (bytes):	2166784
Entropy (8bit):	5.098122633410351
Encrypted:	false
SSDEEP:	24576:dyj3dg8/85sARTNKY32AW1lubOH8QctODacHDvJcpdutXawefZa:dyjEsARTwY32AW1lUcHX/ew
MD5:	6859C7312E52A296CFF0B2F3FBFF55CD
SHA1:	CBF5E40E0468CCA7022FFEDA754B35441A1C6E59
SHA-256:	637E68F9F4A46689F443ABB2A018451B30C864582B45ADBE78F1EF9DA06E2A12
SHA-512:	286E8D2824B9745EB7DED7766380403EA72E42914AE959C92A899F7E8B8C6DA7FA40A36D3767DD0D3EA47A62ACAEDD6DB4BBB1792F44C1FC8DDF3CFC3C6263D8
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qjpeg.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	243200
Entropy (8bit):	6.5010076353608355
Encrypted:	false
SSDEEP:	6144:xoozp27baTENcrXotvHuOyaPB9Jhjf18JSCHsoWhpfWJA6Xnb1j:5zp2Deou5aPB9Jhj9A/M
MD5:	5417DCAD42CB731669E36F2B49C695B5
SHA1:	DC3FCFC849A5B24A6E6F06871BDF32F24746B5FC
SHA-256:	9A59C0A2546400E64F0533D43230AB8A3AED3F1D52A05A6071D6EE66A971DCE7
SHA-512:	0BF9974B9EC21313771C69FA69B56678A0B1610C59341E47411E7A216ABBBB47D81DCE48CA8F7FE994464599280BA492A8E097CDE7D2C0D521285E98DEA59FBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A..........R................8.............9....v3........y...v38....v39.....v3............v3.....Rich...................PE..L....-.V...........!.....N...h.......W.......`............................................@.............................r.......x.......8..............................................................@............`...............................text....L.......N.................. ..`.rdata..NL...`...N...R..............@..@.data...............................@....qtmetad@...........................@..P.rsrc...8...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qjpegd.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434688
Entropy (8bit):	5.456670801522545
Encrypted:	false
SSDEEP:	6144:5dN9W8wkTD6Ph3pKJMpk3WjZn9GM1496GXfSkP0zrEBhSre92/RXHs4eSq82ifO7:5dN9W8DTGPh3s+pk3Wd5XLm
MD5:	47CB3CC0FF9134853580612F79C6D406
SHA1:	46B9B23483F7B0C6C71D79EF7FA6CAE87BC5AA63
SHA-256:	6CF94C3F082BE70BF56532F1B5D63D06090E61B8E22CD7520F8F38963C5103E5
SHA-512:	450929F42E548708FEC0CF0F51801505B3720387298014E0C57551BBF167CFDB4C2EB9CB2D07E53915CFB76BD0033DF3E5B1D3CBDEF7ABAF014995470C8504FB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^............h&<.......(.............................G.........S....G.......G.......G+.......,......G).....Rich............................PE..L....-.V...........!................P.....................................................@..........................Q......$...x...................................p...8........................... C..@...............$............................text...Y........................... ..`.rdata..jC.......D..................@..@.data...`....`.......:..............@....idata..k+.......,...V..............@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qjpegd.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*529 bytes
Category:	dropped
Size (bytes):	2166784
Entropy (8bit):	5.098122633410351
Encrypted:	false
SSDEEP:	24576:dyj3dg8/85sARTNKY32AW1lubOH8QctODacHDvJcpdutXawefZa:dyjEsARTwY32AW1lUcHX/ew
MD5:	6859C7312E52A296CFF0B2F3FBFF55CD
SHA1:	CBF5E40E0468CCA7022FFEDA754B35441A1C6E59
SHA-256:	637E68F9F4A46689F443ABB2A018451B30C864582B45ADBE78F1EF9DA06E2A12
SHA-512:	286E8D2824B9745EB7DED7766380403EA72E42914AE959C92A899F7E8B8C6DA7FA40A36D3767DD0D3EA47A62ACAEDD6DB4BBB1792F44C1FC8DDF3CFC3C6263D8
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qsv9A34.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.917153981783694
Encrypted:	false
SSDEEP:	384:I5JEkajiasWEN7MADKzFk8RPf4BYSJGI9kgLjW/zXE58nupW:I5JEkbWEOAODfsZJGHgLszUF
MD5:	07CF633C8F9B4B9F2B47A5CBB6DB77E0
SHA1:	3DD599DABC36354996687B102E90ADB5D092A1D5
SHA-256:	75316289D34761C9BEBDB5E93B3E78EB9A4EEF0FB17790451AC6E1D208473AE6
SHA-512:	00B4B8654884A7626C1CC4925B1E8BEC14311322017D305C0E1836647DEC9B44C1199E47E7D45295930A9AF0A4ADE27A4DC2A39A20F6A2376729340F8D12A41D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t...'...'...'dvA'...'..U'...'..j'...'..k'...'..W'...'..W'...'...'..'..k'...'..V'...'..Q'...'..T'...'Rich...'........PE..L......V...........!..... ...*......2'.......0............................................@..........................7..q...T8.......p..8............................................................4..@............0...............................text...$........ .................. ..`.rdata.......0.......$..............@..@.data........P.......>..............@....qtmetad0....`.......@..............@..P.rsrc...8....p.......B..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qsv9A54.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61952
Entropy (8bit):	4.52521734752211
Encrypted:	false
SSDEEP:	768:evBB0oePqcdQmmTQ8+t6+tp3o//i6oCKUcJYiLSoly:evB2bnYQ73o//i6oCKUcJYi+R
MD5:	BFB09ED5AA86DB7332B5E2AC101F14BE
SHA1:	D8DF027435B392A8BCE995F97CB2188719A3AC16
SHA-256:	F8775D70749659822AA20340B2B8F76B1F4EE306E8BFBA016FBC9D3FA3188D7B
SHA-512:	B233EA0E42C49C1416C10B07BB00ED942C467264C4BA0FEEA11AE7C543F70F418B5B2EED0517CB1B27BAD2830504359B8F248D7E119E201698584DB88F0EB550
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%B".%...%...%...%../%...%...%...%...%...%C.%...%...%=..%C.%...%C.%...%...%...%C.%...%Rich...%................PE..L......V...........!.........b.......k.......................................0............@.........................0........................................ ......`...8...............................@............................................text............................... ..`.rdata...%.......&..................@..@.data...L...........................@....idata..~........ ..................@..@.qtmetadl...........................@..P.rsrc...............................@..@.reloc..&.... ......................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qsv9A84.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*401 bytes
Category:	dropped
Size (bytes):	1642496
Entropy (8bit):	5.251566388641284
Encrypted:	false
SSDEEP:	24576:6jHdg8/85V7x0h62FFu+vuOQMLN74OU8hcYOMKuDvJcp23h7:6j0V7x0h62FFPvuOQMLN7Y27
MD5:	A3DC1F495AC8290EDDC944F89E387726
SHA1:	FB2CDB741ACEEC1171F2A14AD1375FC6B468025C
SHA-256:	7FD069A30B3DDC0A1041C6BD017589C37168321FC957330922A7B843B8C3F41A
SHA-512:	3B575624C7584AD3AA4CC1AC242E6657F826504153BF63D4746C798DC5552A9210C6FA02DE02FD327297DBCCF55531C39BBCAC3110D141825D7AF1AF2BCB2B9E
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qsvg.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.917153981783694
Encrypted:	false
SSDEEP:	384:I5JEkajiasWEN7MADKzFk8RPf4BYSJGI9kgLjW/zXE58nupW:I5JEkbWEOAODfsZJGHgLszUF
MD5:	07CF633C8F9B4B9F2B47A5CBB6DB77E0
SHA1:	3DD599DABC36354996687B102E90ADB5D092A1D5
SHA-256:	75316289D34761C9BEBDB5E93B3E78EB9A4EEF0FB17790451AC6E1D208473AE6
SHA-512:	00B4B8654884A7626C1CC4925B1E8BEC14311322017D305C0E1836647DEC9B44C1199E47E7D45295930A9AF0A4ADE27A4DC2A39A20F6A2376729340F8D12A41D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t...'...'...'dvA'...'..U'...'..j'...'..k'...'..W'...'..W'...'...'..'..k'...'..V'...'..Q'...'..T'...'Rich...'........PE..L......V...........!..... ...*......2'.......0............................................@..........................7..q...T8.......p..8............................................................4..@............0...............................text...$........ .................. ..`.rdata.......0.......$..............@..@.data........P.......>..............@....qtmetad0....`.......@..............@..P.rsrc...8....p.......B..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qsvgd.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61952
Entropy (8bit):	4.52521734752211
Encrypted:	false
SSDEEP:	768:evBB0oePqcdQmmTQ8+t6+tp3o//i6oCKUcJYiLSoly:evB2bnYQ73o//i6oCKUcJYi+R
MD5:	BFB09ED5AA86DB7332B5E2AC101F14BE
SHA1:	D8DF027435B392A8BCE995F97CB2188719A3AC16
SHA-256:	F8775D70749659822AA20340B2B8F76B1F4EE306E8BFBA016FBC9D3FA3188D7B
SHA-512:	B233EA0E42C49C1416C10B07BB00ED942C467264C4BA0FEEA11AE7C543F70F418B5B2EED0517CB1B27BAD2830504359B8F248D7E119E201698584DB88F0EB550
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%B".%...%...%...%../%...%...%...%...%...%C.%...%...%=..%C.%...%C.%...%...%...%C.%...%Rich...%................PE..L......V...........!.........b.......k.......................................0............@.........................0........................................ ......`...8...............................@............................................text............................... ..`.rdata...%.......&..................@..@.data...L...........................@....idata..~........ ..................@..@.qtmetadl...........................@..P.rsrc...............................@..@.reloc..&.... ......................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qsvgd.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*401 bytes
Category:	dropped
Size (bytes):	1642496
Entropy (8bit):	5.251566388641284
Encrypted:	false
SSDEEP:	24576:6jHdg8/85V7x0h62FFu+vuOQMLN74OU8hcYOMKuDvJcp23h7:6j0V7x0h62FFPvuOQMLN7Y27
MD5:	A3DC1F495AC8290EDDC944F89E387726
SHA1:	FB2CDB741ACEEC1171F2A14AD1375FC6B468025C
SHA-256:	7FD069A30B3DDC0A1041C6BD017589C37168321FC957330922A7B843B8C3F41A
SHA-512:	3B575624C7584AD3AA4CC1AC242E6657F826504153BF63D4746C798DC5552A9210C6FA02DE02FD327297DBCCF55531C39BBCAC3110D141825D7AF1AF2BCB2B9E
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qtg9B02.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.880481326287201
Encrypted:	false
SSDEEP:	384:f0MPiwwZFypMrcrQVdPy82S8fQ4rI95QLjPx6/m:rKwwZFypFrQVdPy4zQSQL7x6O
MD5:	930355CF4D6D14342512E6E3E96CCBF9
SHA1:	04B2345B42197F7723DB6DEF0680DD1FE7F39BDF
SHA-256:	16F51CCDD328452B1344AD0F3FC72384D707E41482FB9AB590F06CAFFBCF86ED
SHA-512:	BAA8E70838B472641B4F2FA09AB24E1B11CB5B8C43B71F7B69C6C82CFDA39B6AE44FA24D36A340C9BCCCB25E76AAC4D481980A1E40A3714232F7CD60469286D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x..x..x..p.<.x..(.x....x....x...x.....x..x...x......x....+.x..*,.x....).x..Rich.x..........................PE..L...bb.V...........!.........(.......%.......0............................................@.........................0:..q....:..x....p..8...........................................................@5..@............0..x............................text...t........................... ..`.rdata.......0......."..............@..@.data...T....P.......:..............@....qtmetad$....`.......<..............@..P.rsrc...8....p.......>..............@..@.reloc...............B..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qtg9B13.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	4.444990029482588
Encrypted:	false
SSDEEP:	384:yoz373l/F3HXo77tUlryCXdWO49deRrtppd2grRR7pUpxxE4YGgaYKfxjS8fa488:N7T3hFI9deN4E4YGlx2ZZGLqiR
MD5:	3A09B78962826CB7E9F86450C7379BB5
SHA1:	7844B06B5A9F46300FBBA7C99245156B7838A475
SHA-256:	538EF3F8A9B38381C25696646B5850CE427800D0500792034A9408A1F5C6833E
SHA-512:	09A3DE5B3393F41CC64C576D6714FBB75C3FB2B912DC0C63422D36381F4C978DA04E4AC4321BF2683B54EF4077C2F47AEB30D47D07402CC1A021B19EE0AFADAA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...6..6..6.I+...6.....6.....6.....6.....6.!J...6..7...6.!J...6.!J...6.....6.!J...6.Rich..6.................PE..L...db.V...........!.........`......`n.......................................@............@.....................................x.... .......................0..D...p...8...........................x...@............................................text...i........................... ..`.rdata...,..........................@..@.data...............................@....idata..............................@..@.qtmetad^...........................@..P.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qtg9B24.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*379 bytes
Category:	dropped
Size (bytes):	1552384
Entropy (8bit):	5.249417393366619
Encrypted:	false
SSDEEP:	24576:pjHdg8/85VTAz+L0si4oxzm0ON8mczOO/3GDvJcp5YZK:pj0VTAzO0si4oxz/T
MD5:	41A19A59EC2F9173C3A43C1C154DF696
SHA1:	65CEC4A3068CF3A4AB839B6D844670F815A5209B
SHA-256:	FDCE8DF9298CBBF329C7244D1B79E69686F47A35250CA777AF728C0057DA3E0C
SHA-512:	150952EC62EC16818AD55A729234B2E2FD0EDD911ADC155C1949BF76BABBB01D1D9B8F50E7CAFF47322E4FA5BCAB59357C6A2B229C21E923E25E2C907F43AACF
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........{...\|.......y...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qtga.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.880481326287201
Encrypted:	false
SSDEEP:	384:f0MPiwwZFypMrcrQVdPy82S8fQ4rI95QLjPx6/m:rKwwZFypFrQVdPy4zQSQL7x6O
MD5:	930355CF4D6D14342512E6E3E96CCBF9
SHA1:	04B2345B42197F7723DB6DEF0680DD1FE7F39BDF
SHA-256:	16F51CCDD328452B1344AD0F3FC72384D707E41482FB9AB590F06CAFFBCF86ED
SHA-512:	BAA8E70838B472641B4F2FA09AB24E1B11CB5B8C43B71F7B69C6C82CFDA39B6AE44FA24D36A340C9BCCCB25E76AAC4D481980A1E40A3714232F7CD60469286D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x..x..x..p.<.x..(.x....x....x...x.....x..x...x......x....+.x..*,.x....).x..Rich.x..........................PE..L...bb.V...........!.........(.......%.......0............................................@.........................0:..q....:..x....p..8...........................................................@5..@............0..x............................text...t........................... ..`.rdata.......0......."..............@..@.data...T....P.......:..............@....qtmetad$....`.......<..............@..P.rsrc...8....p.......>..............@..@.reloc...............B..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qtgad.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	4.444990029482588
Encrypted:	false
SSDEEP:	384:yoz373l/F3HXo77tUlryCXdWO49deRrtppd2grRR7pUpxxE4YGgaYKfxjS8fa488:N7T3hFI9deN4E4YGlx2ZZGLqiR
MD5:	3A09B78962826CB7E9F86450C7379BB5
SHA1:	7844B06B5A9F46300FBBA7C99245156B7838A475
SHA-256:	538EF3F8A9B38381C25696646B5850CE427800D0500792034A9408A1F5C6833E
SHA-512:	09A3DE5B3393F41CC64C576D6714FBB75C3FB2B912DC0C63422D36381F4C978DA04E4AC4321BF2683B54EF4077C2F47AEB30D47D07402CC1A021B19EE0AFADAA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...6..6..6.I+...6.....6.....6.....6.....6.!J...6..7...6.!J...6.!J...6.....6.!J...6.Rich..6.................PE..L...db.V...........!.........`......`n.......................................@............@.....................................x.... .......................0..D...p...8...........................x...@............................................text...i........................... ..`.rdata...,..........................@..@.data...............................@....idata..............................@..@.qtmetad^...........................@..P.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qtgad.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*379 bytes
Category:	dropped
Size (bytes):	1552384
Entropy (8bit):	5.249417393366619
Encrypted:	false
SSDEEP:	24576:pjHdg8/85VTAz+L0si4oxzm0ON8mczOO/3GDvJcp5YZK:pj0VTAzO0si4oxz/T
MD5:	41A19A59EC2F9173C3A43C1C154DF696
SHA1:	65CEC4A3068CF3A4AB839B6D844670F815A5209B
SHA-256:	FDCE8DF9298CBBF329C7244D1B79E69686F47A35250CA777AF728C0057DA3E0C
SHA-512:	150952EC62EC16818AD55A729234B2E2FD0EDD911ADC155C1949BF76BABBB01D1D9B8F50E7CAFF47322E4FA5BCAB59357C6A2B229C21E923E25E2C907F43AACF
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........{...\|.......y...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qti9B63.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	313344
Entropy (8bit):	5.648105299181966
Encrypted:	false
SSDEEP:	6144:FRfirNO3cCAolH6NdXv1+74AvPY6am60rvT:FRsEgolH89+R
MD5:	4A7956E619554C4E91F0C9C56A0A4B3F
SHA1:	0F0407107501ABD8FCC8A1866FAC33BD2114389C
SHA-256:	B9A7C60810EF699AD7CB97B442949E9F3D729C519FA0B972284CEF5BA9CAF297
SHA-512:	25078B4EC877629A9BCAFE7E200F5DDC68F7F807634AC0A2C450A11D04BEEF454300DFA359A980B90B31103C327C0400C33484716C3F3C93F9D4F714A8B1CF0E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................0./......;....................9.....Xr9.........O...Xr......Xr......Xr8......?.....Xr:.....Rich............................PE..L...wb.V...........!.........F............................................................@.........................P...r......x.......8.......................D....................................~..@...............8............................text............................... ..`.rdata..(...........................@..@.data....*.......&...~..............@....qtmetad@...........................@..P.rsrc...8...........................@..@.reloc..D...........................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qti9B93.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	632832
Entropy (8bit):	5.252848606947526
Encrypted:	false
SSDEEP:	6144:g8FmxwBdI56AaimvqvQNVxcuCWyskVDWo0JDKSg+Md/2Ccf/:XF+wBdI5QCWBkVJ
MD5:	C64E6DF1D38738ADC95B568FEE850C59
SHA1:	351F5FCF68C11679060CA125C4D0043664B2276F
SHA-256:	7741F340B3B198BBB3244B428CA32A2606277E2AA3EEDC8E1BD937ACC8B4802C
SHA-512:	9FEFC9738A64CDD230EDE1BCCC9B4EE65D3A1FBF096D83431C3D0AD4D8B2F9A969E25C48C8F077540A564E82AF0D9B34FC916BA508BB2077559D292F05D132FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.\.6...6...6..P....6...d...6...d+..6...d..6...d...6..8....6...6..66..8...6..8.+..6..8....6...d...6..8....6..Rich.6..........................PE..L...xb.V...........!......................................................................@.................................Xt..x................................+..`...8...............................@............p..X............................text............................... ..`.rdata..j........ ..................@..@.data....C... ...>..................@....idata.......p... ...J..............@..@.qtmetad.............j..............@..P.rsrc................n..............@..@.reloc..r3.......4...t..............@..B........................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qti9BB3.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*583 bytes
Category:	dropped
Size (bytes):	2387968
Entropy (8bit):	5.263038424753968
Encrypted:	false
SSDEEP:	24576:sjHdg8/85VPmP+czlJm4KQypn8Os85c2OHSDvJcpGJcdqLZz5lLx1Sz:sj0VNczlJm4KQypnMYLx1Sz
MD5:	78A7788575110699F3A3611EBB31D06E
SHA1:	785E825E9E35C53173FFBC840E708E6610A8EFF9
SHA-256:	62D368175E8A1722EEBD54D53DF97BB207C56B7C1B3816EC9ABC77CB4EA8D454
SHA-512:	E2ED1315D7D66866DBB2FB85045C2A14D9A93D0340169C495CDA8E41BAEA4F98524957BC036E2B1BDCD93D22760DA68DE6B68CB3C9C918E414081173F54FF4AC
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........G...H.......E...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qtiff.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	313344
Entropy (8bit):	5.648105299181966
Encrypted:	false
SSDEEP:	6144:FRfirNO3cCAolH6NdXv1+74AvPY6am60rvT:FRsEgolH89+R
MD5:	4A7956E619554C4E91F0C9C56A0A4B3F
SHA1:	0F0407107501ABD8FCC8A1866FAC33BD2114389C
SHA-256:	B9A7C60810EF699AD7CB97B442949E9F3D729C519FA0B972284CEF5BA9CAF297
SHA-512:	25078B4EC877629A9BCAFE7E200F5DDC68F7F807634AC0A2C450A11D04BEEF454300DFA359A980B90B31103C327C0400C33484716C3F3C93F9D4F714A8B1CF0E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................0./......;....................9.....Xr9.........O...Xr......Xr......Xr8......?.....Xr:.....Rich............................PE..L...wb.V...........!.........F............................................................@.........................P...r......x.......8.......................D....................................~..@...............8............................text............................... ..`.rdata..(...........................@..@.data....*.......&...~..............@....qtmetad@...........................@..P.rsrc...8...........................@..@.reloc..D...........................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qtiffd.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	632832
Entropy (8bit):	5.252848606947526
Encrypted:	false
SSDEEP:	6144:g8FmxwBdI56AaimvqvQNVxcuCWyskVDWo0JDKSg+Md/2Ccf/:XF+wBdI5QCWBkVJ
MD5:	C64E6DF1D38738ADC95B568FEE850C59
SHA1:	351F5FCF68C11679060CA125C4D0043664B2276F
SHA-256:	7741F340B3B198BBB3244B428CA32A2606277E2AA3EEDC8E1BD937ACC8B4802C
SHA-512:	9FEFC9738A64CDD230EDE1BCCC9B4EE65D3A1FBF096D83431C3D0AD4D8B2F9A969E25C48C8F077540A564E82AF0D9B34FC916BA508BB2077559D292F05D132FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.\.6...6...6..P....6...d...6...d+..6...d..6...d...6..8....6...6..66..8...6..8.+..6..8....6...d...6..8....6..Rich.6..........................PE..L...xb.V...........!......................................................................@.................................Xt..x................................+..`...8...............................@............p..X............................text............................... ..`.rdata..j........ ..................@..@.data....C... ...>..................@....idata.......p... ...J..............@..@.qtmetad.............j..............@..P.rsrc................n..............@..@.reloc..r3.......4...t..............@..B........................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qtiffd.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*583 bytes
Category:	dropped
Size (bytes):	2387968
Entropy (8bit):	5.263038424753968
Encrypted:	false
SSDEEP:	24576:sjHdg8/85VPmP+czlJm4KQypn8Os85c2OHSDvJcpGJcdqLZz5lLx1Sz:sj0VNczlJm4KQypnMYLx1Sz
MD5:	78A7788575110699F3A3611EBB31D06E
SHA1:	785E825E9E35C53173FFBC840E708E6610A8EFF9
SHA-256:	62D368175E8A1722EEBD54D53DF97BB207C56B7C1B3816EC9ABC77CB4EA8D454
SHA-512:	E2ED1315D7D66866DBB2FB85045C2A14D9A93D0340169C495CDA8E41BAEA4F98524957BC036E2B1BDCD93D22760DA68DE6B68CB3C9C918E414081173F54FF4AC
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........G...H.......E...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwb9C22.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.841817764853426
Encrypted:	false
SSDEEP:	384:EQIH6vdFY1KdOkKCghKCyKE99jSz4rI9kb00+Q:EQIH6vxdzpgs2zQHb0XQ
MD5:	F1970AA0EB77E6923ED1D67DAFB52F9C
SHA1:	272A02F65D3DB5D483FD0BDB6CFA51E95E6FB0E2
SHA-256:	D4ED81BD346C82DB8BBF6B2711EA46694DFBBD19ADC3C9E12EC5BC2D8F9B7250
SHA-512:	33BA7D49F490A6036F919D4AB30DB63175D1E6213F09E124CD47461F2AA69DAE7268CCD0470472683642FF3A07AE70B0551E1ECFDE2189E3932B21773DA84EE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............n...n...n.......n......n......n......n......n.lc....n...o..n.lc....n.lc....n......n.lc....n.Rich..n.........................PE..L...vb.V...........!.........(.......%.......0............................................@..........................7..r....7..x....p..8.......................x....................................3..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data........P.......:..............@....qtmetad,....`.......<..............@..P.rsrc...8....p.......>..............@..@.reloc..x............B..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwb9C32.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	4.3893431495452475
Encrypted:	false
SSDEEP:	384:fA2hdc7ubuLF0liAgCe79G5WmS4aRRrfLzR7LEay9Ic6HkKE97xjSU4N8GLjdas:fxTMuNCs5C/Eay9Ic9x2UPGLha
MD5:	7CECC4BCCAC841177DB44430092D294D
SHA1:	5BFB5E5A1631A321C40403B5DE681E7B3FA3E922
SHA-256:	DCF942C82962D0F61B97F4743911565B67F0B596339AF8DB48396AA68964B171
SHA-512:	C4445B618A29B75B2904E4865921C8C3AE6E92F8BA64487D44FB591EF5E27C909BCC0A14C9849D1D880E74DC4F9F1495ABF0415494FE29F5227C90151F170E0C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I/...N...N...N...'..N....3..N.......N.......N....1..N...1..N...N..vN......N...0..N....7..N...2..N..Rich.N..........................PE..L...xb.V...........!.........Z.......k.......................................0............@................................. ...x............................ ......`...8...........................P...@............... ............................text............................... ..`.rdata..z$.......&..................@..@.data...T...........................@....idata..h...........................@..@.qtmetadh...........................@..P.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwb9C43.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*353 bytes
Category:	dropped
Size (bytes):	1445888
Entropy (8bit):	5.215810841334759
Encrypted:	false
SSDEEP:	24576:ajHdg8/85VTAg0x6CeMYGw3kOu8LcoOScDvJcp+BB0XA:aj0VTAnx6CeMYGwEcA
MD5:	831372696724EEC4DF4C5492E7FB483F
SHA1:	8FCC2594ADE7C3964F46205903C34B0D4742C5AA
SHA-256:	B9D619175DC0F127AB95DB3B6948BC485829B469BAD880CE63A3D1DF9AE594FC
SHA-512:	78134F425F18BC2A6B2F82AFA6A689216BC5792655A19B07B3373FDC03601B2CA4AEB5E30B1DF40C2A3222163A7A194B4F5DCD1EEC2B53A1A0BF691C149DF6DB
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........a..........._...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwbmp.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.841817764853426
Encrypted:	false
SSDEEP:	384:EQIH6vdFY1KdOkKCghKCyKE99jSz4rI9kb00+Q:EQIH6vxdzpgs2zQHb0XQ
MD5:	F1970AA0EB77E6923ED1D67DAFB52F9C
SHA1:	272A02F65D3DB5D483FD0BDB6CFA51E95E6FB0E2
SHA-256:	D4ED81BD346C82DB8BBF6B2711EA46694DFBBD19ADC3C9E12EC5BC2D8F9B7250
SHA-512:	33BA7D49F490A6036F919D4AB30DB63175D1E6213F09E124CD47461F2AA69DAE7268CCD0470472683642FF3A07AE70B0551E1ECFDE2189E3932B21773DA84EE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............n...n...n.......n......n......n......n......n.lc....n...o..n.lc....n.lc....n......n.lc....n.Rich..n.........................PE..L...vb.V...........!.........(.......%.......0............................................@..........................7..r....7..x....p..8.......................x....................................3..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data........P.......:..............@....qtmetad,....`.......<..............@..P.rsrc...8....p.......>..............@..@.reloc..x............B..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	4.3893431495452475
Encrypted:	false
SSDEEP:	384:fA2hdc7ubuLF0liAgCe79G5WmS4aRRrfLzR7LEay9Ic6HkKE97xjSU4N8GLjdas:fxTMuNCs5C/Eay9Ic9x2UPGLha
MD5:	7CECC4BCCAC841177DB44430092D294D
SHA1:	5BFB5E5A1631A321C40403B5DE681E7B3FA3E922
SHA-256:	DCF942C82962D0F61B97F4743911565B67F0B596339AF8DB48396AA68964B171
SHA-512:	C4445B618A29B75B2904E4865921C8C3AE6E92F8BA64487D44FB591EF5E27C909BCC0A14C9849D1D880E74DC4F9F1495ABF0415494FE29F5227C90151F170E0C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I/...N...N...N...'..N....3..N.......N.......N....1..N...1..N...N..vN......N...0..N....7..N...2..N..Rich.N..........................PE..L...xb.V...........!.........Z.......k.......................................0............@................................. ...x............................ ......`...8...........................P...@............... ............................text............................... ..`.rdata..z$.......&..................@..@.data...T...........................@....idata..h...........................@..@.qtmetadh...........................@..P.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwbmpd.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*353 bytes
Category:	dropped
Size (bytes):	1445888
Entropy (8bit):	5.215810841334759
Encrypted:	false
SSDEEP:	24576:ajHdg8/85VTAg0x6CeMYGw3kOu8LcoOScDvJcp+BB0XA:aj0VTAnx6CeMYGwEcA
MD5:	831372696724EEC4DF4C5492E7FB483F
SHA1:	8FCC2594ADE7C3964F46205903C34B0D4742C5AA
SHA-256:	B9D619175DC0F127AB95DB3B6948BC485829B469BAD880CE63A3D1DF9AE594FC
SHA-512:	78134F425F18BC2A6B2F82AFA6A689216BC5792655A19B07B3373FDC03601B2CA4AEB5E30B1DF40C2A3222163A7A194B4F5DCD1EEC2B53A1A0BF691C149DF6DB
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........a..........._...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwe9CA2.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	324608
Entropy (8bit):	6.695484648313354
Encrypted:	false
SSDEEP:	6144:lweI6fmBFAShI2q3S/fSEdZtE4k/7a0Ku0rhfaTalQbKb9PjArMxcCUZvb:l9mB6ShI2ViuZtErz10AAQh
MD5:	4C78B2447528B00AC848E8ACC1C2FFE5
SHA1:	DF0FAA4756DCDE33B48B4BC90AB8782938ECC6A1
SHA-256:	C3D9043B82AD61DFA04EB2AE43F3BDD4C8850A854DD4DFCF50BFD5BCCE7AC8C9
SHA-512:	08CF6F67E656E44F50963C30D1C8053DC9B79435D1657088795EB6D8EBA958E9336BD24FE6B1843F117F69527C16A2752A96E8D7A7825BE916BE6D4EE2930420
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.u6 ..e ..e ..e...e"..e-..e*..e-..e-..e-..e$..e-..e$..e.i.e%..e ..eL..e.i.e"..e.i.ea..e.i.e!..e-..e!..e.i.e!..eRich ..e................PE..L....b.V...........!.........j...............................................`............@.............................r.......x....0..8....................@..p.......................................@............................................text............................... ..`.rdata..n...........................@..@.data...<-..........................@....qtmetad$...........................@..P_RDATA.. .... ......................@..@.rsrc...8....0......................@..@.reloc..p....@......................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwe9CB2.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	630272
Entropy (8bit):	5.505017237867003
Encrypted:	false
SSDEEP:	6144:aYO2JBOun9nKeeSrQmNmnNei6tpgbdWBLJ6pzMjb1TqbLMIEkh1fcafz/:a/2JBOun9nKe5rFNmNMtpKdzMjut/
MD5:	B04C81EE7444138A3CB1A8D369DEDA18
SHA1:	3C198100ADC8E0159EE020690D7FAB191F45F293
SHA-256:	5C4134DBBDD8AF32B0B4E964F7607969B3DD36F80EA08538B248890F6F1ABC2D
SHA-512:	66B9441CA5A470A389DC40BED2521666DE93F5ED28EABA18C3ED6A055DA52434981DEA6FC9374960E690A918C84BCFFE0BAB06C55FB718809F0802EC9CA0F2CC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2..y\B.y\B.y\BR..B.y\B.+.B.y\B.+.B.y\B.+.B.y\B.+.B.y\B:.B.y\B.y]B.y\B:.B.y\B:.B.y\B:.B.y\B.+.B.y\B:.B.y\BRich.y\B................PE..L....b.V...........!.........".......q....................................................@.........................`.......4...x...............................d...`...8............................}..@...............4............................text............................... ..`.rdata..............................@..@.data...(............\|..............@....idata...............X..............@..@.qtmetad^............p..............@..P.rsrc................t..............@..@.reloc..'#.......$...z..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwe9CE2.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*639 bytes
Category:	dropped
Size (bytes):	2617344
Entropy (8bit):	4.940746554473438
Encrypted:	false
SSDEEP:	24576:cjHdg8/85VYSUcTgKIVlDe/O78McfOy0DvJcpAAE+ShCGa:cj0VYSLTgKIVlDir
MD5:	B97D061C5C09B704A182F5DC25C42DDC
SHA1:	42BA1663E5FA78D32ABFBC8B6CDA91F5E94F6B8B
SHA-256:	4B66FC69E45C200E72ED8A458FCDAA9B4C281CF9C6A6D637027DC2411332048D
SHA-512:	687B21A03535D99D08C5D91EE42321DFF51E7F9D9BEA42CC301942F3453B0E69B84ABB5BE2A0144E7D42C3A2FEC5CA30E2D3B1D51914CDD9A7D70C241B6CF7C4
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS.......................}...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwebp.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	324608
Entropy (8bit):	6.695484648313354
Encrypted:	false
SSDEEP:	6144:lweI6fmBFAShI2q3S/fSEdZtE4k/7a0Ku0rhfaTalQbKb9PjArMxcCUZvb:l9mB6ShI2ViuZtErz10AAQh
MD5:	4C78B2447528B00AC848E8ACC1C2FFE5
SHA1:	DF0FAA4756DCDE33B48B4BC90AB8782938ECC6A1
SHA-256:	C3D9043B82AD61DFA04EB2AE43F3BDD4C8850A854DD4DFCF50BFD5BCCE7AC8C9
SHA-512:	08CF6F67E656E44F50963C30D1C8053DC9B79435D1657088795EB6D8EBA958E9336BD24FE6B1843F117F69527C16A2752A96E8D7A7825BE916BE6D4EE2930420
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.u6 ..e ..e ..e...e"..e-..e*..e-..e-..e-..e$..e-..e$..e.i.e%..e ..eL..e.i.e"..e.i.ea..e.i.e!..e-..e!..e.i.e!..eRich ..e................PE..L....b.V...........!.........j...............................................`............@.............................r.......x....0..8....................@..p.......................................@............................................text............................... ..`.rdata..n...........................@..@.data...<-..........................@....qtmetad$...........................@..P_RDATA.. .... ......................@..@.rsrc...8....0......................@..@.reloc..p....@......................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	630272
Entropy (8bit):	5.505017237867003
Encrypted:	false
SSDEEP:	6144:aYO2JBOun9nKeeSrQmNmnNei6tpgbdWBLJ6pzMjb1TqbLMIEkh1fcafz/:a/2JBOun9nKe5rFNmNMtpKdzMjut/
MD5:	B04C81EE7444138A3CB1A8D369DEDA18
SHA1:	3C198100ADC8E0159EE020690D7FAB191F45F293
SHA-256:	5C4134DBBDD8AF32B0B4E964F7607969B3DD36F80EA08538B248890F6F1ABC2D
SHA-512:	66B9441CA5A470A389DC40BED2521666DE93F5ED28EABA18C3ED6A055DA52434981DEA6FC9374960E690A918C84BCFFE0BAB06C55FB718809F0802EC9CA0F2CC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2..y\B.y\B.y\BR..B.y\B.+.B.y\B.+.B.y\B.+.B.y\B.+.B.y\B:.B.y\B.y]B.y\B:.B.y\B:.B.y\B:.B.y\B.+.B.y\B:.B.y\BRich.y\B................PE..L....b.V...........!.........".......q....................................................@.........................`.......4...x...............................d...`...8............................}..@...............4............................text............................... ..`.rdata..............................@..@.data...(............\|..............@....idata...............X..............@..@.qtmetad^............p..............@..P.rsrc................t..............@..@.reloc..'#.......$...z..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\imageformats\qwebpd.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*639 bytes
Category:	dropped
Size (bytes):	2617344
Entropy (8bit):	4.940746554473438
Encrypted:	false
SSDEEP:	24576:cjHdg8/85VYSUcTgKIVlDe/O78McfOy0DvJcpAAE+ShCGa:cj0VYSLTgKIVlDir
MD5:	B97D061C5C09B704A182F5DC25C42DDC
SHA1:	42BA1663E5FA78D32ABFBC8B6CDA91F5E94F6B8B
SHA-256:	4B66FC69E45C200E72ED8A458FCDAA9B4C281CF9C6A6D637027DC2411332048D
SHA-512:	687B21A03535D99D08C5D91EE42321DFF51E7F9D9BEA42CC301942F3453B0E69B84ABB5BE2A0144E7D42C3A2FEC5CA30E2D3B1D51914CDD9A7D70C241B6CF7C4
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS.......................}...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\lib8816.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	987136
Entropy (8bit):	6.7994669809057475
Encrypted:	false
SSDEEP:	24576:hLcKcC0rO2s6c0k0/BMeJywAqiyOJUME:RMncDZQizS
MD5:	7EE993251D55A2EAB74340D27FF82260
SHA1:	15975F2AAF1DAB31A7B22AF068B531D806BF337E
SHA-256:	20E6D1109016042147A058F5EC45F0BCD58C290A89380E4D9EC467E98F0D99CA
SHA-512:	B9C1BF31272DDA582EC05D4BD7DD4575962D4C7AC13867785104866CD42B481320368FD9A7A36AE2EBEA38EDC726E48CEEAA3D33BD70020FBFF9AFA64D561F05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.m._.m._.m.L...X.m...2.Z.m...b.\.m.Z.0.[.m...0.X.m._.l.:.m.Z.2.t.m.Z.1.^.m.Z.7.^.m.Rich_.m.........PE..L....S.M...........!........................................................P......................................@..........x...............................d....................................................................................text.............................. ..`.rdata..............................@..@.data................n..............@....reloc...............~..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\libxml2.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	987136
Entropy (8bit):	6.7994669809057475
Encrypted:	false
SSDEEP:	24576:hLcKcC0rO2s6c0k0/BMeJywAqiyOJUME:RMncDZQizS
MD5:	7EE993251D55A2EAB74340D27FF82260
SHA1:	15975F2AAF1DAB31A7B22AF068B531D806BF337E
SHA-256:	20E6D1109016042147A058F5EC45F0BCD58C290A89380E4D9EC467E98F0D99CA
SHA-512:	B9C1BF31272DDA582EC05D4BD7DD4575962D4C7AC13867785104866CD42B481320368FD9A7A36AE2EBEA38EDC726E48CEEAA3D33BD70020FBFF9AFA64D561F05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.m._.m._.m.L...X.m...2.Z.m...b.\.m.Z.0.[.m...0.X.m._.l.:.m.Z.2.t.m.Z.1.^.m.Z.7.^.m.Rich_.m.........PE..L....S.M...........!........................................................P......................................@..........x...............................d....................................................................................text.............................. ..`.rdata..............................@..@.data................n..............@....reloc...............~..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qmi9E6A.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	5.922853492485489
Encrypted:	false
SSDEEP:	384:Wn3LnlqqkzbGROQ2mSnyX+Aqj9oiTUEFgQddok7aoQzv9hqLHon34OI9kb00Wosh:sLnXOQtXN2mQon3lHb0zo6f
MD5:	838166262327BA37E57EC8FCC026F286
SHA1:	A4816F529ECD6372CFF66DA415C12E10C2DD28C8
SHA-256:	7E056B6CEEF2CA42359D5EE4B5B8C5B68B3B30DEC3FC01F18C831040D2DB5536
SHA-512:	F4A307C9EBE7B44A3767BF2B5859126D1FEC5A32B280142E63F3EC2B51176E66CF6586B0F103A6F2015895329749900A7EB23886EB65E5EAD996B58F18FC0D27
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x...x...x....>..x...*..x......x......x...(..x..x.(..x...x...x..x....x..x.)..x...*...x..x.+..x..Rich.x..........................PE..L....,.V...........!.........R......#%.......0............................................@..........................>..u....?..x.......@...........................................................X8..@............0..d............................text............................... ..`.rdata...<...0...>..."..............@..@.data...l....p.......`..............@....qtmetad.............d..............@..P.rsrc...@............f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qmi9E7A.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78336
Entropy (8bit):	4.927792483537757
Encrypted:	false
SSDEEP:	384:0JFFfkhrWyBd8IKHTLfeLNLSSSfgHyPSSys9IS2NSSOAHcE6KtPPE6vEdAm++UIw:0JIhr8IqTLeLSL1Evg10Bn9bzKvgqHo
MD5:	9AC0D042945C7EE429B049E70B6213CF
SHA1:	3CC294D5C0F1E63A3E9B7076801DE19204044669
SHA-256:	3285045CD08A6FB8F7421A0372C127F8E34CA1E534C58A85E115933CC554ABF0
SHA-512:	1D1199E2F9E4695C45E02E1C787B47017791D3FF04C559AA75278EC692E5AE9F32982F618F4D2446C694BE2322CAED8D08EFAE35DFA2EB21452253FA1E96CCC3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...F..F..F.N+...F.....F.....F.....F.....F.&J...F..G.w.F.&J...F.&J...F.....F.&J...F.Rich..F.........PE..L....,.V...........!................Pc.......................................p............@.....................................x....P.......................`..$...p...8...............................@............................................text............................... ..`.rdata..=N.......P..................@..@.data...$...........................@....idata...;.......<..................@..@.qtmetadF....@......................@..P.rsrc........P......."..............@..@.reloc.......`.......(..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qmi9F08.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*701 bytes
Category:	dropped
Size (bytes):	2871296
Entropy (8bit):	5.417479780296388
Encrypted:	false
SSDEEP:	49152:3jLVeeqeh6lTBf5gE3tLrr50195uaNnum05GY3mAtdxnVDdN1xlzhicb2:oX
MD5:	271A7327375AC92EAFD73BC584C6957A
SHA1:	9D1E26F8D6E624CCB613639AB1722BF8DBD095C3
SHA-256:	7E94AB0773BCB194DADBD70FD2DF4D25DFF236313EE26F2F05E185CC8084716A
SHA-512:	2C14CBFE52AF40403946D0BB763EECF7A772FFCC74C7012EAEECED6BF5A9A9043BF1C8DB27918828839463D56C592B7F2E60C3989F68C35E9D85D9997843A697
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qminimal.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	5.922853492485489
Encrypted:	false
SSDEEP:	384:Wn3LnlqqkzbGROQ2mSnyX+Aqj9oiTUEFgQddok7aoQzv9hqLHon34OI9kb00Wosh:sLnXOQtXN2mQon3lHb0zo6f
MD5:	838166262327BA37E57EC8FCC026F286
SHA1:	A4816F529ECD6372CFF66DA415C12E10C2DD28C8
SHA-256:	7E056B6CEEF2CA42359D5EE4B5B8C5B68B3B30DEC3FC01F18C831040D2DB5536
SHA-512:	F4A307C9EBE7B44A3767BF2B5859126D1FEC5A32B280142E63F3EC2B51176E66CF6586B0F103A6F2015895329749900A7EB23886EB65E5EAD996B58F18FC0D27
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x...x...x....>..x...*..x......x......x...(..x..x.(..x...x...x..x....x..x.)..x...*...x..x.+..x..Rich.x..........................PE..L....,.V...........!.........R......#%.......0............................................@..........................>..u....?..x.......@...........................................................X8..@............0..d............................text............................... ..`.rdata...<...0...>..."..............@..@.data...l....p.......`..............@....qtmetad.............d..............@..P.rsrc...@............f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qminimald.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78336
Entropy (8bit):	4.927792483537757
Encrypted:	false
SSDEEP:	384:0JFFfkhrWyBd8IKHTLfeLNLSSSfgHyPSSys9IS2NSSOAHcE6KtPPE6vEdAm++UIw:0JIhr8IqTLeLSL1Evg10Bn9bzKvgqHo
MD5:	9AC0D042945C7EE429B049E70B6213CF
SHA1:	3CC294D5C0F1E63A3E9B7076801DE19204044669
SHA-256:	3285045CD08A6FB8F7421A0372C127F8E34CA1E534C58A85E115933CC554ABF0
SHA-512:	1D1199E2F9E4695C45E02E1C787B47017791D3FF04C559AA75278EC692E5AE9F32982F618F4D2446C694BE2322CAED8D08EFAE35DFA2EB21452253FA1E96CCC3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...F..F..F.N+...F.....F.....F.....F.....F.&J...F..G.w.F.&J...F.&J...F.....F.&J...F.Rich..F.........PE..L....,.V...........!................Pc.......................................p............@.....................................x....P.......................`..$...p...8...............................@............................................text............................... ..`.rdata..=N.......P..................@..@.data...$...........................@....idata...;.......<..................@..@.qtmetadF....@......................@..P.rsrc........P......."..............@..@.reloc.......`.......(..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qminimald.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*701 bytes
Category:	dropped
Size (bytes):	2871296
Entropy (8bit):	5.417479780296388
Encrypted:	false
SSDEEP:	49152:3jLVeeqeh6lTBf5gE3tLrr50195uaNnum05GY3mAtdxnVDdN1xlzhicb2:oX
MD5:	271A7327375AC92EAFD73BC584C6957A
SHA1:	9D1E26F8D6E624CCB613639AB1722BF8DBD095C3
SHA-256:	7E94AB0773BCB194DADBD70FD2DF4D25DFF236313EE26F2F05E185CC8084716A
SHA-512:	2C14CBFE52AF40403946D0BB763EECF7A772FFCC74C7012EAEECED6BF5A9A9043BF1C8DB27918828839463D56C592B7F2E60C3989F68C35E9D85D9997843A697
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qofA0BE.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	547328
Entropy (8bit):	6.420150013421032
Encrypted:	false
SSDEEP:	12288:0nz6WzpibWqKYixABfX+P/kUdIVGYOk8GulpYnjIraFfEWmM:0nzxaOYcndIbAp1a+Z
MD5:	8A4AA2CED2E95848335787A1B64E8250
SHA1:	41DF6CB974BDAB2CE26CCE313A9D16B9D10D3C35
SHA-256:	878F0E0AEB9490728E4B771FDAF6B46DD427C2AAC4366384F2C3CB50E5795E19
SHA-512:	484BC2E682DB75DBC937A9E9A0BEFEBCB54B7B80F9FEC96C26E590A3BCA50932D6F7046F60DA2D80D81ED0E6DE5AB714CF63C805EE13DAD746900C9630AE2B38
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%[..D5..D5..D5.P....D5....D5.....D5....D5.....D5.8..D5..D4..E5.8...D5.8...D5.8..D5....D5.8..D5.Rich.D5.........................PE..L....,.V...........!......................................................................@.........................`...w.......x....p..H........................#..................................p...@............... ............................text...]........................... ..`.rdata..............................@..@.data...D....P.......*..............@....qtmetad.....`.......0..............@..P.rsrc...H....p.......2..............@..@.reloc...#.......$...6..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qofA0FE.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1005056
Entropy (8bit):	5.622345867432529
Encrypted:	false
SSDEEP:	12288:GIQe6sft6PLlmIFz7WNHtZEwIdFwcVAMPvafEWma:+7sftG5PZAPzIdecVAOfZa
MD5:	9D268F952A446602DD2F326865A3EAD4
SHA1:	DFB5396C48C367E3909BDF57E12BD7080177531D
SHA-256:	7CDBA29C2ED20C9D0DF6D5FD812DA3B90D5BEC130A1D7597913814EA14A8EF36
SHA-512:	3B2F6E2AD90B22F58FB159BB72A893CF8A51990F1716F8C739B90ED94E22F3B4041BD9E12C03C43E1BBCEAB80453CB61297F13E8EFDDD9F9B28D00EED77F6C71
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............qQ..qQ..qQb..Q..qQ...Q..qQ...Q..qQ...Q..qQ...Q..qQ.`.Q..qQ..pQ..qQ.`.Q..qQ.`.Q..qQ.`.Q..qQ...Q..qQ.`.Q..qQRich..qQ................PE..L....,.V...........!.....V...................p............................................@......................... ...........x....P.......................`...)...w..8...........................`...@............................................text....T.......V.................. ..`.rdata...(...p...*...Z..............@..@.data............,..................@....idata...f.......h..................@..@.qtmetadK....@......................@..P.rsrc........P......................@..@.reloc..`3...`...4..."..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qofA16C.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*1307 bytes
Category:	dropped
Size (bytes):	5353472
Entropy (8bit):	5.358395934149231
Encrypted:	false
SSDEEP:	49152:EjLVefjbk6ogjrC6myZQogjPqtDo/rTP612qRmYM/+BnpcVC1SWbRoD05w5mTKx/:DBNT
MD5:	DC17A38D9E62F90EAA6B250D82E14919
SHA1:	3CC4416EA6E8B206FF38896F88501B03724C8D46
SHA-256:	7D5A6569BA74E25484B86BE81BC28613194AE7E60D40D452EC10E98665FC4C6D
SHA-512:	5FD5A57D4235273B77977D04B2E42F5E2BF773003CF10FFB7F51F4AC22EDB8EDEB8753289FDDBECB621D7BAE3540D6E9EF343534E29E10BF413F4FE2D39E0600
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qoffscreen.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	547328
Entropy (8bit):	6.420150013421032
Encrypted:	false
SSDEEP:	12288:0nz6WzpibWqKYixABfX+P/kUdIVGYOk8GulpYnjIraFfEWmM:0nzxaOYcndIbAp1a+Z
MD5:	8A4AA2CED2E95848335787A1B64E8250
SHA1:	41DF6CB974BDAB2CE26CCE313A9D16B9D10D3C35
SHA-256:	878F0E0AEB9490728E4B771FDAF6B46DD427C2AAC4366384F2C3CB50E5795E19
SHA-512:	484BC2E682DB75DBC937A9E9A0BEFEBCB54B7B80F9FEC96C26E590A3BCA50932D6F7046F60DA2D80D81ED0E6DE5AB714CF63C805EE13DAD746900C9630AE2B38
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%[..D5..D5..D5.P....D5....D5.....D5....D5.....D5.8..D5..D4..E5.8...D5.8...D5.8..D5....D5.8..D5.Rich.D5.........................PE..L....,.V...........!......................................................................@.........................`...w.......x....p..H........................#..................................p...@............... ............................text...]........................... ..`.rdata..............................@..@.data...D....P.......*..............@....qtmetad.....`.......0..............@..P.rsrc...H....p.......2..............@..@.reloc...#.......$...6..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qoffscreend.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1005056
Entropy (8bit):	5.622345867432529
Encrypted:	false
SSDEEP:	12288:GIQe6sft6PLlmIFz7WNHtZEwIdFwcVAMPvafEWma:+7sftG5PZAPzIdecVAOfZa
MD5:	9D268F952A446602DD2F326865A3EAD4
SHA1:	DFB5396C48C367E3909BDF57E12BD7080177531D
SHA-256:	7CDBA29C2ED20C9D0DF6D5FD812DA3B90D5BEC130A1D7597913814EA14A8EF36
SHA-512:	3B2F6E2AD90B22F58FB159BB72A893CF8A51990F1716F8C739B90ED94E22F3B4041BD9E12C03C43E1BBCEAB80453CB61297F13E8EFDDD9F9B28D00EED77F6C71
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............qQ..qQ..qQb..Q..qQ...Q..qQ...Q..qQ...Q..qQ...Q..qQ.`.Q..qQ..pQ..qQ.`.Q..qQ.`.Q..qQ.`.Q..qQ...Q..qQ.`.Q..qQRich..qQ................PE..L....,.V...........!.....V...................p............................................@......................... ...........x....P.......................`...)...w..8...........................`...@............................................text....T.......V.................. ..`.rdata...(...p...*...Z..............@..@.data............,..................@....idata...f.......h..................@..@.qtmetadK....@......................@..P.rsrc........P......................@..@.reloc..`3...`...4..."..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qoffscreend.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*1307 bytes
Category:	dropped
Size (bytes):	5353472
Entropy (8bit):	5.358395934149231
Encrypted:	false
SSDEEP:	49152:EjLVefjbk6ogjrC6myZQogjPqtDo/rTP612qRmYM/+BnpcVC1SWbRoD05w5mTKx/:DBNT
MD5:	DC17A38D9E62F90EAA6B250D82E14919
SHA1:	3CC4416EA6E8B206FF38896F88501B03724C8D46
SHA-256:	7D5A6569BA74E25484B86BE81BC28613194AE7E60D40D452EC10E98665FC4C6D
SHA-512:	5FD5A57D4235273B77977D04B2E42F5E2BF773003CF10FFB7F51F4AC22EDB8EDEB8753289FDDBECB621D7BAE3540D6E9EF343534E29E10BF413F4FE2D39E0600
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qwiA296.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1020928
Entropy (8bit):	6.637209169942716
Encrypted:	false
SSDEEP:	24576:zIqDMndk36C66mKncbHaxw5XaO7eN2ZNL:cm4Wm6NcDaaNL
MD5:	7F4EAA37E14A5616F0EFCCAE3E103D0B
SHA1:	E68DEA532DF07CC40C203596297A45B8350FF9C8
SHA-256:	24CD825C14F434CA31316FE2B3E581799BBD87C1D5ACDA2E1D6645274B9E76D0
SHA-512:	AAB85A923FC4F58A871287C7F046DF6BC83538B3F196ACEF9C53EB152F371FA40996564EB594FEC9631957EBC9F4B7D4081607BBD20BEBE88EE94960CA0E9886
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........9.UYX..YX..YX....V.]X..T.h.QX..T.W.TX....y.^X..T.j.]X..T.V.\X....j.]X....g.XX....\|.JX..YX...]....W.@X....V.wX....k.XX..T.l.XX....i.XX..RichYX..................PE..L....-.V...........!.....\...X.......\.......p............................................@.........................@...u............@..@....................P.........................................@............p...............................text....Z.......\.................. ..`.rdata..Hz...p...\|...`..............@..@.data....=..........................@....qtmetad.....0......................@..P.rsrc...@....@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qwiA2F5.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2043904
Entropy (8bit):	5.93027641048304
Encrypted:	false
SSDEEP:	24576:Hfma7DW+TeDjVDFmPQIi5gsKzxw5IBvmZfeLNrH:HePPVIPQFmxYIa6r
MD5:	89B55AF5E263C02EDB6A8F709C64E4C2
SHA1:	EEF5B5A6403FC9B908779E1734A0C080D626EB06
SHA-256:	0F81E1DBA4200EBBE2E5FC250E49A735BEA2F56B8E9B28E2CD45BDD0B700F678
SHA-512:	3DC030A47D83799ED804C90D3BE8C03D5B3190A71E8CABB5808D68608E83BE98318B2132D80E7C9A372B069E72A112628312142394D8FC590B89AC739D75ED1F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........n.q.=.q.=.q.=. =.q.=.#.=.q.=.#+=.q.=b..=.q.=.#.=.q.=.#=.q.=...=.q.=b..=.q.=b..=.q.=.q.=.w.=..+=.q.=..*=.q.=...=.q.=.#.=.q.=...=.q.=Rich.q.=........PE..L....-.V...........!.....`...................p............................................@.........................`.......h@..................................8....z..8...........................p...@............ ..h ...........................text...._.......`.................. ..`.rdata...8...p...:...d..............@..@.data....o.......D..................@....idata...c... ...d..................@..@.qtmetadF............F..............@..P.rsrc................J..............@..@.reloc...............P..............@..B................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qwiA344.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*3135 bytes
Category:	dropped
Size (bytes):	12840960
Entropy (8bit):	5.549178033344311
Encrypted:	false
SSDEEP:	49152:xbEJXAXvOjYXJbl7R7WdwIx1Blzbe5Q1pVnqgxUgePpYmA7gIEQ8N1joHfGsjRtp:bj1PvhQPUA6oSsVmmlUgBw7RYmC
MD5:	39D6B99777905BC9DFB6D03A727941BC
SHA1:	14632BA62DB63AEC6066485DCD3B0F4EBEF9134B
SHA-256:	FB1F325AD7987093F5FCB65CD4AFF4208B6A592DF05581E8F7394BA1456C0F8E
SHA-512:	7148A10E0CEFCB1A8133C068528159D387814F13537E0ADE335E6C279F9CAB7069F7CCB92AFD7676250823503AFB8D4266C5BA094820030CAFE4634A911CBD9A
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........?...@3......=...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qwindows.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1020928
Entropy (8bit):	6.637209169942716
Encrypted:	false
SSDEEP:	24576:zIqDMndk36C66mKncbHaxw5XaO7eN2ZNL:cm4Wm6NcDaaNL
MD5:	7F4EAA37E14A5616F0EFCCAE3E103D0B
SHA1:	E68DEA532DF07CC40C203596297A45B8350FF9C8
SHA-256:	24CD825C14F434CA31316FE2B3E581799BBD87C1D5ACDA2E1D6645274B9E76D0
SHA-512:	AAB85A923FC4F58A871287C7F046DF6BC83538B3F196ACEF9C53EB152F371FA40996564EB594FEC9631957EBC9F4B7D4081607BBD20BEBE88EE94960CA0E9886
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........9.UYX..YX..YX....V.]X..T.h.QX..T.W.TX....y.^X..T.j.]X..T.V.\X....j.]X....g.XX....\|.JX..YX...]....W.@X....V.wX....k.XX..T.l.XX....i.XX..RichYX..................PE..L....-.V...........!.....\...X.......\.......p............................................@.........................@...u............@..@....................P.........................................@............p...............................text....Z.......\.................. ..`.rdata..Hz...p...\|...`..............@..@.data....=..........................@....qtmetad.....0......................@..P.rsrc...@....@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qwindowsd.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2043904
Entropy (8bit):	5.93027641048304
Encrypted:	false
SSDEEP:	24576:Hfma7DW+TeDjVDFmPQIi5gsKzxw5IBvmZfeLNrH:HePPVIPQFmxYIa6r
MD5:	89B55AF5E263C02EDB6A8F709C64E4C2
SHA1:	EEF5B5A6403FC9B908779E1734A0C080D626EB06
SHA-256:	0F81E1DBA4200EBBE2E5FC250E49A735BEA2F56B8E9B28E2CD45BDD0B700F678
SHA-512:	3DC030A47D83799ED804C90D3BE8C03D5B3190A71E8CABB5808D68608E83BE98318B2132D80E7C9A372B069E72A112628312142394D8FC590B89AC739D75ED1F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........n.q.=.q.=.q.=. =.q.=.#.=.q.=.#+=.q.=b..=.q.=.#.=.q.=.#=.q.=...=.q.=b..=.q.=b..=.q.=.q.=.w.=..+=.q.=..*=.q.=...=.q.=.#.=.q.=...=.q.=Rich.q.=........PE..L....-.V...........!.....`...................p............................................@.........................`.......h@..................................8....z..8...........................p...@............ ..h ...........................text...._.......`.................. ..`.rdata...8...p...:...d..............@..@.data....o.......D..................@....idata...c... ...d..................@..@.qtmetadF............F..............@..P.rsrc................J..............@..@.reloc...............P..............@..B................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\platforms\qwindowsd.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*3135 bytes
Category:	dropped
Size (bytes):	12840960
Entropy (8bit):	5.549178033344311
Encrypted:	false
SSDEEP:	49152:xbEJXAXvOjYXJbl7R7WdwIx1Blzbe5Q1pVnqgxUgePpYmA7gIEQ8N1joHfGsjRtp:bj1PvhQPUA6oSsVmmlUgBw7RYmC
MD5:	39D6B99777905BC9DFB6D03A727941BC
SHA1:	14632BA62DB63AEC6066485DCD3B0F4EBEF9134B
SHA-256:	FB1F325AD7987093F5FCB65CD4AFF4208B6A592DF05581E8F7394BA1456C0F8E
SHA-512:	7148A10E0CEFCB1A8133C068528159D387814F13537E0ADE335E6C279F9CAB7069F7CCB92AFD7676250823503AFB8D4266C5BA094820030CAFE4634A911CBD9A
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........?...@3......=...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\plugins\skins\ComA87F.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1051648
Entropy (8bit):	5.914353201037196
Encrypted:	false
SSDEEP:	6144:WzR8SEZriDvMlKC9+A11VatifWW/dLSr2xZlryQ:WR8B7fD7e6xZ
MD5:	83A4565BC4D44448410E0836F341AD74
SHA1:	9E01BEF376FB7E7605B3494C6896D23E17D0E7C0
SHA-256:	ED0C33FDA60BE43EC7FBA8D8A93A3E5AF14AA38DB60252499E86E49BBA1F1547
SHA-512:	D652AED74350E86B54C6420D7746E3EF81E4F6DD1E2DBCB1B5F7255142BDB2D070E7A296F9180679693E47883C8715AE5F2BAC88081457BF262ECA9D7E63CEBE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S.].=.].=.].=.P..._.=.P...Q.=.P...Y.=.P...Y.=.r.._.=.....^.=.].<...=.....Y.=.....\.=.P...\.=.....\.=.Rich].=.........PE..L...[..[...........!.....z...........I.......................................`............@.....................................d....0..F....................@......@...8...............................@............................................text....y.......z.................. ..`.rdata..~`.......b...~..............@..@.data...$...........................@....idata..V...........................@..@.qtmetad..... ......................@..P.rsrc...F....0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\plugins\skins\ComA8AE.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	768512
Entropy (8bit):	5.96173506861599
Encrypted:	false
SSDEEP:	3072:7piKiG3HDrL8M8YdZRdFb45tRvKjGFSTtVQFbv1VD4V5SedfLBHSUSHRr1VD4blL:7vr78M8EZrkPYGELar2xZrK9M2G
MD5:	491212D3AED4213F72544077A5E37A43
SHA1:	D79F32DE6EB4672F24EEDC51A0B915E14BD9BE3C
SHA-256:	2765476CB9282D410575898753C36458FEDFF66AED95AC61E49F3CE31F856758
SHA-512:	CD00596227406983962D3BDDF1237BB8ADA2C10EA43745414D46E574E6D4D8C25B0A7ABE42FD9E06F2A648B2172A02C0A2EB629C265E5A73EA6400E960183B81
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.\|HC.\|HC.\|HN..HB.\|HN..HO.\|HN..HG.\|HN..HG.\|H...HA.\|H.w.H@.\|HC.}H..\|H.w.HG.\|H.w.HB.\|HN..HB.\|H.w.HB.\|HRichC.\|H........................PE..L...V.HX...........!.........&.......^....................................................@......................... .......(...d.......F...........................p...8...............................@...............(............................text...T........................... ..`.rdata..............................@..@.data...,...........................@....idata..e...........................@..@.qtmetad............................@..P.rsrc...F...........................@..@.reloc..@...........................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\plugins\skins\CommonSkin.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1051648
Entropy (8bit):	5.914353201037196
Encrypted:	false
SSDEEP:	6144:WzR8SEZriDvMlKC9+A11VatifWW/dLSr2xZlryQ:WR8B7fD7e6xZ
MD5:	83A4565BC4D44448410E0836F341AD74
SHA1:	9E01BEF376FB7E7605B3494C6896D23E17D0E7C0
SHA-256:	ED0C33FDA60BE43EC7FBA8D8A93A3E5AF14AA38DB60252499E86E49BBA1F1547
SHA-512:	D652AED74350E86B54C6420D7746E3EF81E4F6DD1E2DBCB1B5F7255142BDB2D070E7A296F9180679693E47883C8715AE5F2BAC88081457BF262ECA9D7E63CEBE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S.].=.].=.].=.P..._.=.P...Q.=.P...Y.=.P...Y.=.r.._.=.....^.=.].<...=.....Y.=.....\.=.P...\.=.....\.=.Rich].=.........PE..L...[..[...........!.....z...........I.......................................`............@.....................................d....0..F....................@......@...8...............................@............................................text....y.......z.................. ..`.rdata..~`.......b...~..............@..@.data...$...........................@....idata..V...........................@..@.qtmetad..... ......................@..P.rsrc...F....0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\plugins\skins\CommonSkin_D.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	768512
Entropy (8bit):	5.96173506861599
Encrypted:	false
SSDEEP:	3072:7piKiG3HDrL8M8YdZRdFb45tRvKjGFSTtVQFbv1VD4V5SedfLBHSUSHRr1VD4blL:7vr78M8EZrkPYGELar2xZrK9M2G
MD5:	491212D3AED4213F72544077A5E37A43
SHA1:	D79F32DE6EB4672F24EEDC51A0B915E14BD9BE3C
SHA-256:	2765476CB9282D410575898753C36458FEDFF66AED95AC61E49F3CE31F856758
SHA-512:	CD00596227406983962D3BDDF1237BB8ADA2C10EA43745414D46E574E6D4D8C25B0A7ABE42FD9E06F2A648B2172A02C0A2EB629C265E5A73EA6400E960183B81
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.\|HC.\|HC.\|HN..HB.\|HN..HO.\|HN..HG.\|HN..HG.\|H...HA.\|H.w.H@.\|HC.}H..\|H.w.HG.\|H.w.HB.\|HN..HB.\|H.w.HB.\|HRichC.\|H........................PE..L...V.HX...........!.........&.......^....................................................@......................... .......(...d.......F...........................p...8...............................@...............(............................text...T........................... ..`.rdata..............................@..@.data...,...........................@....idata..e...........................@..@.qtmetad............................@..P.rsrc...F...........................@..@.reloc..@...........................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\plugins\styles\ComA8DE.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	3.9415927211067303
Encrypted:	false
SSDEEP:	384:w3WFKZZZK+8JetYXAaKAqQMnEkxH5cXDvPcDqSGLHGdkQvPhypJNL7Q5Q2K5I9/S:wP8WYunHZczMEHGew65QROMQLsW
MD5:	0B82D6F14F833FFD7E09B20149D43A65
SHA1:	BD42D9E1E9BD862F5D6BC2B3D0D7B14515F610EC
SHA-256:	08ED99DE40BCA156FB19D693E972350AD3421BEC2D869783F6EC127722ACBEF5
SHA-512:	647C913DC6A88189D2DDC0C53B69D3A742DA428FBE54F49DCD3A97E749284C8547CBD315E3394A88B3AA2015B68BF00ECD1D60B34B3BE8EC63042D1E5C231736
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Oa5.!25.!25.!28..27.!28..29.!28..21.!28..21.!2...27.!2.l.22.!25. 2W.!2.l.21.!2.l.24.!28..24.!2.l.24.!2Rich5.!2........PE..L...[..[...........!.........T......*M....................................... ............@.............................................<...........................0...8...............................@............................................text.../~.......................... ..`.rdata... ......."..................@..@.data...............................@....idata..............................@..@.qtmetad............................@..P.rsrc...<...........................@..@.reloc..'...........................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\plugins\styles\ComA8DF.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	4.321547893439222
Encrypted:	false
SSDEEP:	768:/6E5RkqLgcbx7qPHSTfVT4ngzlCHRGLbfWU:+Igy7YHST9T4ngzlCHRGW
MD5:	496D734FB65D5590E8273A62DF908492
SHA1:	F67F819157308E3B1A1052987624DDE182131D49
SHA-256:	2C435206FFB3ECC8ECA5E6007DDA28C3FA141C113783711DCF42D20B4749EB9C
SHA-512:	300E74057A4EB3DDAAD5D6EE8CE565F30114799576BBA780DB6E1D6E591235619E0D368284FF80C3944E42F97E84D0E286FDAB54C0AC813131A9323BF89D0730
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[/1c.N_0.N_0.N_0...0.N_0...0.N_0...0.N_0...0.N_0..0.N_0..0.N_0.N^0mN_0..0.N_0..0.N_0...0.N_0..0.N_0Rich.N_0................PE..L...=mGX...........!.........l......pe.......................................P............@................................. ........0..<....................@..........8...........................0...@............... ............................text...%........................... ..`.rdata..B3.......4..................@..@.data...............................@....idata..=...........................@..@.qtmetad..... ......................@..P.rsrc...<....0......................@..@.reloc..Y....@......................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\plugins\styles\CommonStyle.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	3.9415927211067303
Encrypted:	false
SSDEEP:	384:w3WFKZZZK+8JetYXAaKAqQMnEkxH5cXDvPcDqSGLHGdkQvPhypJNL7Q5Q2K5I9/S:wP8WYunHZczMEHGew65QROMQLsW
MD5:	0B82D6F14F833FFD7E09B20149D43A65
SHA1:	BD42D9E1E9BD862F5D6BC2B3D0D7B14515F610EC
SHA-256:	08ED99DE40BCA156FB19D693E972350AD3421BEC2D869783F6EC127722ACBEF5
SHA-512:	647C913DC6A88189D2DDC0C53B69D3A742DA428FBE54F49DCD3A97E749284C8547CBD315E3394A88B3AA2015B68BF00ECD1D60B34B3BE8EC63042D1E5C231736
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Oa5.!25.!25.!28..27.!28..29.!28..21.!28..21.!2...27.!2.l.22.!25. 2W.!2.l.21.!2.l.24.!28..24.!2.l.24.!2Rich5.!2........PE..L...[..[...........!.........T......*M....................................... ............@.............................................<...........................0...8...............................@............................................text.../~.......................... ..`.rdata... ......."..................@..@.data...............................@....idata..............................@..@.qtmetad............................@..P.rsrc...<...........................@..@.reloc..'...........................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\plugins\styles\CommonStyle_D.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	4.321547893439222
Encrypted:	false
SSDEEP:	768:/6E5RkqLgcbx7qPHSTfVT4ngzlCHRGLbfWU:+Igy7YHST9T4ngzlCHRGW
MD5:	496D734FB65D5590E8273A62DF908492
SHA1:	F67F819157308E3B1A1052987624DDE182131D49
SHA-256:	2C435206FFB3ECC8ECA5E6007DDA28C3FA141C113783711DCF42D20B4749EB9C
SHA-512:	300E74057A4EB3DDAAD5D6EE8CE565F30114799576BBA780DB6E1D6E591235619E0D368284FF80C3944E42F97E84D0E286FDAB54C0AC813131A9323BF89D0730
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[/1c.N_0.N_0.N_0...0.N_0...0.N_0...0.N_0...0.N_0..0.N_0..0.N_0.N^0mN_0..0.N_0..0.N_0...0.N_0..0.N_0Rich.N_0................PE..L...=mGX...........!.........l......pe.......................................P............@................................. ........0..<....................@..........8...........................0...@............... ............................text...%........................... ..`.rdata..B3.......4..................@..@.data...............................@....idata..=...........................@..@.qtmetad..... ......................@..P.rsrc...<....0......................@..@.reloc..Y....@......................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA549.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	689664
Entropy (8bit):	6.6867796543180775
Encrypted:	false
SSDEEP:	12288:9SQRllSaqu2R1CuF3p9PsIixqvtDcm91qWQePjmPl8+y3yRighALfxQJv:w83SdLR1CuDN6sc01qOPeny3yRidLf
MD5:	BE4901DC54B5DE34E5C7099374FF15DC
SHA1:	97F9C280E84685C97E2652E0B43BD190B4694407
SHA-256:	B0337AC5E5F268998E23F6651A180C876907047D20C3603DB09C997B73B3E51D
SHA-512:	142D4FD32281C8D3A82D3C850F8E17D962F4DA5CA8BB21A90FE502489B0A72A1C7CA26662C45CA3B0FE605F49547DC57EB580E024CAD707E329B0C2E5027F889
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.............!P......D......{......z......F....@F..........@{....@z....@G......@....@E....Rich...........................PE..L....,.V...........!.....:...P......sA.......P............................................@.............................t...T...x....p..@........................C..................................H...@............P..X............................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data........@.......(..............@....qtmetad.....`.......<..............@..P.rsrc...@....p.......>..............@..@.reloc...C.......D...B..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA579.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1022464
Entropy (8bit):	5.653813868662224
Encrypted:	false
SSDEEP:	24576:gQxUKE1mflSfnqeeXFlAhPlu1AMFJ6GvYP/Sd/42:qUA/eXFAsfFj3x
MD5:	C57F418CC1A195F7CF74931029598E25
SHA1:	13603642C0EE985031D37645CD32F47B9B307ACC
SHA-256:	40BE27696A886F3435F4E2474FC9E1FC6A476F25CF7F7148EB4D424FACA9F8B7
SHA-512:	E58FABA3237765D9DBDDA2B04CD83A3332974ACD17BD48FD72F7F29F44A70163183FAA11271C092F59980E2545E1529D29FDE70305F431DA5A7D031978305308
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................4*..............)......(............\K..............\K).....\K(.....\K.............\K......Rich............................PE..L....,.V...........!................`.....................................................@..........................p......tF..x................................3......8............................^..@............@..t............................text............................... ..`.rdata..............................@..@.data................f..............@....idata...7...@...8..................@..@.qtmetad.............R..............@..P.rsrc................V..............@..@.reloc...<.......>...\..............@..B........................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA5B8.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*807 bytes
Category:	dropped
Size (bytes):	3305472
Entropy (8bit):	5.20428851057236
Encrypted:	false
SSDEEP:	49152:djCxxsYVaqwHHDj/YeOEahApG7XKo+iPxY/lNmJzKj:u7XKo+uxY/lNmJzKj
MD5:	F1FC33C2E41AC7F1CB382F1EC6E28485
SHA1:	A7C60A1CEFAB4A8A3839017A8DCB956249285FD7
SHA-256:	E40A4D1128CE8FDFBB496280F5940F07ABFB096AD171550FD0991CC85F6CF12F
SHA-512:	0690CA6803F3F312E7BF60C5A73652630D3D11259E3208659366BD176806D5E3EAC5117CD149849DE577FEA9D68E582629BA7AC158718577631B00AEA6CEBA5B
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........'...\.......&...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA636.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49664
Entropy (8bit):	6.319449367453344
Encrypted:	false
SSDEEP:	768:7brDhGPFMaH7xpKmJUaHkfs0Pz7kZZBmhZmEKi1pOJe1b0zvJy8:jda5H7qmhR0Pz7mZBQyi1p4ibgvJ
MD5:	1353C12C14BA3F68A485365E4C3FFD67
SHA1:	B3761D63D78D493D7C3E3C6ABEC6ABE52A3B3559
SHA-256:	5EEB1591711B3A9D55A6374EEF1C80D4E8844D25206223CF0F2CADE45823B80D
SHA-512:	21FF85D91F80BD2B03FE3A6169D7110AC2BCFC8ABCF258D89C8BDBB2F2ACC6FB46778C3EB8F01FD92FBA0B2E6B4A661B14969D4323FF976BE3CAC972E0490066
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.x..............h.........................................................%................................Rich............................PE..L....,.V...........!.....f...\.......m....................................................@.............................v...............@.......................@......................................@............................................text....d.......f.................. ..`.rdata...@.......B...j..............@..@.data...............................@....qtmetad............................@..P.rsrc...@...........................@..@.reloc..@...........................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA647.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	5.416266490396551
Encrypted:	false
SSDEEP:	1536:3Mw+ynYjzh21B4bZOjITECQQWKw9oPr1dkAHIOw1+IZkMzOX:33not21+bZOj2QQW59WkAoOw1+EzO
MD5:	9E8C0ABF2E31BB7AAE75345912CFEDC6
SHA1:	E7CAE55563EDD6FD58CC63755F11A5855270EBB9
SHA-256:	7783BA5FB7D2DF1C1660D90A8313B499DC49A76C507AE40BBE53FB1146722442
SHA-512:	470B1526AA1DCC99A34F68E12BAF13D62D5307D2B5D608F4E6EE57C583BBE203F019C24361F40D235B7AA7E907B0E17340616D9A736C8C77D21E5F5152807C32
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9..rW..rW..rW.6....rW.. ...rW.. ...rW.. ...rW.. ...rW.^...rW......rW..rV..sW.^...rW.^...rW.. ...rW.^...rW.Rich.rW.................PE..L....,.V...........!.....>..........`........P...............................@............@.........................`........................................ ..`....W..8...........................`...@............................................text....<.......>.................. ..`.rdata...[...P...\...B..............@..@.data...............................@....idata...=.......>..................@..@.qtmetad8...........................@..P.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA657.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*483 bytes
Category:	dropped
Size (bytes):	1978368
Entropy (8bit):	5.315537065727486
Encrypted:	false
SSDEEP:	24576:GjmXSO9AWpJIeIkyOyulkSOq8jcGO2nm99DSTvhrlOCvhzGr/wMAdGXekH:GjCpJIeIkyOylzDhroCvhzGr/wMAdGX
MD5:	FF58A6B96B8842A7B9A6CAB71D722ACD
SHA1:	E315DD83A12C49D951E4FEEF87BC510E94610671
SHA-256:	2F4750BA03AFE66A56C8CA2D382C4569BF0AFFE0C5F251C1B99A9A4945CBD696
SHA-512:	264D3B826CF413DA916B092B0BB0BF1126E5B4FB57F492E4F4A4C1E886BC91C872C3138D42E8815C7C67CAA7DA7819AEBBFA0908D28185F5BC1CB6B4220D9345
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...............(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA6B6.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	6.327985366880436
Encrypted:	false
SSDEEP:	1536:x0iS+yJRxIrVk2+0MQz/AOCNCmjLH4CQ/iN5FwUF/uHm:uiS+yJRxIrVkP0prwCmjLYTuLF/uHm
MD5:	B10D850BC7CC3CA2A78866854795B1AA
SHA1:	0494B1351AA844EF6CDF3BEBCCE1E4B956A853A9
SHA-256:	522DC5D5E02B614471D2DB958A588C83F08B89AF3A59C419A800BE7EA1101C15
SHA-512:	4B015163A57049713DF14CC15A22491F4684A4DAD56E2D8DD4C918CACB4BF32BE6CD78795046F7085C8900665C51897CC1A4162ACD6726120948A0F43051D8C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..4..4..4..i...4......4......4......4......4.l....4.....4..5...4.l....4.l....4......4.l....4.Rich.4.........................PE..L....,.V...........!.....h...l.......p....................................................@.........................@...u...............@...............................................................@...............p............................text....g.......h.................. ..`.rdata..ZN.......P...l..............@..@.data...4...........................@....qtmetad............................@..P.rsrc...@...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA6D6.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118272
Entropy (8bit):	5.382591705784591
Encrypted:	false
SSDEEP:	768:KjYMoc5KFkJQOPu2lXmG/ROoSnKuW0TMG9CSh6n/42ZN0aKzPZ+ee9:sEOQOWmXJ/BhuCDZZN0aWpO
MD5:	74182F9DD67E1EBEEA260424EAD79912
SHA1:	68A191C678FA699BCBF4AFC1022F9F9852E11A20
SHA-256:	C1670B3A78C0FEA196910AE85AE9316111E4BE3B41D6BA79BEF7A765F96A16FE
SHA-512:	F3D093E30EBF9839DA78BA04DF99E25F44FC34C92FDD9F812125BA9C5C65990C6AABE88C24280670453D0F8914D8BBACB4271EA598CE4C09EB11F38D958F3F65
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,..M...M...M....\|..M....h..M....W..M....V..M....j..M..p.j..M...5$..M...M...L..p.V..M..p.k..M....l..M..p.i..M..Rich.M..........................PE..L....,.V...........!................@........ ............................................@......................... t.........................................`....'..8...........................pb..@............................................text...]........................... ..`.rdata...U... ...V..................@..@.data................j..............@....idata...<.......>...p..............@..@.qtmetad3...........................@..P.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqA6E7.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*423 bytes
Category:	dropped
Size (bytes):	1732608
Entropy (8bit):	5.263376455325759
Encrypted:	false
SSDEEP:	24576:4j7iyDg6nb/2H8eYyY++PBZRNgUT08wO+8UcLONMvrBTR5UCwyAAW:4jtb/2H8eYyY++PBZRNgUT08LU
MD5:	E85F4D18D5F760A2532510D5B0177EDF
SHA1:	8F7972D23B24A3CD60F32C2320EBFB27C17F5E6D
SHA-256:	BEAB00702368F0C300026591D59F61C56863BCE9077F01720E21B529868EEF7C
SHA-512:	77466BB6E5A5D532776CC6C2A81AD25968E3EDF56B4C1136882389F3749EBE23FB0680319C4B8D32F69C62E64FAEB923F1D6FE45C89D14B030C67FB126A7C330
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...............8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlite.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	689664
Entropy (8bit):	6.6867796543180775
Encrypted:	false
SSDEEP:	12288:9SQRllSaqu2R1CuF3p9PsIixqvtDcm91qWQePjmPl8+y3yRighALfxQJv:w83SdLR1CuDN6sc01qOPeny3yRidLf
MD5:	BE4901DC54B5DE34E5C7099374FF15DC
SHA1:	97F9C280E84685C97E2652E0B43BD190B4694407
SHA-256:	B0337AC5E5F268998E23F6651A180C876907047D20C3603DB09C997B73B3E51D
SHA-512:	142D4FD32281C8D3A82D3C850F8E17D962F4DA5CA8BB21A90FE502489B0A72A1C7CA26662C45CA3B0FE605F49547DC57EB580E024CAD707E329B0C2E5027F889
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.............!P......D......{......z......F....@F..........@{....@z....@G......@....@E....Rich...........................PE..L....,.V...........!.....:...P......sA.......P............................................@.............................t...T...x....p..@........................C..................................H...@............P..X............................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data........@.......(..............@....qtmetad.....`.......<..............@..P.rsrc...@....p.......>..............@..@.reloc...C.......D...B..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlited.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1022464
Entropy (8bit):	5.653813868662224
Encrypted:	false
SSDEEP:	24576:gQxUKE1mflSfnqeeXFlAhPlu1AMFJ6GvYP/Sd/42:qUA/eXFAsfFj3x
MD5:	C57F418CC1A195F7CF74931029598E25
SHA1:	13603642C0EE985031D37645CD32F47B9B307ACC
SHA-256:	40BE27696A886F3435F4E2474FC9E1FC6A476F25CF7F7148EB4D424FACA9F8B7
SHA-512:	E58FABA3237765D9DBDDA2B04CD83A3332974ACD17BD48FD72F7F29F44A70163183FAA11271C092F59980E2545E1529D29FDE70305F431DA5A7D031978305308
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................4*..............)......(............\K..............\K).....\K(.....\K.............\K......Rich............................PE..L....,.V...........!................`.....................................................@..........................p......tF..x................................3......8............................^..@............@..t............................text............................... ..`.rdata..............................@..@.data................f..............@....idata...7...@...8..................@..@.qtmetad.............R..............@..P.rsrc................V..............@..@.reloc...<.......>...\..............@..B........................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlited.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*807 bytes
Category:	dropped
Size (bytes):	3305472
Entropy (8bit):	5.20428851057236
Encrypted:	false
SSDEEP:	49152:djCxxsYVaqwHHDj/YeOEahApG7XKo+iPxY/lNmJzKj:u7XKo+uxY/lNmJzKj
MD5:	F1FC33C2E41AC7F1CB382F1EC6E28485
SHA1:	A7C60A1CEFAB4A8A3839017A8DCB956249285FD7
SHA-256:	E40A4D1128CE8FDFBB496280F5940F07ABFB096AD171550FD0991CC85F6CF12F
SHA-512:	0690CA6803F3F312E7BF60C5A73652630D3D11259E3208659366BD176806D5E3EAC5117CD149849DE577FEA9D68E582629BA7AC158718577631B00AEA6CEBA5B
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........'...\.......&...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysql.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49664
Entropy (8bit):	6.319449367453344
Encrypted:	false
SSDEEP:	768:7brDhGPFMaH7xpKmJUaHkfs0Pz7kZZBmhZmEKi1pOJe1b0zvJy8:jda5H7qmhR0Pz7mZBQyi1p4ibgvJ
MD5:	1353C12C14BA3F68A485365E4C3FFD67
SHA1:	B3761D63D78D493D7C3E3C6ABEC6ABE52A3B3559
SHA-256:	5EEB1591711B3A9D55A6374EEF1C80D4E8844D25206223CF0F2CADE45823B80D
SHA-512:	21FF85D91F80BD2B03FE3A6169D7110AC2BCFC8ABCF258D89C8BDBB2F2ACC6FB46778C3EB8F01FD92FBA0B2E6B4A661B14969D4323FF976BE3CAC972E0490066
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.x..............h.........................................................%................................Rich............................PE..L....,.V...........!.....f...\.......m....................................................@.............................v...............@.......................@......................................@............................................text....d.......f.................. ..`.rdata...@.......B...j..............@..@.data...............................@....qtmetad............................@..P.rsrc...@...........................@..@.reloc..@...........................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysqld.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	5.416266490396551
Encrypted:	false
SSDEEP:	1536:3Mw+ynYjzh21B4bZOjITECQQWKw9oPr1dkAHIOw1+IZkMzOX:33not21+bZOj2QQW59WkAoOw1+EzO
MD5:	9E8C0ABF2E31BB7AAE75345912CFEDC6
SHA1:	E7CAE55563EDD6FD58CC63755F11A5855270EBB9
SHA-256:	7783BA5FB7D2DF1C1660D90A8313B499DC49A76C507AE40BBE53FB1146722442
SHA-512:	470B1526AA1DCC99A34F68E12BAF13D62D5307D2B5D608F4E6EE57C583BBE203F019C24361F40D235B7AA7E907B0E17340616D9A736C8C77D21E5F5152807C32
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9..rW..rW..rW.6....rW.. ...rW.. ...rW.. ...rW.. ...rW.^...rW......rW..rV..sW.^...rW.^...rW.. ...rW.^...rW.Rich.rW.................PE..L....,.V...........!.....>..........`........P...............................@............@.........................`........................................ ..`....W..8...........................`...@............................................text....<.......>.................. ..`.rdata...[...P...\...B..............@..@.data...............................@....idata...=.......>..................@..@.qtmetad8...........................@..P.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlmysqld.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*483 bytes
Category:	dropped
Size (bytes):	1978368
Entropy (8bit):	5.315537065727486
Encrypted:	false
SSDEEP:	24576:GjmXSO9AWpJIeIkyOyulkSOq8jcGO2nm99DSTvhrlOCvhzGr/wMAdGXekH:GjCpJIeIkyOylzDhroCvhzGr/wMAdGX
MD5:	FF58A6B96B8842A7B9A6CAB71D722ACD
SHA1:	E315DD83A12C49D951E4FEEF87BC510E94610671
SHA-256:	2F4750BA03AFE66A56C8CA2D382C4569BF0AFFE0C5F251C1B99A9A4945CBD696
SHA-512:	264D3B826CF413DA916B092B0BB0BF1126E5B4FB57F492E4F4A4C1E886BC91C872C3138D42E8815C7C67CAA7DA7819AEBBFA0908D28185F5BC1CB6B4220D9345
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...............(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlpsql.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	6.327985366880436
Encrypted:	false
SSDEEP:	1536:x0iS+yJRxIrVk2+0MQz/AOCNCmjLH4CQ/iN5FwUF/uHm:uiS+yJRxIrVkP0prwCmjLYTuLF/uHm
MD5:	B10D850BC7CC3CA2A78866854795B1AA
SHA1:	0494B1351AA844EF6CDF3BEBCCE1E4B956A853A9
SHA-256:	522DC5D5E02B614471D2DB958A588C83F08B89AF3A59C419A800BE7EA1101C15
SHA-512:	4B015163A57049713DF14CC15A22491F4684A4DAD56E2D8DD4C918CACB4BF32BE6CD78795046F7085C8900665C51897CC1A4162ACD6726120948A0F43051D8C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..4..4..4..i...4......4......4......4......4.l....4.....4..5...4.l....4.l....4......4.l....4.Rich.4.........................PE..L....,.V...........!.....h...l.......p....................................................@.........................@...u...............@...............................................................@...............p............................text....g.......h.................. ..`.rdata..ZN.......P...l..............@..@.data...4...........................@....qtmetad............................@..P.rsrc...@...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlpsqld.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118272
Entropy (8bit):	5.382591705784591
Encrypted:	false
SSDEEP:	768:KjYMoc5KFkJQOPu2lXmG/ROoSnKuW0TMG9CSh6n/42ZN0aKzPZ+ee9:sEOQOWmXJ/BhuCDZZN0aWpO
MD5:	74182F9DD67E1EBEEA260424EAD79912
SHA1:	68A191C678FA699BCBF4AFC1022F9F9852E11A20
SHA-256:	C1670B3A78C0FEA196910AE85AE9316111E4BE3B41D6BA79BEF7A765F96A16FE
SHA-512:	F3D093E30EBF9839DA78BA04DF99E25F44FC34C92FDD9F812125BA9C5C65990C6AABE88C24280670453D0F8914D8BBACB4271EA598CE4C09EB11F38D958F3F65
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,..M...M...M....\|..M....h..M....W..M....V..M....j..M..p.j..M...5$..M...M...L..p.V..M..p.k..M....l..M..p.i..M..Rich.M..........................PE..L....,.V...........!................@........ ............................................@......................... t.........................................`....'..8...........................pb..@............................................text...]........................... ..`.rdata...U... ...V..................@..@.data................j..............@....idata...<.......>...p..............@..@.qtmetad3...........................@..P.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\sqldrivers\qsqlpsqld.pdb (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MSVC program database ver 7.00, 4096*423 bytes
Category:	dropped
Size (bytes):	1732608
Entropy (8bit):	5.263376455325759
Encrypted:	false
SSDEEP:	24576:4j7iyDg6nb/2H8eYyY++PBZRNgUT08wO+8UcLONMvrBTR5UCwyAAW:4jtb/2H8eYyY++PBZRNgUT08LU
MD5:	E85F4D18D5F760A2532510D5B0177EDF
SHA1:	8F7972D23B24A3CD60F32C2320EBFB27C17F5E6D
SHA-256:	BEAB00702368F0C300026591D59F61C56863BCE9077F01720E21B529868EEF7C
SHA-512:	77466BB6E5A5D532776CC6C2A81AD25968E3EDF56B4C1136882389F3749EBE23FB0680319C4B8D32F69C62E64FAEB923F1D6FE45C89D14B030C67FB126A7C330
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...............8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\translations\LocA736.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	67435
Entropy (8bit):	4.679572104306291
Encrypted:	false
SSDEEP:	768:BhwQhuDduX1EoQ0qXOrOVX1SOmI+h3+quz2RHmeP1K5X:BOMuDUFr4zYGNX
MD5:	5F0B33BBBED4A1B6C8BFE8083C23E13F
SHA1:	C925D8805647FAB8EC714E099D179720A7B1506A
SHA-256:	389F8BE2583786211648B889D4BEC67A65C16FF1C68BF387A10353863CDFD6D6
SHA-512:	C5B23F077691F4E2293D4FEBE00BD33BE904C532E2F12394D102D50A04719936347C3B8A9FDED754B67B81F9A85747ADD10C8B3D34306CBB2DE0C4111DD530FF
Malicious:	false
Preview:	<.d....!..`...B...P...W......g.......w...U.......}.......................Z...;...G..G ......H,......H,......H,.....SW.. e..g....'.......................u...%.................x..........T..............................`.......`..%9...................d.....(%u.....,:...d..-.....3.4]....u.5.......8G.....9.......;.9.....E....:..H(....(.H(...*..I......K.......Km....,.Km....n.Km.....Km......Km....4.Km....v.Km.....Km......Km......Km....^.Km.....Km......Km....$.Km....f.Km.....Km......L.b.....M.5....R.....6.T.3..a..TZ....@.U.%...\|.V...."..V......Y.......Z....%..Z......].....C.d.......i....9/.j.e..v..k.#..O..m.)..$^.p....<..p.......u"...3$.{....b2..S....+..Y....".......y.....hO..........}c......C...8M.......k..\|...z....2...}......x9.....i...de..1.............t...`.......)...2/...$..Z....t..+v..4....=..[a....,....W..-q......-.s.....-.#....4.......CI...5..K.T..k..TbN..tK.X.u...g.a.$..Td.bx...E..c\|<..[H.xx......\|....F7......."...Z......k....B..3!......VE..n...6U..n............

C:\Program Files (x86)\LocalPlayback\translations\LocA747.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	113503
Entropy (8bit):	4.716453314830321
Encrypted:	false
SSDEEP:	768:ZHnAXzBP0MWcwPbskddjUYfimdXPhuXZian5VedoxL3AywH1UaH6Vrae3XnmJIIT:Zxv
MD5:	1FACFBA68362D19D0E79425FE0C4533C
SHA1:	51E9AB5A9D436D1D5A519C2AAD4C3A4817447AD3
SHA-256:	5CDA4DD422AB99B6D13F2F28E35AFE81B374F78B19786D3492F85995C526D97B
SHA-512:	D8DD1FBBA33AAF92E66F4D0F9FCD2B9321982D3AB307805A76623F8BE044F0E846017F144B85F08060F43621692635C48ABDE4300D7BB18FCEDDD3CE6F161D01
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.1" language="en_US">.<context>. <name>AboutDialog</name>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="11"/>. <source>User Help</source>. <translation>User Manual</translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="12"/>. <source>Local Playback</source>. <translation>Local Playback</translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="13"/>. <source>v3.0.0.1build</source>. <translation>v3.0.0.1build</translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="63"/>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="64"/>. <source>/help.pdf</source>. <tr

C:\Program Files (x86)\LocalPlayback\translations\LocA757.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	47554
Entropy (8bit):	5.823270694123633
Encrypted:	false
SSDEEP:	384:Bei3q4SFvPjZ99nooKh5ayASWl8/z/jRTnAC2mCDCiwxBYhQU37hFg6vmv40Jh3J:B87P9nBWnElSN8E6+viQ3xF
MD5:	3224822052C3CCEBB28C7E839CD642DE
SHA1:	3AABA8B56A80A34ACFD6C4E1F1F4A4CEB6510D67
SHA-256:	60DFC2BD92976D05AE2B9962F343C68F24EFF032D0D11D0761DC92F24A84F6B8
SHA-512:	DA16D23DD7309C052D719485FE42AE859D7DD7CD7350391978CF5A77F2159C278416AEB68487D74CF77EB73296073F19C132C35140F690E1760005E4B4D0498C
Malicious:	false
Preview:	<.d....!..`...B...P...W.......g...=...w...................................l...;......G ......H,...H..H,......H,......SW...7..g....e............... .......}...%..........N.................T...{...............r...........`.......`..................."...d..[..(%u..o..,:...F4.-....zw.4]......5.......8G......9.....O.;.9..]..E....)..H(......H(......I....I.K.......Km......Km......Km....6.Km....p.Km......Km......Km......Km......Km......Km....,.Km....f.Km......Km......Km......Km....N.Km......L.b.....M.5.....R.......T.3..DH.TZ......U.%..W<.V.....4.V.....P.Y.......Z.......Z.....1.].......d....}..i....)M.j.e..Qk.k.#..7..m.)...^.p....+..p.......u"...%h.{....D...S.......Y...t..............He..........}c..^...C...(........-..\|...TZ...2...w......R......IL..de..$Q......u.....P{..`...X...)...$....$..?....t.. ~..4.......[a...o.,....=z.-q...\p.-.s.....-.#.....4....Z..CI...'8.K.T..Ji.TbN..P9.X.u...G.a.$..;Z.bx...1..c\|<..?..xx......\|....2%......_T...Z...9..k....f..3!..y...VE..L...6U..Ln...........

C:\Program Files (x86)\LocalPlayback\translations\LocA768.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	114329
Entropy (8bit):	4.714261860320126
Encrypted:	false
SSDEEP:	768:ZYnURBUxwMWcwPbskddjUYfimdXPhuXZian5VedoxPKaLmHojcJDAfmfa1h6JIIt:Z5J
MD5:	704020D61E677C7DB0DA97C0BA13A61E
SHA1:	EF80574E93DFD4DEA8065345354FD7CC2F44A9B1
SHA-256:	A9A6A953303764E675844D400F7454EFDA652D319FF1613F6921D43729DB1309
SHA-512:	B586F36483016615FE593A88B1D78BA5ADDD669F130BF016B3BEB9780AB3853D7B9A245AC4417F00F6CC33EA2B85D5D5A5C003C0C8FBAC9ED00705D62CB9F613
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.1" language="zh_CN">.<context>. <name>AboutDialog</name>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="11"/>. <source>User Help</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="12"/>. <source>Local Playback</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="13"/>. <source>v3.0.0.1build</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="63"/>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="64"/>. <source>/help.pdf</sou

C:\Program Files (x86)\LocalPlayback\translations\LocalPlayBack_en.ts (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	113503
Entropy (8bit):	4.716453314830321
Encrypted:	false
SSDEEP:	768:ZHnAXzBP0MWcwPbskddjUYfimdXPhuXZian5VedoxL3AywH1UaH6Vrae3XnmJIIT:Zxv
MD5:	1FACFBA68362D19D0E79425FE0C4533C
SHA1:	51E9AB5A9D436D1D5A519C2AAD4C3A4817447AD3
SHA-256:	5CDA4DD422AB99B6D13F2F28E35AFE81B374F78B19786D3492F85995C526D97B
SHA-512:	D8DD1FBBA33AAF92E66F4D0F9FCD2B9321982D3AB307805A76623F8BE044F0E846017F144B85F08060F43621692635C48ABDE4300D7BB18FCEDDD3CE6F161D01
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.1" language="en_US">.<context>. <name>AboutDialog</name>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="11"/>. <source>User Help</source>. <translation>User Manual</translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="12"/>. <source>Local Playback</source>. <translation>Local Playback</translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="13"/>. <source>v3.0.0.1build</source>. <translation>v3.0.0.1build</translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="63"/>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="64"/>. <source>/help.pdf</source>. <tr

C:\Program Files (x86)\LocalPlayback\translations\LocalPlayBack_zh.ts (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	114329
Entropy (8bit):	4.714261860320126
Encrypted:	false
SSDEEP:	768:ZYnURBUxwMWcwPbskddjUYfimdXPhuXZian5VedoxPKaLmHojcJDAfmfa1h6JIIt:Z5J
MD5:	704020D61E677C7DB0DA97C0BA13A61E
SHA1:	EF80574E93DFD4DEA8065345354FD7CC2F44A9B1
SHA-256:	A9A6A953303764E675844D400F7454EFDA652D319FF1613F6921D43729DB1309
SHA-512:	B586F36483016615FE593A88B1D78BA5ADDD669F130BF016B3BEB9780AB3853D7B9A245AC4417F00F6CC33EA2B85D5D5A5C003C0C8FBAC9ED00705D62CB9F613
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.1" language="zh_CN">.<context>. <name>AboutDialog</name>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="11"/>. <source>User Help</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="12"/>. <source>Local Playback</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="13"/>. <source>v3.0.0.1build</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="63"/>. <location filename="../../../src/LocalPlayback/ui/About/AboutDialog.cpp" line="64"/>. <source>/help.pdf</sou

C:\Program Files (x86)\LocalPlayback\translations\LocalPlayback_en.qm (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	67435
Entropy (8bit):	4.679572104306291
Encrypted:	false
SSDEEP:	768:BhwQhuDduX1EoQ0qXOrOVX1SOmI+h3+quz2RHmeP1K5X:BOMuDUFr4zYGNX
MD5:	5F0B33BBBED4A1B6C8BFE8083C23E13F
SHA1:	C925D8805647FAB8EC714E099D179720A7B1506A
SHA-256:	389F8BE2583786211648B889D4BEC67A65C16FF1C68BF387A10353863CDFD6D6
SHA-512:	C5B23F077691F4E2293D4FEBE00BD33BE904C532E2F12394D102D50A04719936347C3B8A9FDED754B67B81F9A85747ADD10C8B3D34306CBB2DE0C4111DD530FF
Malicious:	false
Preview:	<.d....!..`...B...P...W......g.......w...U.......}.......................Z...;...G..G ......H,......H,......H,.....SW.. e..g....'.......................u...%.................x..........T..............................`.......`..%9...................d.....(%u.....,:...d..-.....3.4]....u.5.......8G.....9.......;.9.....E....:..H(....(.H(...*..I......K.......Km....,.Km....n.Km.....Km......Km....4.Km....v.Km.....Km......Km......Km....^.Km.....Km......Km....$.Km....f.Km.....Km......L.b.....M.5....R.....6.T.3..a..TZ....@.U.%...\|.V...."..V......Y.......Z....%..Z......].....C.d.......i....9/.j.e..v..k.#..O..m.)..$^.p....<..p.......u"...3$.{....b2..S....+..Y....".......y.....hO..........}c......C...8M.......k..\|...z....2...}......x9.....i...de..1.............t...`.......)...2/...$..Z....t..+v..4....=..[a....,....W..-q......-.s.....-.#....4.......CI...5..K.T..k..TbN..tK.X.u...g.a.$..Td.bx...E..c\|<..[H.xx......\|....F7......."...Z......k....B..3!......VE..n...6U..n............

C:\Program Files (x86)\LocalPlayback\translations\LocalPlayback_zh.qm (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	47554
Entropy (8bit):	5.823270694123633
Encrypted:	false
SSDEEP:	384:Bei3q4SFvPjZ99nooKh5ayASWl8/z/jRTnAC2mCDCiwxBYhQU37hFg6vmv40Jh3J:B87P9nBWnElSN8E6+viQ3xF
MD5:	3224822052C3CCEBB28C7E839CD642DE
SHA1:	3AABA8B56A80A34ACFD6C4E1F1F4A4CEB6510D67
SHA-256:	60DFC2BD92976D05AE2B9962F343C68F24EFF032D0D11D0761DC92F24A84F6B8
SHA-512:	DA16D23DD7309C052D719485FE42AE859D7DD7CD7350391978CF5A77F2159C278416AEB68487D74CF77EB73296073F19C132C35140F690E1760005E4B4D0498C
Malicious:	false
Preview:	<.d....!..`...B...P...W.......g...=...w...................................l...;......G ......H,...H..H,......H,......SW...7..g....e............... .......}...%..........N.................T...{...............r...........`.......`..................."...d..[..(%u..o..,:...F4.-....zw.4]......5.......8G......9.....O.;.9..]..E....)..H(......H(......I....I.K.......Km......Km......Km....6.Km....p.Km......Km......Km......Km......Km......Km....,.Km....f.Km......Km......Km......Km....N.Km......L.b.....M.5.....R.......T.3..DH.TZ......U.%..W<.V.....4.V.....P.Y.......Z.......Z.....1.].......d....}..i....)M.j.e..Qk.k.#..7..m.)...^.p....+..p.......u"...%h.{....D...S.......Y...t..............He..........}c..^...C...(........-..\|...TZ...2...w......R......IL..de..$Q......u.....P{..`...X...)...$....$..?....t.. ~..4.......[a...o.,....=z.-q...\p.-.s.....-.#.....4....Z..CI...'8.K.T..Ji.TbN..P9.X.u...G.a.$..;Z.bx...1..c\|<..?..xx......\|....2%......_T...Z...9..k....f..3!..y...VE..L...6U..Ln...........

C:\Program Files (x86)\LocalPlayback\translations\TooA7A9.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	13050
Entropy (8bit):	4.768747941794166
Encrypted:	false
SSDEEP:	192:P5NsHsl1GkEFbJwkbcQDUD5MxjbJBlhqWX:Vl1GkAQQDLtsWX
MD5:	1A9B64537F04C64B1629651CC04C8DDB
SHA1:	ED0F7A025E4729BE4F23A42015826D1DD6F79366
SHA-256:	FF6FC25C0E719784C05CDBB1F2583033256D57C133740EA13C0C458DF7C1DF8B
SHA-512:	65CB9BBEB77BFAEEA209C1AC9ED153681790E8480B8306E640849585A686B9CD9355DF08BA2A5C4C128B14CA3A7739322EE810173A7DEA7044513D25C6D90A21
Malicious:	false
Preview:	<.d....!..`...B...`...-...U...1...............;.......;.......;.. U...;..,...G.......H,......H,......H,..,+..LD......Sg..................(......................j..L....j..g.......g....,.........H.....[.J6...-..L.=.....S.....,.W.T.....[.......[.....u.[Z......[j\|.............w.......w......V.e......._..!..'=....V.i5...c.+'4..(s.8.%.. ..;.>.....Y.....E..V...##......)...........o.............W.......................8..............I.......I.......I...,e...]...'..hD..,...:............#...%.....?.%.....FJ......H8....9.K....e..F....`..F... ....n.......K..-...J...."......)..,...."%.>.7......~Z......~Z......o5......o5...,.........-.q..$..-.r..$N.-.s..$..-.t..$..-.u..%,.-.v..%v.-.w..%..-.x..&..-.y..&T.X................!...&.......'..9.......A.D.....f.e.....~.....:..I...........(....................N..+..2.....@.T9...+E.Y.....C.Z....+..^.......h.>...$.h.>.. ............?...E.......r.=....*s.d8......d.....1.d.......d.....<.g.......o........ ....-...~.......~..-O..^...+..L.9.....YUt.......

C:\Program Files (x86)\LocalPlayback\translations\TooA7AA.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	44703
Entropy (8bit):	4.750873490865808
Encrypted:	false
SSDEEP:	768:OCoJpB9ldRiCYJniaGzF39pXKj9VkcJu5C2qRRVaS4Hccl3hPILGWKyfJYyyij82:ht
MD5:	4570AA94F86F1E512A63E950F4484399
SHA1:	1325C5348EE38FD35AE04F2426654E32A7B8DF56
SHA-256:	A59F6B944367D5264827069C2149887073747DF4E7CABAE91BDF2EC83EB9F0C9
SHA-512:	B95F62FE3B635F44DCA73CABD7215BAEA6529A7D7452E6942E53954E18FAEF7C4E81939E53F49189D4D0ECA5819CB5058A59B67D3DB1DADA4B5349FF0667917D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.0" language="en_US">.<context>. <name>AboutClass</name>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="14"/>. <source>About</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="91"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="249"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="284"/>. <source>PushButton</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="149"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbo

C:\Program Files (x86)\LocalPlayback\translations\TooA7BB.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9671
Entropy (8bit):	5.652362202740122
Encrypted:	false
SSDEEP:	192:FJmrvIzTXFTeO4cb4pi2/OUIqQZIe1+B+CgE:FJEvIzTXFSdAQAqDt
MD5:	0AD914E05DD58B686DEB4D042A8D2B13
SHA1:	93A6F5BB25485E953D962A2F710F209F499CBB1E
SHA-256:	0742E49682C78DE27B0DEE311A2A7C514E0804786908A8AADA2CF69D4B1CE77B
SHA-512:	1BFAC3C93D031735CA3E22BB6D47F8AF352AF64F9ABC661EAE9FF098BC3DB2328D17530ABFCB2CA956FF3DC2BC16FF8BAE4167A47B5C02940023085EE18E2759
Malicious:	false
Preview:	<.d....!..`...B...............;...A...;.......;.......;.. ;...>......G.......H,......H,......H,......LD......Sg.../..S....l..........................L.......g.......g....#.......<.H.....S.J6... ..S.......W.T.....[.......[.......[Z....u.[j\|............V.e...i..._.....'=....I.*i5.....+'4.....8.%...p.;.>...m..V............B......Z...o...?.......k.W.......................8...............I.......I....J..I... ....]......hD.. r..:....M.......z...%.....?.%...Z.FJ......H8......K....T..F....:..F....<...n...p...K.. ...J....o.........,.......>.7......~Z......~Z...0..o5......o5.............-.q...e.-.r.....-.s.....-.t.....-.u...U.-.v.....-.w.....-.x.....-.y...E.X................!..............9.....K.A.D.....~........I....................;.......9...N...x.2.......T9......Y.......Z.....@.^.....w.h.>...#.h.>...............?.............=.....X.d8....=.d.....).d.......d.....n.g.......o........ ....t..^......L.9.....YUt..............O.......E....8......!L...............+..............4.H......q.

C:\Program Files (x86)\LocalPlayback\translations\TooA7BC.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	44397
Entropy (8bit):	5.001700542957749
Encrypted:	false
SSDEEP:	768:cCoJpBiddNOsjKjllGz63wBLBOwZp/3unD2qkrDN4hPrSmuJrZACE4v8k8ynfj/1:YRo
MD5:	9F7E28E3E39BC3640CE1AF3AC909985E
SHA1:	AD68CFC954C96744A35A222CCA447D4BE42EA6CB
SHA-256:	2E2A667AE118C0FB097B094CF8BA86DCFDBFD5E21B777CEEC0AA542D5BADF303
SHA-512:	590CE8A8B23C2E1D4D740EDB49B86F08B40F5B721379B78CFBF126489A1D6630F3F3D7432EAC4345DF32C541AE6DCECC6436C6C8C4145BAAAFD6FF1BD8E42E90
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.0" language="zh_CN">.<context>. <name>AboutClass</name>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="14"/>. <source>About</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="91"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="249"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="284"/>. <source>PushButton</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="149"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbo

C:\Program Files (x86)\LocalPlayback\translations\TooA7CD.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	23
Entropy (8bit):	4.229871195093384
Encrypted:	false
SSDEEP:	3:j2wZC4Xl9t:Cwpvt
MD5:	4AEF4415F2E976B2CC6F24B877804A57
SHA1:	2AA2D42C51F9CF024E3777F0DDE4270388FD22AE
SHA-256:	307CEF95DD5B36FF215055D427E1885B7FC3650C9224CF76D63056545996FF60
SHA-512:	C75F089A95107997B0A786E7C1191E48EC7A69AEFFF97DAF37783791D943C612B7C1B43BCC2CACDFD15E79382E0F314C88817C7DD320F8028AF3420452CE3A1C
Malicious:	false
Preview:	<.d....!..`.........

C:\Program Files (x86)\LocalPlayback\translations\TooA7CE.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	4.788406509918275
Encrypted:	false
SSDEEP:	24:2dpL9NK9PoUJNW0L9foUJNW0L9+SSDoUJNWQL:cphSPNE0hfNE0h+S2NEA
MD5:	6F4E4E47D42C85B7C7F80D8F800B2001
SHA1:	F921377E45EBFB800AC0D23E6F29E45259CD641C
SHA-256:	9487D790292C6AEAE7BE64340F784650B81D7AC1028C7FFCFC9FEE41040A6D40
SHA-512:	E49B3A1DB81C58318AA3052491140672D041F84059E74E4AAB9BF88AA5853F64297C100CE9737B7B6733ED339E06C733FF9A5D73AFDD13E42FF22D56674A6D2B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.0" language="en_US">.<context>. <name>apt::ToolApplicationHull::ToolApplicationPrivate</name>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="161"/>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="175"/>. <source>Hint</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="164"/>. <source> is already running.</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="178"/>. <source>Display resolution less than 1024*768,are you sure to start the program?</source>. <translation type

C:\Program Files (x86)\LocalPlayback\translations\TooA7DE.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.3715950403342205
Encrypted:	false
SSDEEP:	6:CwTa+ZMjmAN3l9KFajfPulQ+0EnaSLReTJCRaQ9KFo2lf9Ks:HdZMjmY3l8aKldh0M8Q8o2lt
MD5:	133BEEA808D90551E7CAAFBC68D460D1
SHA1:	3FC608883E8B7212D85F533F7D075AB0EDBCBDA3
SHA-256:	303B1B6E9FE3233256521CA1EE0C3951A49736536716FB6ECEB4762686C3616E
SHA-512:	ABB01A736262B43CFD45EC577C45B47B322CEAD206BCB832C757F5C6A11DA1B0E7833492A64A233983A48DA343A131769145A120522B8B10463F017D7775CA41
Malicious:	false
Preview:	<.d....!..`...B.......T.....y.......{....ci...g.....].~..L0........... is already running.....0apt::ToolApplicationHull::ToolApplicationPrivate.....R...s.\.N..1.0.2.4...7.6.8..f/T&~.~.T/R............HDisplay resolution less than 1024768,are you sure to start the program?....0apt::ToolApplicationHull::ToolApplicationPrivate......c.y:..........Hint....0apt::ToolApplicationHull::ToolApplicationPrivate.

C:\Program Files (x86)\LocalPlayback\translations\TooA7DF.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.127233949191075
Encrypted:	false
SSDEEP:	24:2dMXvOL9NK9PhNW0L9fHNW0L9+SSDoUDiNWQL:cM2hSPhE0hfHE0h+S2HiEA
MD5:	B105BCAA5FF160C84F2A2B76945548C4
SHA1:	985C9A406696E230B040E965EF6BA2300E3BCC4D
SHA-256:	616942516D221A83C2A8FA9120284DE8E9305EB110D34524251BE1F5B377D4E4
SHA-512:	052E803DB3EB4F787BB33124BA79F5281CFB958108B7799170D662D63D0E65CC93B7C2EF04594937D3011C978CACA6162A14439EFB1950AAC4090E1CD8EFD76D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.0" language="zh_CN">.<context>. <name>apt::ToolApplicationHull::ToolApplicationPrivate</name>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="161"/>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="175"/>. <source>Hint</source>. <translation>..</translation>. </message>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="164"/>. <source> is already running.</source>. <translation>.....</translation>. </message>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="178"/>. <source>Display resolution less than 1024*768,are you sure to start the program?</source>. <translation type="unfinished">.

C:\Program Files (x86)\LocalPlayback\translations\ToolGuiToolkit_en.qm (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	13050
Entropy (8bit):	4.768747941794166
Encrypted:	false
SSDEEP:	192:P5NsHsl1GkEFbJwkbcQDUD5MxjbJBlhqWX:Vl1GkAQQDLtsWX
MD5:	1A9B64537F04C64B1629651CC04C8DDB
SHA1:	ED0F7A025E4729BE4F23A42015826D1DD6F79366
SHA-256:	FF6FC25C0E719784C05CDBB1F2583033256D57C133740EA13C0C458DF7C1DF8B
SHA-512:	65CB9BBEB77BFAEEA209C1AC9ED153681790E8480B8306E640849585A686B9CD9355DF08BA2A5C4C128B14CA3A7739322EE810173A7DEA7044513D25C6D90A21
Malicious:	false
Preview:	<.d....!..`...B...`...-...U...1...............;.......;.......;.. U...;..,...G.......H,......H,......H,..,+..LD......Sg..................(......................j..L....j..g.......g....,.........H.....[.J6...-..L.=.....S.....,.W.T.....[.......[.....u.[Z......[j\|.............w.......w......V.e......._..!..'=....V.i5...c.+'4..(s.8.%.. ..;.>.....Y.....E..V...##......)...........o.............W.......................8..............I.......I.......I...,e...]...'..hD..,...:............#...%.....?.%.....FJ......H8....9.K....e..F....`..F... ....n.......K..-...J...."......)..,...."%.>.7......~Z......~Z......o5......o5...,.........-.q..$..-.r..$N.-.s..$..-.t..$..-.u..%,.-.v..%v.-.w..%..-.x..&..-.y..&T.X................!...&.......'..9.......A.D.....f.e.....~.....:..I...........(....................N..+..2.....@.T9...+E.Y.....C.Z....+..^.......h.>...$.h.>.. ............?...E.......r.=....*s.d8......d.....1.d.......d.....<.g.......o........ ....-...~.......~..-O..^...+..L.9.....YUt.......

C:\Program Files (x86)\LocalPlayback\translations\ToolGuiToolkit_en.ts (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	44703
Entropy (8bit):	4.750873490865808
Encrypted:	false
SSDEEP:	768:OCoJpB9ldRiCYJniaGzF39pXKj9VkcJu5C2qRRVaS4Hccl3hPILGWKyfJYyyij82:ht
MD5:	4570AA94F86F1E512A63E950F4484399
SHA1:	1325C5348EE38FD35AE04F2426654E32A7B8DF56
SHA-256:	A59F6B944367D5264827069C2149887073747DF4E7CABAE91BDF2EC83EB9F0C9
SHA-512:	B95F62FE3B635F44DCA73CABD7215BAEA6529A7D7452E6942E53954E18FAEF7C4E81939E53F49189D4D0ECA5819CB5058A59B67D3DB1DADA4B5349FF0667917D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.0" language="en_US">.<context>. <name>AboutClass</name>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="14"/>. <source>About</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="91"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="249"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="284"/>. <source>PushButton</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="149"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbo

C:\Program Files (x86)\LocalPlayback\translations\ToolGuiToolkit_zh.qm (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	9671
Entropy (8bit):	5.652362202740122
Encrypted:	false
SSDEEP:	192:FJmrvIzTXFTeO4cb4pi2/OUIqQZIe1+B+CgE:FJEvIzTXFSdAQAqDt
MD5:	0AD914E05DD58B686DEB4D042A8D2B13
SHA1:	93A6F5BB25485E953D962A2F710F209F499CBB1E
SHA-256:	0742E49682C78DE27B0DEE311A2A7C514E0804786908A8AADA2CF69D4B1CE77B
SHA-512:	1BFAC3C93D031735CA3E22BB6D47F8AF352AF64F9ABC661EAE9FF098BC3DB2328D17530ABFCB2CA956FF3DC2BC16FF8BAE4167A47B5C02940023085EE18E2759
Malicious:	false
Preview:	<.d....!..`...B...............;...A...;.......;.......;.. ;...>......G.......H,......H,......H,......LD......Sg.../..S....l..........................L.......g.......g....#.......<.H.....S.J6... ..S.......W.T.....[.......[.......[Z....u.[j\|............V.e...i..._.....'=....I.*i5.....+'4.....8.%...p.;.>...m..V............B......Z...o...?.......k.W.......................8...............I.......I....J..I... ....]......hD.. r..:....M.......z...%.....?.%...Z.FJ......H8......K....T..F....:..F....<...n...p...K.. ...J....o.........,.......>.7......~Z......~Z...0..o5......o5.............-.q...e.-.r.....-.s.....-.t.....-.u...U.-.v.....-.w.....-.x.....-.y...E.X................!..............9.....K.A.D.....~........I....................;.......9...N...x.2.......T9......Y.......Z.....@.^.....w.h.>...#.h.>...............?.............=.....X.d8....=.d.....).d.......d.....n.g.......o........ ....t..^......L.9.....YUt..............O.......E....8......!L...............+..............4.H......q.

C:\Program Files (x86)\LocalPlayback\translations\ToolGuiToolkit_zh.ts (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	44397
Entropy (8bit):	5.001700542957749
Encrypted:	false
SSDEEP:	768:cCoJpBiddNOsjKjllGz63wBLBOwZp/3unD2qkrDN4hPrSmuJrZACE4v8k8ynfj/1:YRo
MD5:	9F7E28E3E39BC3640CE1AF3AC909985E
SHA1:	AD68CFC954C96744A35A222CCA447D4BE42EA6CB
SHA-256:	2E2A667AE118C0FB097B094CF8BA86DCFDBFD5E21B777CEEC0AA542D5BADF303
SHA-512:	590CE8A8B23C2E1D4D740EDB49B86F08B40F5B721379B78CFBF126489A1D6630F3F3D7432EAC4345DF32C541AE6DCECC6436C6C8C4145BAAAFD6FF1BD8E42E90
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.0" language="zh_CN">.<context>. <name>AboutClass</name>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="14"/>. <source>About</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="91"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="249"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="284"/>. <source>PushButton</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbout.ui" line="149"/>. <location filename="../../../../src/ToolGuiToolkit/src/StrangeControls/DialogAbo

C:\Program Files (x86)\LocalPlayback\translations\ToolShareModule_en.qm (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	23
Entropy (8bit):	4.229871195093384
Encrypted:	false
SSDEEP:	3:j2wZC4Xl9t:Cwpvt
MD5:	4AEF4415F2E976B2CC6F24B877804A57
SHA1:	2AA2D42C51F9CF024E3777F0DDE4270388FD22AE
SHA-256:	307CEF95DD5B36FF215055D427E1885B7FC3650C9224CF76D63056545996FF60
SHA-512:	C75F089A95107997B0A786E7C1191E48EC7A69AEFFF97DAF37783791D943C612B7C1B43BCC2CACDFD15E79382E0F314C88817C7DD320F8028AF3420452CE3A1C
Malicious:	false
Preview:	<.d....!..`.........

C:\Program Files (x86)\LocalPlayback\translations\ToolShareModule_en.ts (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	4.788406509918275
Encrypted:	false
SSDEEP:	24:2dpL9NK9PoUJNW0L9foUJNW0L9+SSDoUJNWQL:cphSPNE0hfNE0h+S2NEA
MD5:	6F4E4E47D42C85B7C7F80D8F800B2001
SHA1:	F921377E45EBFB800AC0D23E6F29E45259CD641C
SHA-256:	9487D790292C6AEAE7BE64340F784650B81D7AC1028C7FFCFC9FEE41040A6D40
SHA-512:	E49B3A1DB81C58318AA3052491140672D041F84059E74E4AAB9BF88AA5853F64297C100CE9737B7B6733ED339E06C733FF9A5D73AFDD13E42FF22D56674A6D2B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.0" language="en_US">.<context>. <name>apt::ToolApplicationHull::ToolApplicationPrivate</name>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="161"/>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="175"/>. <source>Hint</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="164"/>. <source> is already running.</source>. <translation type="unfinished"></translation>. </message>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="178"/>. <source>Display resolution less than 1024*768,are you sure to start the program?</source>. <translation type

C:\Program Files (x86)\LocalPlayback\translations\ToolShareModule_zh.qm (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.3715950403342205
Encrypted:	false
SSDEEP:	6:CwTa+ZMjmAN3l9KFajfPulQ+0EnaSLReTJCRaQ9KFo2lf9Ks:HdZMjmY3l8aKldh0M8Q8o2lt
MD5:	133BEEA808D90551E7CAAFBC68D460D1
SHA1:	3FC608883E8B7212D85F533F7D075AB0EDBCBDA3
SHA-256:	303B1B6E9FE3233256521CA1EE0C3951A49736536716FB6ECEB4762686C3616E
SHA-512:	ABB01A736262B43CFD45EC577C45B47B322CEAD206BCB832C757F5C6A11DA1B0E7833492A64A233983A48DA343A131769145A120522B8B10463F017D7775CA41
Malicious:	false
Preview:	<.d....!..`...B.......T.....y.......{....ci...g.....].~..L0........... is already running.....0apt::ToolApplicationHull::ToolApplicationPrivate.....R...s.\.N..1.0.2.4...7.6.8..f/T&~.~.T/R............HDisplay resolution less than 1024768,are you sure to start the program?....0apt::ToolApplicationHull::ToolApplicationPrivate......c.y:..........Hint....0apt::ToolApplicationHull::ToolApplicationPrivate.

C:\Program Files (x86)\LocalPlayback\translations\ToolShareModule_zh.ts (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.127233949191075
Encrypted:	false
SSDEEP:	24:2dMXvOL9NK9PhNW0L9fHNW0L9+SSDoUDiNWQL:cM2hSPhE0hfHE0h+S2HiEA
MD5:	B105BCAA5FF160C84F2A2B76945548C4
SHA1:	985C9A406696E230B040E965EF6BA2300E3BCC4D
SHA-256:	616942516D221A83C2A8FA9120284DE8E9305EB110D34524251BE1F5B377D4E4
SHA-512:	052E803DB3EB4F787BB33124BA79F5281CFB958108B7799170D662D63D0E65CC93B7C2EF04594937D3011C978CACA6162A14439EFB1950AAC4090E1CD8EFD76D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.<!DOCTYPE TS>.<TS version="2.0" language="zh_CN">.<context>. <name>apt::ToolApplicationHull::ToolApplicationPrivate</name>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="161"/>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="175"/>. <source>Hint</source>. <translation>..</translation>. </message>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="164"/>. <source> is already running.</source>. <translation>.....</translation>. </message>. <message>. <location filename="../../../../src/ToolShareModule/src/ToolApplication/ToolApplication.cpp" line="178"/>. <source>Display resolution less than 1024*768,are you sure to start the program?</source>. <translation type="unfinished">.

C:\Program Files (x86)\LocalPlayback\translations\qt_A788.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Preview:	<.d....!..`...

C:\Program Files (x86)\LocalPlayback\translations\qt_A789.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	117340
Entropy (8bit):	5.859369984347924
Encrypted:	false
SSDEEP:	1536:81dXW89nqEFu54aekvOzHHSVuf8j2+/xc3lhnbsfdAoz/w:s9qEFeLekvOznSVHJG3lhn+djY
MD5:	1DAE5BCF080EFAD6EEE5B8D2A211B3C6
SHA1:	FAA4ECA2D1F9257F6B86B2B9CB93EE67B22CE7F8
SHA-256:	11123226DB46D35F81079AFB3C88D3AFE463645707A7C2DFB24F2867F6FC14B4
SHA-512:	7335685A3E91C15BB0FD28EBEB81013554617040876A8F99AF673CBF67545DEC68A572E898D1DE27C58069875412BCE9E24F8295139DE519007904F0D5170121
Malicious:	false
Preview:	<.d....!..`...B..+...........+.......@.......A...8...B.......C.......D.......E...V...F.......G...L...H.......I...9...P.......Q...e...R...^...S.......T...T...U.......V...\|...W.......X...o...Y.......]..4 ...;...2...;..,....;..8....;.......;.......M..4H...O.......O...........#...}..4p...m..4........N..(5......+;...f..+;..6Y..+;..<...+O...8..+O..6'..1......E@......F....Y..H4..."..HY..J...H.......I.......J.......J.......K....5..LD..._..L......PS...V..Q....6..R...N...W..../..Zr.....[`.....[`......\...lU.._......._....L..1...<........j......6...............B........I...$..K....$.......,...g...y...3.......A......r...........................9..L7......;w...E..5b...E...G.......5...%.......%..D........`..............................0.......0..8W...0..}y...0...6...0.......0.......5.......5...... D..:... D..J...+....R..,...;...,......<U..~...<U......<......F...;...F......H5...i..H5..:...H5..Jk..H5...w..VE...[..f....u..f...0X..f...9...f...E...f.......f.......f....j..g....A..l.......

C:\Program Files (x86)\LocalPlayback\translations\qt_en.qm (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:j2wZC4n:CwZ
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Preview:	<.d....!..`...

C:\Program Files (x86)\LocalPlayback\translations\qt_zh_CN.qm (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	117340
Entropy (8bit):	5.859369984347924
Encrypted:	false
SSDEEP:	1536:81dXW89nqEFu54aekvOzHHSVuf8j2+/xc3lhnbsfdAoz/w:s9qEFeLekvOznSVHJG3lhn+djY
MD5:	1DAE5BCF080EFAD6EEE5B8D2A211B3C6
SHA1:	FAA4ECA2D1F9257F6B86B2B9CB93EE67B22CE7F8
SHA-256:	11123226DB46D35F81079AFB3C88D3AFE463645707A7C2DFB24F2867F6FC14B4
SHA-512:	7335685A3E91C15BB0FD28EBEB81013554617040876A8F99AF673CBF67545DEC68A572E898D1DE27C58069875412BCE9E24F8295139DE519007904F0D5170121
Malicious:	false
Preview:	<.d....!..`...B..+...........+.......@.......A...8...B.......C.......D.......E...V...F.......G...L...H.......I...9...P.......Q...e...R...^...S.......T...T...U.......V...\|...W.......X...o...Y.......]..4 ...;...2...;..,....;..8....;.......;.......M..4H...O.......O...........#...}..4p...m..4........N..(5......+;...f..+;..6Y..+;..<...+O...8..+O..6'..1......E@......F....Y..H4..."..HY..J...H.......I.......J.......J.......K....5..LD..._..L......PS...V..Q....6..R...N...W..../..Zr.....[`.....[`......\...lU.._......._....L..1...<........j......6...............B........I...$..K....$.......,...g...y...3.......A......r...........................9..L7......;w...E..5b...E...G.......5...%.......%..D........`..............................0.......0..8W...0..}y...0...6...0.......0.......5.......5...... D..:... D..J...+....R..,...;...,......<U..~...<U......<......F...;...F......H5...i..H5..:...H5..Jk..H5...w..VE...[..f....u..f...0X..f...9...f...E...f.......f.......f....j..g....A..l.......

C:\Program Files (x86)\LocalPlayback\vcr902B.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7195312
Entropy (8bit):	7.989078407747941
Encrypted:	false
SSDEEP:	196608:A9OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMELc:fz5x7jLXkmkU4cFec
MD5:	385194EB89B6741781CB9065D8E8158E
SHA1:	AA721DB201DA3F238A9221C1FDF71C504A2DC20C
SHA-256:	C8497C8BB691C748697C429A61F31D253383E3CF1B552925022556875C63A313
SHA-512:	6D36CCF7016961A9F0A41E88F694A8DC30F57EA068D88B805ABDAE2907BD924205DDFF5CC90901504F022597D8E33E78AA70EE25437C83B358F81B513BC65C69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0........m...@.................................t!..,........7............m..>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\vcr92EB.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6503984
Entropy (8bit):	7.986886773014506
Encrypted:	false
SSDEEP:	98304:hQEKzHx15bWUuBrNatjJh2eNUrzKRL/RaIswn7aBOC5qZxVqFb2iExMc7FvxwGvf:WRDnuBotjJh2emr8L/YIsG7MOgqHG64
MD5:	0FC525B6B7B96A87523DAA7A0013C69D
SHA1:	DF7F0A73BFA077E483E51BFB97F5E2ECEEDFB6A3
SHA-256:	A22895E55B26202EAE166838EDBE2EA6AAD00D7EA600C11F8A31EDE5CBCE2048
SHA-512:	729251371ED208898430040FE48CABD286A5671BD7F472A30E9021B68F73B2D49D85A0879920232426B139520F7E21321BA92646985216BF2F733C64E014A71D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0........c...@.................................t!..,........7..........x.b..>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\vcredist_x64_2013.exe (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7195312
Entropy (8bit):	7.989078407747941
Encrypted:	false
SSDEEP:	196608:A9OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMELc:fz5x7jLXkmkU4cFec
MD5:	385194EB89B6741781CB9065D8E8158E
SHA1:	AA721DB201DA3F238A9221C1FDF71C504A2DC20C
SHA-256:	C8497C8BB691C748697C429A61F31D253383E3CF1B552925022556875C63A313
SHA-512:	6D36CCF7016961A9F0A41E88F694A8DC30F57EA068D88B805ABDAE2907BD924205DDFF5CC90901504F022597D8E33E78AA70EE25437C83B358F81B513BC65C69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0........m...@.................................t!..,........7............m..>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\vcredist_x86.exe (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6503984
Entropy (8bit):	7.986886773014506
Encrypted:	false
SSDEEP:	98304:hQEKzHx15bWUuBrNatjJh2eNUrzKRL/RaIswn7aBOC5qZxVqFb2iExMc7FvxwGvf:WRDnuBotjJh2emr8L/YIsG7MOgqHG64
MD5:	0FC525B6B7B96A87523DAA7A0013C69D
SHA1:	DF7F0A73BFA077E483E51BFB97F5E2ECEEDFB6A3
SHA-256:	A22895E55B26202EAE166838EDBE2EA6AAD00D7EA600C11F8A31EDE5CBCE2048
SHA-512:	729251371ED208898430040FE48CABD286A5671BD7F472A30E9021B68F73B2D49D85A0879920232426B139520F7E21321BA92646985216BF2F733C64E014A71D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0........c...@.................................t!..,........7..........x.b..>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\zli9454.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	5.8489695835244095
Encrypted:	false
SSDEEP:	768:bw6vENCUvhLcSCE/StC0KuFLRO5ZikoHBc1m7s4wixE+XwVY/nToIf18IOsIOIiy:bDvENBhA+WjPLAVY/nToIfCIOsIOIip
MD5:	72E87AD407BB28F5B471C3396296B377
SHA1:	15CD01170FF8D8531FB16F4F7A1C5FBE810A1057
SHA-256:	91EC6085E862E1EEDC254BF88EFECD4FA67F486216AB3B1473915D15462E71BB
SHA-512:	1569939514C0E30E2FBF7D81586ADA53931AC36B11F306B95B5E0741C6B32C45D88D33271223C99CD4FBD585F0675D5188557E5DFE6901F9FBB2E3E8EC98A698
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2.@.2.@.2.@.:.@.2.@.:.@.2.@.2.@.2.@.:.@.2.@.>.@.2.@.>.@.2.@`9.@.2.@.>.@.2.@Rich.2.@........................PE..L......L...........!................3.............LZ.........................0..................................................<............................ ......`...................................................H............................text............................... ..`.rdata...H.......P..................@..@.data...P...........................@....rsrc...............................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\LocalPlayback\zlib1.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	5.8489695835244095
Encrypted:	false
SSDEEP:	768:bw6vENCUvhLcSCE/StC0KuFLRO5ZikoHBc1m7s4wixE+XwVY/nToIf18IOsIOIiy:bDvENBhA+WjPLAVY/nToIfCIOsIOIip
MD5:	72E87AD407BB28F5B471C3396296B377
SHA1:	15CD01170FF8D8531FB16F4F7A1C5FBE810A1057
SHA-256:	91EC6085E862E1EEDC254BF88EFECD4FA67F486216AB3B1473915D15462E71BB
SHA-512:	1569939514C0E30E2FBF7D81586ADA53931AC36B11F306B95B5E0741C6B32C45D88D33271223C99CD4FBD585F0675D5188557E5DFE6901F9FBB2E3E8EC98A698
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2.@.2.@.2.@.:.@.2.@.:.@.2.@.2.@.2.@.:.@.2.@.>.@.2.@.>.@.2.@`9.@.2.@.>.@.2.@Rich.2.@........................PE..L......L...........!................3.............LZ.........................0..................................................<............................ ......`...................................................H............................text............................... ..`.rdata...H.......P..................@..@.data...P...........................@....rsrc...............................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LocalPlayback\Local Playback User Manual.lnk

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 24 11:56:22 2024, mtime=Thu Oct 24 11:56:22 2024, atime=Fri Nov 2 14:23:02 2018, length=1163462, window=hide
Category:	dropped
Size (bytes):	2147
Entropy (8bit):	3.5536743155647468
Encrypted:	false
SSDEEP:	48:8vG2CdON0B+TOx2AmKEd/B+Qx2id/B+Vgd/B+Qx2+p/B+Qx2GcGmyg:8+6Tm2cv025Vj02++02GAy
MD5:	08167D95584E66B2C579BB44089BD481
SHA1:	D4B8665BBB2D981D1F81105DABFD5DA00BA8BEA6
SHA-256:	1FE86A99341E8BC6367CC54F3928117CCABF413806D74ABA0308ABC8770EE98F
SHA-512:	510A1AF75C33AF089F059AC22790396F4B1CBE1D3AA8D390EEC927A42F258AB65CC7349E90866C33A2695D018F9DB21A0605DD4F153B11492CCC144BCD16DB30
Malicious:	false
Preview:	L..................F.@.. ...@O. .&.... .&.....r...............................P.O. .:i.....+00.../C:\.....................1.....XY.g..PROGRA~2.........O.IXY.g....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....d.1.....XY.g..LOCALP~1..L......XY.gXY.g....rS....................a...L.o.c.a.l.P.l.a.y.b.a.c.k.......2.....bM.z .LOCALP~1.PDF..n......XY.gXY.g.....S........................L.o.c.a.l. .P.l.a.y.b.a.c.k. .U.s.e.r. .M.a.n.u.a.l...p.d.f.......r...............-.......q..................C:\Program Files (x86)\LocalPlayback\Local Playback User Manual.pdf..R.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.o.c.a.l.P.l.a.y.b.a.c.k.\.L.o.c.a.l. .P.l.a.y.b.a.c.k. .U.s.e.r. .M.a.n.u.a.l...p.d.f.$.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.o.c.a.l.P.l.a.y.b.a.c.k.C.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.o.c.a.l.P.l.a.y.b.a.c.k.\.L.o.c.a.l. .P.l.a.y.b.a.c.k. .U.s.e.r. .M.a.n.u.a.l...p

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LocalPlayback\LocalPlayback.lnk

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 24 11:56:07 2024, mtime=Thu Oct 24 11:56:07 2024, atime=Fri Nov 2 14:29:04 2018, length=1877776, window=hide
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	3.409512824212021
Encrypted:	false
SSDEEP:	48:8WnG2CdON0B+mdB+qB5d/B+QB+Ld/B+vd/B+QB+I/B+QB+ragmyg:8WG6F1JGSJZJrgy
MD5:	99EDE4433D954DCCD0371CB361835A10
SHA1:	98B01646382C9EE594F053B2EE7BD8A8A5215D33
SHA-256:	B5A1D624EC4F1272F2A3C20CBE9E36E8B801FEFE2A519CD90A9C83F9C2658975
SHA-512:	FCC2089F555BC1FE48DDB1444D3091846EB2C2307D945F99BB1049F8871D2A8F1BA6560E2E546E2E9E07D5FF18A38ABBDE5D4C849BC70DE1D7D79B88BE2ED7CD
Malicious:	false
Preview:	L..................F.@.. .......&..a....&....x..r...............................P.O. .:i.....+00.../C:\.....................1.....XY.g..PROGRA~2.........O.IXY.g....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....d.1.....XY.g..LOCALP~1..L......XY.gXY.g....rS....................a...L.o.c.a.l.P.l.a.y.b.a.c.k.....p.2.....bM.{ .LOCALP~1.EXE..T......XY.gXY.g.....S........................L.o.c.a.l.P.l.a.y.b.a.c.k...e.x.e.......e...............-.......d..................C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe..E.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.o.c.a.l.P.l.a.y.b.a.c.k.\.L.o.c.a.l.P.l.a.y.b.a.c.k...e.x.e.$.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.o.c.a.l.P.l.a.y.b.a.c.k.6.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.o.c.a.l.P.l.a.y.b.a.c.k.\.L.o.c.a.l.P.l.a.y.b.a.c.k...e.x.e.........%ProgramFiles%\LocalPlayback\LocalPlayback.exe................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LocalPlayback\Uninstall LocalPlayback.lnk

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Icon number=0, Archive, ctime=Thu Oct 24 11:56:05 2024, mtime=Thu Oct 24 11:56:05 2024, atime=Fri Nov 2 14:29:06 2018, length=1191936, window=hide
Category:	modified
Size (bytes):	2442
Entropy (8bit):	3.9013307352043864
Encrypted:	false
SSDEEP:	48:8BG2CdOuTXMgZbIHMdVTVUq4dVTVU1yIEVTVUByYmyg:8o7Gy23Wgy
MD5:	461C28122F6F58BC6BE583BBBE5B2B14
SHA1:	4AA312A3E805DF05D63977C7D5B4DCDFF8BBAA8F
SHA-256:	0970EF692B847821E8628D6D1DF60C3AAA6384D6AD762A02A486FD513F7D30BD
SHA-512:	8608B6C4C6EA8E481EF1465D90E97D2DE832EDFA4B0C30E134591C29A2A6A01DCF67451429C3EBA6F1C2B91E6C33304EEE0154584D47227D1C390D0A1A4E6A75
Malicious:	false
Preview:	L..................F.@.. ....ds..&..%.u..&......r...0......................O....P.O. .:i.....+00.../C:\.....................1.....XY.g..PROGRA~2.........O.IXY.g....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.......1.....XY.g..INSTAL~1..~......XY.gXY.g....`S....................[...I.n.s.t.a.l.l.S.h.i.e.l.d. .I.n.s.t.a.l.l.a.t.i.o.n. .I.n.f.o.r.m.a.t.i.o.n.......1.....XY.g..{6674B~1..~......XY.gXY.g....aS....................Hg..{.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.}.....\.2..0..bM.{ .setup.exe.D......XY.gXY.g....gS........................s.e.t.u.p...e.x.e.......................-..........................C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\setup.exe..}.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.I.n.s.t.a.l.l.S.h.i.e.l.d. .I.n.s.t.a.l.l.a.t.i.o.n. .I.n.f.o.r.m.a.t.i.o.n.\.{.6.6.7.4.B.C.C.5.

C:\ProgramData\Package Cache\{1b103cea-f037-4504-81de-956057b442c3}\state.rsm

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	data
Category:	dropped
Size (bytes):	874
Entropy (8bit):	2.8283643978655695
Encrypted:	false
SSDEEP:	12:GZK34pgMClGttDq+xUFZMAKL+ftun2Q9kXg1Q126TfyeXjcl1sK:cKUgMClc2ZMAKlcFK1L
MD5:	DFB3C25DD94DF0DCF44D8204DB30A1C2
SHA1:	6CE33E7AF48C627F477FA859E9B1A073503DBF19
SHA-256:	D085564CA40DE3E08A3622688E835BF087E8EA86D9DF3D46AAD9FFA3BADF096B
SHA-512:	637DD13519850E1AA6E0B948005F66DDB5EA24213DA2E8DCB67BDF99AECA23A46E419324E8CE3B8AC5F87E0321604DF94CC57CC38CAE8068BDDAC606E97602B8
Malicious:	false
Preview:	A.......................................................................................................................................................................................................................W.i.x.B.u.n.d.l.e.F.o.r.c.e.d.R.e.s.t.a.r.t.P.a.c.k.a.g.e.................W.i.x.B.u.n.d.l.e.L.a.s.t.U.s.e.d.S.o.u.r.c.e.............................W.i.x.B.u.n.d.l.e.N.a.m.e.....<...M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.3. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.2...0...3.0.5.0.1.........W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.........C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.7.7.F.7.B.2.2.3.-.8.4.F.4.-.4.3.A.E.-.9.4.6.9.-.C.C.1.0.7.4.8.8.B.B.8.B.}.\.{.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.}.\.v.c.r.e.d.i.s.t._.x.6.4._.2.0.1.3...e.x.e.....................

C:\ProgramData\Package Cache\{1b103cea-f037-4504-81de-956057b442c3}\vcredist_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462408
Entropy (8bit):	6.935259199929042
Encrypted:	false
SSDEEP:	12288:zymOcB+pwPprnVmLmDsC+FU+ZOSzc9tzruE8l0:zLOsDFncLmKDZOSzQFI0
MD5:	DEE60960E1A4F58051BBD5FAB56BAAD8
SHA1:	9CBB3F53ED6085B93E3814349C9F00AEFB2167F9
SHA-256:	B93A755312C1A3D2B6E50DDFB41A497233949CFCEA894A7375EB618836E270EA
SHA-512:	C7E874BB9910F20261F15F5164FDF98FACF0A98D6FE291706DD843E1EAE4715E9D6B989A07CD91AC57018F89C6C32349E5F5D7F9E78835C088A7EB616115B7FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0............@.................................t!..,........7...............>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	data
Category:	dropped
Size (bytes):	864
Entropy (8bit):	2.8149775775089316
Encrypted:	false
SSDEEP:	12:GZK34pgMClGttDq+xUFZMAKRJ+ftun2QukXg1Q126TfyeXjcl1s:cKUgMClc2ZMAKR4cFK1
MD5:	52FD0EF09FC4E1EC9AAC1946F51578D4
SHA1:	21C9D597FE0836B49ADC7967E8FD726E8E0D45EC
SHA-256:	90967C940752D0009C3BAB1F187AB032C7277074A27562D615E07725D27FD9C8
SHA-512:	7E074F6C10917E1F570C06C8501029A3697711A6FF44B6BFF8839D92CBAB754EF14ED06DF9DB05D49B7F4BAA51095B0A3A783CD2984F9F670F1F9EAD15E124A6
Malicious:	false
Preview:	A.......................................................................................................................................................................................................................W.i.x.B.u.n.d.l.e.F.o.r.c.e.d.R.e.s.t.a.r.t.P.a.c.k.a.g.e.................W.i.x.B.u.n.d.l.e.L.a.s.t.U.s.e.d.S.o.u.r.c.e.............................W.i.x.B.u.n.d.l.e.N.a.m.e.....<...M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.3. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.8.6.). .-. .1.2...0...3.0.5.0.1.........W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.........C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.7.7.F.7.B.2.2.3.-.8.4.F.4.-.4.3.A.E.-.9.4.6.9.-.C.C.1.0.7.4.8.8.B.B.8.B.}.\.{.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.}.\.v.c.r.e.d.i.s.t._.x.8.6...e.x.e.....................

C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	461368
Entropy (8bit):	6.931191292112627
Encrypted:	false
SSDEEP:	12288:iymOcB+pwPprnVmLmDsC+FU+ZOSzDBtzY7UWfR2:iLOsDFncLmKDZOSz1FO5
MD5:	2335AB0C0E19C0EF416D07DF66FEE649
SHA1:	1E8794AFF453F7647A6C149F3D38F7A3FF4CCD1B
SHA-256:	F0E46C0F9B2991FA6D187C6B2BED28139C67804CC58CC45C77F06A6F217CB21A
SHA-512:	518580D7A0D8F9610C8EC0204AE879A91A24325FB5E45348E6F0769AA25A69525992BC0F722DF113993AA29A1A917DE8FBECFB39D547D6F25354C3488BF06A62
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0............@.................................t!..,........7...............>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182008
Entropy (8bit):	5.744800976220097
Encrypted:	false
SSDEEP:	3072:kIFNKUw8ALJ+C2T0FSmmiYQT4TF2E+JYHdeZ2bgA/qrJc:4Un0mT8Sc/T4R1b9xg8P
MD5:	1AE40C548AE265EFF8D25EA7538A5196
SHA1:	D52AECA6FD0739684F78516713B911D53DFE21C1
SHA-256:	5DEBB7234F9A709A8AE79B5DF86253E966F286B27CA87C484D3FA7C5F105A550
SHA-512:	6982C4BFF243B49AF6E93C178E3C68825D4B1688FA976A930B53B8DDE2001080B83BBC3C6650127D0DE175D6C937CA6359B00B8B0C6AA8AC84239B16C6E12E7E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.*.!.D.!.D.!.D../..D.D../..(.D../....D.... .D.!.E.[.D......D.....%.D..... .D.!.. .D..... .D.Rich!.D.........................PE..d...V..U.........."......X...v.................@....................................e.....`..................................................J..................$...................`t..8...............................p............p...............................text....W.......X.................. ..`.rdata.......p.......\..............@..@.data... B...`.......D..............@....pdata..$............`..............@..@.rsrc................v..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\corecomp.ini (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65503
Entropy (8bit):	3.783333450686201
Encrypted:	false
SSDEEP:	1536:biZVg/LPnypGccYM3MFe/Xvv+JcvpqLm416lt91FHWEi7I8qQdeVH3+HF2FnlP5r:gW/LPni+3MFe/XycRj4slt9HHWEi7I8M
MD5:	09D38CECA6A012F4CE5B54F03DB9B21A
SHA1:	01FCB72F22205E406FF9A48C5B98D7B7457D7D98
SHA-256:	F6D7BC8CA6550662166F34407968C7D3669613E50E98A4E40BEC1589E74FF5D1
SHA-512:	8C73CA3AF53A9BAF1B9801F87A8FF759DA9B40637A86567C6CC10AB491ACCB446B40C8966807BD06D52EB57384E2D6A4886510DE338019CFD7EF966B45315BA9
Malicious:	false
Preview:	; Corecomp.ini..;..; This file stores information about files that InstallShield..; will install to the Windows\System folder, such as Windows..; 95 and NT 4.0 core components and DAO, ODBC, and ActiveX files...; ..; The entries have the following format, without a space before ..; or after the equal sign:..;..; <file name>=<properties>..; ..; Currently, following properties are supported:..; 0x00000000 No registry entry is created for this file. It is..; not logged for uninstallation, and is therefore ..; never removed...;..; Inappropriate modification to this file can prevent an..; application from getting Windows 95/Windows NT logo...;..; Last Updated: 2/27/2002; rs....[Win32]....12500852.cpx=0x00000000 ..12510866.cpx=0x00000000 ..12520437.cpx=0x00000000..12520850.cpx=0x00000000..12520860.cpx=0x00000000..12520861.cpx=0x00000000 ..12520863.cpx=0x00000000 ..12520865.cpx=0x00000000..6to4svc.dll=0x00000000..82557ndi.dll=0x00000000..8514a.dll=0x000

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\dotnetinstaller.exe (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23816
Entropy (8bit):	4.157085489956457
Encrypted:	false
SSDEEP:	192:hEm805ZvWFgfXDuQFCl+Z5nYe+PjPrSBO3SwR9F:f8SZvWF/QYQ3nYPLWh4
MD5:	DE5B5C9E5A9192302FE08BEA71E00D61
SHA1:	C6B2D1AF8C92788CA8844B025E2C5D11CF494379
SHA-256:	AFC858FB1D92E8D1F7B735E1A279EA70C7F7A019FE665C826BAF4FC9E5D0F3B1
SHA-512:	AA42786D6B557B769CEDA509984414FD88C38C676F617B6C6CAD23DF72C7E74AE774D245A99FAC601956ED67917119954ECB5AB4C5940BAEE81D7CB5B2EBC438
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D..U..................... .......... ...@....... ....................................@....................................K....@..x............@.......`....................................................... ............... ..H............text........ ...................... ..`.rsrc...x....@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\dotnetinstaller.exe.config (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.677494553177857
Encrypted:	false
SSDEEP:	3:cTIMOoIRuQVK/FNURAmIRMNHNQAolFNURAmIRMNHjKbo5KWREBAW4QIMOn:8IffVKNC7VNQAofC7V2bopuAW4QIT
MD5:	DB722945AB9C024CE55E469644393824
SHA1:	191782B3B4C7BD21FABB3D5B655B7F2DEC2F4F56
SHA-256:	C7E5BDC4B79F7F8C68C5F09C0C055E97FB8C62FE1B5D469B3527AB6B767C8DF2
SHA-512:	40503C28296CEB68428E327AC79326579C067511638263A477534B8E33341F24E2944077ACCDABB947981980F91604B71B6715A1488181B9C48515AB81271ED8
Malicious:	false
Preview:	<configuration>.. <startup>.. <supportedRuntime version="v2.0.50727"/>.. <supportedRuntime version="v4.0"/>.. </startup>..</configuration>

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\DIFxData.ini (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.638552692098388
Encrypted:	false
SSDEEP:	3:m1eAsIdWVVVWhs6E2QVVK2Whsyor3Vg2Wn:mdv0am2QVVgQ3Van
MD5:	1EB6253DEE328C2063CA12CF657BE560
SHA1:	46E01BCBB287873CF59C57B616189505D2BB1607
SHA-256:	6BC8B890884278599E4C0CA4095CEFDF0F5394C5796012D169CC0933E03267A1
SHA-512:	7C573896ABC86D899AFBCE720690454C06DBFAFA97B69BC49B8E0DDEC5590CE16F3CC1A30408314DB7C4206AA95F5C684A6587EA2DA033AECC4F70720FC6189E
Malicious:	false
Preview:	[<Properties>]..DIFx32Supported=No..DIFxIntel64Supported=No..DIFxAMD64Supported=No..

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\FontData.ini (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.175273297885966
Encrypted:	false
SSDEEP:	3:m1eAsCMWRXBQYrD:mdjXIYf
MD5:	8CE28395A49EB4ADA962F828ECA2F130
SHA1:	270730E2969B8B03DB2A08BA93DFE60CBFB36C5F
SHA-256:	A7E91B042CE33490353C00244C0420C383A837E73E6006837A60D3C174102932
SHA-512:	BB712043CDDBE62B5BFDD79796299B0C4DE0883A39F79CD006D3B04A1A2BED74B477DF985F7A89B653E20CB719B94FA255FDAA0819A8C6180C338C01F39B8382
Malicious:	false
Preview:	[<Properties>]..FontRegistration=No..

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\Setup.xml (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.79370143429073
Encrypted:	false
SSDEEP:	6:TM3i0bB9LDYR9zg++RPczg+LnV3zg+0xDXq3vJ++:TM3i0bBNYnh+lQhL9h08c+
MD5:	16E6F308D482E99FBDBCF92265FDCAC1
SHA1:	0698E47E2040A2BD61487BF2E5D0EE2569D0C7AC
SHA-256:	E29757AAEAEDEF80BDE5AF75F82D8F768595EC8C192D2455E41DB006F6E3E25C
SHA-512:	8421CA37CCF2DD0CC0BEA5625D5F60A29D0D5AC0193289F522C6DB76AE56EC40001BC846ED107725550CDE85995060E66293F34D05F5F086C6587A16F8C5C83C
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8'?>.<Configs>..<Translator>...<Value>0</Value>..</Translator>..<LogLevel>...<Value>0</Value>..</LogLevel>..<VersionType>...<Value>0</Value>..</VersionType>..<Skin>...<Value>CommonSkin</Value>..</Skin>.</Configs>

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\StringTable_0x0409.ips (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	3.6325552582561333
Encrypted:	false
SSDEEP:	12:Q+sw2NQ4IistCQ8lCaistCR0I5W8lCaistQQluXistQWs0VlluDuaswBDWGe0u/1:Q+s198CQ8lE8CRw8lE8QQluy8QV+luKt
MD5:	E3BB8788BD30B611F5656F37EC8BB126
SHA1:	1968E7289D4D50A6D3CA42D7B9F502D48F32D14E
SHA-256:	F1E88084CE54C00051C6282C91C28A307D5381B2FF767E613C6CD11F8F3D82A7
SHA-512:	7470AFA98BE5A2708E5CC5D54646241B47E4F23CC323092F16023BFB7E6C9FCC2A8980412D79ED7BEC10A4737D190C9D670891B78AA40318270EF6A5DA70086D
Malicious:	false
Preview:	..[.S.t.r.i.n.g.T.a.b.l.e.:.D.a.t.a.:.0.4.0.9.].....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.O.M.P.L.E.T.E.=.C.o.m.p.l.e.t.e.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.O.M.P.L.E.T.E._.D.E.S.C.=.C.o.m.p.l.e.t.e.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.U.S.T.O.M.=.C.u.s.t.o.m.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.U.S.T.O.M._.D.E.S.C._.P.R.O.=.C.u.s.t.o.m.....I.D.S._.S.Q.L.S.C.R.I.P.T._.I.N.S.T.A.L.L.I.N.G.=.E.x.e.c.u.t.i.n.g. .S.Q.L. .I.n.s.t.a.l.l. .S.c.r.i.p.t...........I.D.S._.S.Q.L.S.C.R.I.P.T._.U.N.I.N.S.T.A.L.L.I.N.G.=.E.x.e.c.u.t.i.n.g. .S.Q.L. .U.n.i.n.s.t.a.l.l. .S.c.r.i.p.t...........I.D._.S.T.R.I.N.G.1.=.h.t.t.p.:././.w.w.w...c.o.m.p.a.n.y...c.o.m.....

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\_isres_0x0409.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1863024
Entropy (8bit):	5.6880660516410595
Encrypted:	false
SSDEEP:	12288:as4d9dfaOdWJIhpJCPtjvntnSb8COevQonCLPub+7Gqi:khrWihDCPtjvntnSb8COevQonCfHi
MD5:	D33CE9D8DA4500CF094FA3ACC8B740A7
SHA1:	DD8C71279AA114B830C786749E07FBC75B838C08
SHA-256:	6E81640032197E610C17AD72427C2E4B17B86893C82151B0C217083E34C1DDB5
SHA-512:	6D09C605CD0CBD8CD1FB7F43F1D6560C683A6B3DBA75C09DAFF8AADD5BCEA01E4BDC39F07E28AD80BC17353FC315982007DF5C6F3CEBCEB82B2C056CCC09610B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..(...{...{...{...{...{,..{J..{...{P..{..{...{,..{...{..{...{Rich...{........PE..L......U...........!.........................................................p...............................................@..(....P..V...........pP.......@.......................................................A...............................text...@........................... ..`.rdata........... ..................@..@.data....f.......P..................@....idata.......@....... ..............@....rsrc...V....P.......0..............@..@.reloc...)...@...0... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\default.pal (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	RIFF (little-endian) data, palette, 1168 bytes, data size 1028, 256 entries, extra bytes 0x6f66666c
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	2.551387347019812
Encrypted:	false
SSDEEP:	12:b126a96IlDkYTYcspSuB0MRG763GDwFGrZYOFBz3WI7KEpw3f6QL7nhem:Ax96Il9T3ISMg76KJrZtT2b5X
MD5:	0ABAFE3F69D053494405061DE2629C82
SHA1:	E414B6F1E9EB416B9895012D24110B844F9F56D1
SHA-256:	8075162DB275EB52F5D691B15FC0D970CB007F5BECE33CE5DB509EDF51C1F020
SHA-512:	63448F2BEF338EA44F3BF9EF35E594EF94B4259F3B2595D77A836E872129B879CEF912E23CF48421BABF1208275E21DA1FABFDC494958BCFCD391C78308EAA27
Malicious:	false
Preview:	RIFF....PAL data..........................................................f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3...............f...3..................f...3...............f..3.....f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3...................f...3..................f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3.....f...f...f...f.f.f.3.f...f...f...f..f.f.f.3.f...f...f...f...f.i.f.3.f...ff..ff..ff..fff.ff3.ff..f3..f3..f3..f3f.f33.f3..f...f...f...f.f.f.3.f...3...3...3...3.f.3.3.3...3...3...3..3.f.3.3.3...3...3...3...3.f.3.3.3...3f..3f..3f..3ff.3f3.3f..33..33..33..33f.333.33..3...3...3...3.f.3.3.3.............f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3.........................................................................................................

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\isrt.dll (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	431344
Entropy (8bit):	7.9730383756562615
Encrypted:	false
SSDEEP:	12288:+l0FRYQwGdo976C3tZZTTCtJJWIPEhvSp0HBvVLT:+g6N39WC3qJWrhvSKhBT
MD5:	DB43DAB8E9B14DFBBF7E0B44F03A8A90
SHA1:	E2E4D4B5F2AF07AFF077880A3F44144233862233
SHA-256:	E342E14B9866563518AEFE3208EA0CF8A2533FF229353DDEFEF475436BF9B5B1
SHA-512:	24B08D34A0D84C53111D2CBA03D4444C826696B22674E04C1CDA142AF89227319D887155B1F83FF195A6053A57A34EB9A8488EDA7BF4A0E2248700B2CE5216F2
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D..P..a...a...a.''....a..'....a..&....a..'..H.a..'....a.......a.......a...`...a.....!.a..&..J.a..&....a..&....a.......a..&....a.Rich..a.........................PE..L......U...........!.....^...6...............p..........................................................................S...\...+....................x...............w..8............................................................................text............>......PEC2MO...... ....rsrc....@.......4...B.............. ....reloc...............v..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\license.rtf (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1054
Category:	dropped
Size (bytes):	11493
Entropy (8bit):	5.05316015112462
Encrypted:	false
SSDEEP:	192:pLfQlCKclJ3oKm9TLRjs9TE9T39Tf9TFe5Zx6vPYULnMU1/agUfVUAxlprmc8lyk:5fQcKX59Ttjs9TE9T39Tf9TFi6YULnM4
MD5:	E7EB45E877C8CB80F56E9DBC9504E757
SHA1:	5E4679A0348B03072CD59621B6666F01ADED8F6F
SHA-256:	2301902EC24434DD7475A3823902851B4BC66D23B25281392E4E310223F7A706
SHA-512:	EC1CD9A3A358BFCEE80318E03616ECCAA14D374DD713D3AE2863AE038C450D97943476EE547938732026C8DAE9ACEB06633608979CD3B466323565D5D2D40A7D
Malicious:	false
Preview:	{\rtf1\adeflang1054\ansi\ansicpg1252\uc1\adeff22\deff0\stshfdbch12\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe2052{\fonttbl{\f0\froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times};}..{\f1\fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f3\froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f5\fmodern\fcharset0\fprq1{\\panose 02070409020205020404}Courier;}..{\f12\froman\fcharset129\fprq2{\\panose 02030600000101010101}Batang{\\falt \'a8\'cfoUAA};}{\f22\froman\fcharset0\fprq2{\\panose 00000000000000000000}Angsana New;}{\f35\fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\f37\froman\fcharset129\fprq2{\\panose 02030600000101010101}@Batang;}{\f38\froman\fcharset238\fprq2 Times New Roman CE{\\falt Times};}{\f39\froman\fcharset204\fprq2 Times New Roman Cyr{\\falt Times};}..{\f41\froman\fcharset161\fprq2 Times New Roman Greek{\\falt Times};}{\f42\froman\fcharset162\fprq2 Times New Roman Tur{\\falt Ti

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\setup.inx (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	data
Category:	dropped
Size (bytes):	256012
Entropy (8bit):	7.372841368757717
Encrypted:	false
SSDEEP:	3072:jUgqLn4zM1TF08meQdQ5NhHMm77hplbnALofCAZz4w5YpTBqqodQcQnnSF7a5INZ:jUgqLIQlddthAo4w0BqWnShYTNtG
MD5:	51CFDC963AB67279BCE6C9D7E7C4B933
SHA1:	66E3E4DA9A3AB8B2AD2717CC772860D6383FB02B
SHA-256:	BDAFEBD536D5E00A4C284CC425CA1D4B45AA155A58F7DFA46CCE02165FBADA57
SHA-512:	25C319E84AC87337D36A68337C79DB1F112FE9C8B7E5146AC041EC61C751C19A31AAA323BD134913F53625C43D27CD4C9763D904003506085708AB7C13573345
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}a.=mQ.Y]A..M1..)!.)........................................}...m..q]}}aMm.U=].E-M.5.=.%.-...............................]......a..(..H....YQQEY.0.o=55.={.gC[..W.....O.So##` ......,..x8........X......]..H.........5MM.5s..gW.CKgCC.....;..TDh..8P@........8.....p.e..Q...\| h......%]1II.1....S[wSS.[.G.W.o....L.`H ..D.. ........t....L......ayyIa......s..w!99.!....Gs[K[............T,.0,,......\|(.....l...P...yyy!a...........w.o.....W.;o?g..+O.....4.,$\.@....<......l......}uuI}.4..@....!99.!..s.w..3{.SGk.......0.D4\.... H.............4...Ye}!e. ..D....c.w......w3.;#.#C.[.THl....(.<,4p,.$.......a..t...8..L..YQQ=Y...w.{o..`.--..S.w3.7+kk .....$..H8@.X,0...y...........x...H...1miMQ.c4....{%9-%%.-c.sO.....'7?..... @\D.....H...................iuUaaUi...MEE%M..gk........?.7wK.....@.\|$d8......$.<................e}}Qe...I]1II.1.W.[.c_.;[s.....g..W..L<l...

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7195312
Entropy (8bit):	7.989078407747941
Encrypted:	false
SSDEEP:	196608:A9OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMELc:fz5x7jLXkmkU4cFec
MD5:	385194EB89B6741781CB9065D8E8158E
SHA1:	AA721DB201DA3F238A9221C1FDF71C504A2DC20C
SHA-256:	C8497C8BB691C748697C429A61F31D253383E3CF1B552925022556875C63A313
SHA-512:	6D36CCF7016961A9F0A41E88F694A8DC30F57EA068D88B805ABDAE2907BD924205DDFF5CC90901504F022597D8E33E78AA70EE25437C83B358F81B513BC65C69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0........m...@.................................t!..,........7............m..>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe (copy)

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6503984
Entropy (8bit):	7.986886773014506
Encrypted:	false
SSDEEP:	98304:hQEKzHx15bWUuBrNatjJh2eNUrzKRL/RaIswn7aBOC5qZxVqFb2iExMc7FvxwGvf:WRDnuBotjJh2emr8L/YIsG7MOgqHG64
MD5:	0FC525B6B7B96A87523DAA7A0013C69D
SHA1:	DF7F0A73BFA077E483E51BFB97F5E2ECEEDFB6A3
SHA-256:	A22895E55B26202EAE166838EDBE2EA6AAD00D7EA600C11F8A31EDE5CBCE2048
SHA-512:	729251371ED208898430040FE48CABD286A5671BD7F472A30E9021B68F73B2D49D85A0879920232426B139520F7E21321BA92646985216BF2F733C64E014A71D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0........c...@.................................t!..,........7..........x.b..>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Users\Public\Desktop\LocalPlayback.lnk

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 24 11:56:07 2024, mtime=Thu Oct 24 11:56:22 2024, atime=Fri Nov 2 14:29:04 2018, length=1877776, window=hide
Category:	dropped
Size (bytes):	2038
Entropy (8bit):	3.405183015995871
Encrypted:	false
SSDEEP:	48:8rnG2CdON0B+mdB+qBEd/B+QB+Ld/B+vd/B+QB+I/B+QB+ragmyg:8rG6FuJGSJZJrgy
MD5:	DDC2AE1264563ADB577006BB6F2BC9EE
SHA1:	24367B2FECBF1AA550D3FAD5E9012F60BAB502F1
SHA-256:	7FD29DBBEE9B51F37478C8B950215A4502BB9500ED32889B9AC096A878F1C37C
SHA-512:	865C34BC4EFB347BB7DFD882094282A5E301CD382603E1642A1978BB5FC79794A236B2AE748620E7F7D98EF542A26EE8784A31335FB790019CCC68F4659DE5A4
Malicious:	false
Preview:	L..................F.@.. .......&..Hb. .&....x..r...............................P.O. .:i.....+00.../C:\.....................1.....XY.g..PROGRA~2.........O.IXY.g....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....d.1.....XY.g..LOCALP~1..L......XY.gXY.g....rS....................a...L.o.c.a.l.P.l.a.y.b.a.c.k.....p.2.....bM.{ .LOCALP~1.EXE..T......XY.gXY.g.....S........................L.o.c.a.l.P.l.a.y.b.a.c.k...e.x.e.......e...............-.......d..................C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe..<.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.o.c.a.l.P.l.a.y.b.a.c.k.\.L.o.c.a.l.P.l.a.y.b.a.c.k...e.x.e.$.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.o.c.a.l.P.l.a.y.b.a.c.k.6.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.o.c.a.l.P.l.a.y.b.a.c.k.\.L.o.c.a.l.P.l.a.y.b.a.c.k...e.x.e.........%ProgramFiles%\LocalPlayback\LocalPlayback.exe..................................................

C:\Users\user\AppData\Local\Temp\8823.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	276992
Entropy (8bit):	2.826431565667897
Encrypted:	false
SSDEEP:	3072:zFaUaT2q0kgRMbfno8m46+6l6767v+T553Y4TMyT8Iqy1jF1QKb4ReZva96Ja96x:B1RMbfnoh46+6l67
MD5:	79150C58384BB928336FE4E0A4750507
SHA1:	823D14337B5D1D5E1A49D14AF87F1C5C6F38DE3C
SHA-256:	B5DB58C0A9945A59CB88FE4680FA1565EF05BB05D40F09F4E086863C94D72124
SHA-512:	5F1752CD150FB5B1CE432CDC7B65792EEB941D03B2EB9F9E3169793F68707574E7BCFD8C9B416644B0C7646EC79E6AEA9BE4168284D89091279A5F0C874F11E6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..............................................................................................................."... ...)...]...#...$...%...&...'...(...6...7...+...,...-......./...0...1...2...3...4...5.......8...T...9...:...;...<...=...>...?...@...A...\...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...U...[...V...W...X...Y...Z...o..._...^.......b...`...a...t...n...d...e...f...g...h...i...j...k...l...m.......u...p...q...r...s...............w...x...y...z...

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20241024085557.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	ASCII text, with very long lines (366), with CRLF line terminators
Category:	modified
Size (bytes):	9511
Entropy (8bit):	5.560910097633401
Encrypted:	false
SSDEEP:	192:aNdxI1uVudbMFELBdjNjq8HnfyKx7YHsfutV68Cut:gLI1EYbn1dh+MusfgZC8
MD5:	A56A39655753ADD7B60FF510BF3D94BB
SHA1:	2FCB4A57A29749872939F7B17F5074AC61582FC0
SHA-256:	0CF2A82B3453E152107EEA129DBEDFE57BAB35E10E582DF6B19787EDC1988C60
SHA-512:	D9A32D55665FE53E09224968B429017ED8DA7AEF36DAE8223FB4C7B0A540A1356E78AFC27879780C6437F01FDABF4DBD1893FBC9B01C9AFB63CD96CD0B1D7979
Malicious:	false
Preview:	[1778:049C][2024-10-24T08:55:57]i001: Burn v3.7.2829.0, Windows v6.3 (Build 9600: Service Pack 0), path: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe, cmdline: '/q -burn.unelevated BurnPipe.{0942DD9A-AF4A-432E-BD2D-A92FFBEDB9E9} {F3730AF5-9EE5-4B54-A568-50E8BA9679B4} 1876'..[1778:049C][2024-10-24T08:55:57]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user~1\AppData\Local\Temp\dd_vcredist_amd64_20241024085557.log'..[1778:049C][2024-10-24T08:55:57]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe'..[1778:049C][2024-10-24T08:55:58]i000: Setting string variable 'WixBundleName' to value 'Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501'..[1778:049C][2024-10-24T08:55:58]i100: Detect begin, 2 packages..[1778:049C][2024

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20241024085557_0_vcRuntimeMinimum_x64.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (588), with CRLF line terminators
Category:	dropped
Size (bytes):	175796
Entropy (8bit):	3.785298795012927
Encrypted:	false
SSDEEP:	1536:1cTp3ZRJ7b+MNnaGLAGe3DSIGapl1CoAwO9nE0+c8wqu1HYtHzAqDnOjTkyyyy75:1CXjTkyyyy7cyjeE+V7e
MD5:	FC2040237AE2D6A3F9BF23E9E368CD99
SHA1:	1EB3B61A89E9E3F5774353DE75F53F402B72502C
SHA-256:	244B34F0D56F3BDDF51628216694D9DDCFFCF6B451836AEA4DE29D1D38AD6D01
SHA-512:	4245A0C93101DB4963F7924267DE870E9F042784A309E911505814BFA260053E6A370CC1AF0A90D1A39C6A1BD46CFBB7BE6ECEC95F2C2EAA9B5C5F09A865C183
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.4./.1.0./.2.0.2.4. . .0.8.:.5.6.:.0.0. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.7.7.F.7.B.2.2.3.-.8.4.F.4.-.4.3.A.E.-.9.4.6.9.-.C.C.1.0.7.4.8.8.B.B.8.B.}.\.{.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.}.\.v.c.r.e.d.i.s.t._.x.6.4._.2.0.1.3...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.5.4.:.C.C.). .[.0.8.:.5.6.:.0.0.:.2.6.1.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.5.4.:.C.C.). .[.0.8.:.5.6.:.0.0.:.2.6.1.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.5.4.:.C.C.). .[.0.8.:.5.6.:.0.0.:.2.6.1.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.A.7.4.9.D.8.E.

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20241024085557_1_vcRuntimeAdditional_x64.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (588), with CRLF line terminators
Category:	dropped
Size (bytes):	198054
Entropy (8bit):	3.805652799185035
Encrypted:	false
SSDEEP:	3072:cDGjm7vDDDDDDDDDDDDD2odT1bUNf9I4OQWG+iQ:Zjo
MD5:	0E1AB16B01927EA742F5B7AA8ACF2AD2
SHA1:	24A909821FB974321B1D21618FB3EF8107FED362
SHA-256:	7A4001D0501D9D85AEFD226A1650A72D2D96F15D4EB771F87278BB8A860AF050
SHA-512:	F16D7AAFFE367F96BC9A32E8E97DA955379D4031DF81833AC4CE7A4366172FF6B421C734CA9400B6777721B77019E59CD45744CBB99A902B04E67BC9C0AFB15D
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.4./.1.0./.2.0.2.4. . .0.8.:.5.6.:.0.1. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.7.7.F.7.B.2.2.3.-.8.4.F.4.-.4.3.A.E.-.9.4.6.9.-.C.C.1.0.7.4.8.8.B.B.8.B.}.\.{.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.}.\.v.c.r.e.d.i.s.t._.x.6.4._.2.0.1.3...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.5.4.:.9.4.). .[.0.8.:.5.6.:.0.1.:.1.8.3.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.5.4.:.9.4.). .[.0.8.:.5.6.:.0.1.:.1.8.3.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.5.4.:.9.4.). .[.0.8.:.5.6.:.0.1.:.1.8.3.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.9.2.9.F.B.D.2.

C:\Users\user\AppData\Local\Temp\dd_vcredist_x86_20241024085549.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	ASCII text, with very long lines (361), with CRLF line terminators
Category:	modified
Size (bytes):	8950
Entropy (8bit):	5.59877194043899
Encrypted:	false
SSDEEP:	192:X25dcR1Du9DXSRc/CaM32s4YMNkuA2VsAxWOWeQX1g6LKwK:G5SR1DudSRyCabYMEcpxr9QX1PKwK
MD5:	1AF8855A2A4A9A4560E069769750B99E
SHA1:	BE526F9321C0ABA29FBFFC72AD09463096B94F45
SHA-256:	17EA40553AF591D50CA7AD3FC3415D25495577FB471ADC631D319645E205FA6A
SHA-512:	5E3A8E1A8B31ED12274C163F604CC465F8EB0D92393783D14078F4E64D6A62D889F75A430CEE085334EEE82480CC60CA98B2E78CFBBA157AB0BB04F9F3A06BB2
Malicious:	false
Preview:	[1C38:106C][2024-10-24T08:55:49]i001: Burn v3.7.2829.0, Windows v6.3 (Build 9600: Service Pack 0), path: C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe, cmdline: '/q -burn.unelevated BurnPipe.{DBEA4BDC-32D1-4571-8C40-9D2304124BE9} {91C7A57E-FB61-4624-AACC-1188F529C9A7} 8120'..[1C38:106C][2024-10-24T08:55:49]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user~1\AppData\Local\Temp\dd_vcredist_x86_20241024085549.log'..[1C38:106C][2024-10-24T08:55:49]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe'..[1C38:106C][2024-10-24T08:55:49]i000: Setting string variable 'WixBundleName' to value 'Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501'..[1C38:106C][2024-10-24T08:55:50]i100: Detect begin, 2 packages..[1C38:106C][2024-10-24T08:55

C:\Users\user\AppData\Local\Temp\dd_vcredist_x86_20241024085549_0_vcRuntimeMinimum_x86.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (588), with CRLF line terminators
Category:	dropped
Size (bytes):	180318
Entropy (8bit):	3.793600719490966
Encrypted:	false
SSDEEP:	1536:ggnmPuAoW2TdcmXUrAWypxgox2ZLr4y6qsh7vSOTzWqDNHFtH4fqTfkjeE71oooQ:gBrjeEpoooox/gEVhLU6b
MD5:	5B76EE2F7DD5977012E6109085D8D9C6
SHA1:	0B17BCD592D64270868E2FEB79D31693F25EBC2B
SHA-256:	6962A3044230034534C537A3E284805D47E3B76BACC9B0E73957CA3E851C830D
SHA-512:	088E2EC21EBC2E2303960CFCD17EDA3EFE04CCDC9285EA0A6D70FE4D190E5B6BD4E98378AA1C8128E8FD676F5F361E02DBB77182DE47A7ED9363BF7846DDB9AE
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.4./.1.0./.2.0.2.4. . .0.8.:.5.5.:.5.2. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.7.7.F.7.B.2.2.3.-.8.4.F.4.-.4.3.A.E.-.9.4.6.9.-.C.C.1.0.7.4.8.8.B.B.8.B.}.\.{.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.}.\.v.c.r.e.d.i.s.t._.x.8.6...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.B.8.:.4.8.). .[.0.8.:.5.5.:.5.2.:.2.8.1.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.B.8.:.4.8.). .[.0.8.:.5.5.:.5.2.:.2.8.1.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.B.8.:.4.8.). .[.0.8.:.5.5.:.5.2.:.2.8.1.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.1.3.A.4.E.E.1.2.-.2.3.E.

C:\Users\user\AppData\Local\Temp\dd_vcredist_x86_20241024085549_1_vcRuntimeAdditional_x86.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (588), with CRLF line terminators
Category:	dropped
Size (bytes):	210672
Entropy (8bit):	3.8017237212319266
Encrypted:	false
SSDEEP:	3072:ZI7jfaQQQQQQttttttttNzUNI+6Fu3jgDneCCy:yjG
MD5:	D00CEAF0A96E8F88AE4BA473DDFB11D4
SHA1:	8C7823C762CD7789233A81528E0FDA381EF4E536
SHA-256:	CCF5DC7C749CA8D3766F2A9942A29D4294C6737F99C8D11EAFB9C550CED1C854
SHA-512:	30DDEDF73CBA51123FA92AA0EA67BD14E4E58298053DBD283FC02B211236498E89CB580BBF344828FBC847D9B6B1FA2620FC376A5F0F0C4C44A8C6E753C72209
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.4./.1.0./.2.0.2.4. . .0.8.:.5.5.:.5.3. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.7.7.F.7.B.2.2.3.-.8.4.F.4.-.4.3.A.E.-.9.4.6.9.-.C.C.1.0.7.4.8.8.B.B.8.B.}.\.{.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.}.\.v.c.r.e.d.i.s.t._.x.8.6...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.B.8.:.8.4.). .[.0.8.:.5.5.:.5.3.:.9.0.6.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.B.8.:.8.4.). .[.0.8.:.5.5.:.5.3.:.9.0.6.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.B.8.:.8.4.). .[.0.8.:.5.5.:.5.3.:.9.0.6.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.F.8.C.F.E.B.2.2.-.A.2.E.

C:\Users\user\AppData\Local\Temp\dd_vcredist_x86_20241024085603.log

Download File

Process:	C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1085
Entropy (8bit):	5.366402065947335
Encrypted:	false
SSDEEP:	24:tQ8tGMsLzAUOAQ3cP2LZktSQdGQXUPtqoQYXHK+EQYUK+EQXPceRNSQIsc:i8t1QrNQKOZkUQAQkPt3QftQMtQXEBQ8
MD5:	380195E629F3F46561CF38D068BFE0C7
SHA1:	77EC61FB8C13009F67B15C536242C7824A1480BF
SHA-256:	848A232A5452EDF1ECA881D98F8B13E3341139E25D4DF91FF123927A21017766
SHA-512:	B361AC04C0F976450F93A54630E3062E065050AAD4E38B3AB88698ECF582EC8BBAF3D5E309501F71FE2FC05F2A63955F954C46AF2035332F3E9222951D39E781
Malicious:	false
Preview:	[1260:10D0][2024-10-24T08:56:03]i001: Burn v3.7.2829.0, Windows v6.3 (Build 9600: Service Pack 0), path: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe, cmdline: ''..[1260:10D0][2024-10-24T08:56:03]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user~1\AppData\Local\Temp\dd_vcredist_x86_20241024085603.log'..[1260:10D0][2024-10-24T08:56:04]i100: Detect begin, 2 packages..[1260:10D0][2024-10-24T08:56:04]i102: Detected related bundle: {1b103cea-f037-4504-81de-956057b442c3}, type: Upgrade, scope: PerMachine, version: 12.0.30501.0, operation: None..[1260:10D0][2024-10-24T08:56:04]i101: Detected package: vcRuntimeMinimum_x86, state: Present, cached: Complete..[1260:10D0][2024-10-24T08:56:04]i101: Detected package: vcRuntimeAdditional_x86, state: Present, cached: Complete..[1260:10D0][2024-10-24T08:56:04]i052: Condition 'VersionNT >= v6.0 OR (VersionNT = v5.1 AND ServicePackLevel >= 2) OR (VersionNT = v5.2 AND ServicePackLevel >= 1)' eva

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\BootstrapperApplicationData.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	5906
Entropy (8bit):	3.74433002895579
Encrypted:	false
SSDEEP:	96:X0eVJbgV2VBLHeBxjn6yeHqbP0wLyc08n6qLUemc4q4I0wMLrycNLihtrtvRtrtB:X001Ks1YjpIDpixLURhfzLG0LiFOBL5e
MD5:	C3C557E32FD3FEA1F2B620BD6206E5AB
SHA1:	13781B7131C0EDDA67D44ACC51AB9AEE578E5EFB
SHA-256:	8830CC689C3C689CB9E8DCA08BAAD699DA1096D7AC1219F6E4891BE621989CA1
SHA-512:	1B9B5A0BEA00C606EF63691B0B992BC5BEA69160A22D65AC18A6DC78EE522EED50B38A5ECDF18C65545804F689AE2AB124999406049F0FE646AE7E42D11C7E88
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.U.x.B.l.o.c.k.e.r. .S.h.o.r.t.N.a.m.e.=.".M.i.n.i.m.u.m.O.S.L.e.v.e.l.". .T.y.p.e.=.".S.t.o.p.". .C.o.n.d.i.t.i.o.n.=.".N.O.T.(.(.V.e.r.s.i.o.n.N.T. .&.g.t.;. .v.6...1.). .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.6...1. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).).". .D.i.s.p.l.a.y.T.e.x.t.=.".#.l.o.c...M.i.n.i.m.u.m.O.S.L.e.v.e.l.". ./.>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T.6.4. .&.g.t.;.=. .v.6...0. .O.R. .(.V.e.r.s.i.o.n.N.T.6.4. .=. .v.5...2. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .X.P. .S.P.1. .(.

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\license.rtf

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	16314
Entropy (8bit):	4.029351854088453
Encrypted:	false
SSDEEP:	384:8mBYdp6JA+sONgANaPLvIewK23S2cV+GiEAxwGbXIa2:YsJA+5W2Q
MD5:	FA463394F28F934AC05AAD9CFEA9CD26
SHA1:	BF4F839C766BC8B4B83DD84011FA55A713FAA345
SHA-256:	6C08B1BE7206BD4AF65BB8756F86A75E1E0E6A17F0F52B06A2946EA9934F59EB
SHA-512:	93746745CF473BA1B7AC5863D1AFA564BCB9610CC86437D1BFDFB926B5A3E46FA40B0FBDA46DBE1EF2FA5AB2CB904F12EC0E12EE09BABB5F447ED5A443875A1F
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\fnil\fprq2\fcharset134 SimSun;}{\f2\froman\fprq2\fcharset2 Symbol;}{\f3\froman\fprq2\fcharset0 Times New Roman;}{\f4\fnil\fprq2\fcharset0 SimSun;}}..{\colortbl ;\red0\green0\blue255;}..{\\generator Riched20 6.2.9200}{\\mmathPr\mnaryLim0\mdispDef1\mwrapIndent1440 }\viewkind4\uc1 ..\pard\nowidctlpar\sb120\sa120\b\f0\fs20\lang2052 MICROSOFT\f1\lang1033\'c8\'ed\'bc\'fe\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\f0\par....\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 MICROSOFT VISUAL C++ REDISTRIBUTABLE FOR VISUAL STUDIO 2013 \par....\pard\nowidctlpar\sb120\sa120\b0\f1\lang2052\'b1\'be\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\'ca\'c7\f0\lang1033 Microsoft Corporation\f1\'a3\'a8\lang2052\'bb\'f2\'c4\'fa\'cb\'f9\'d4\'da\'b5\'d8\'b5\'c4\f0\lang1033 Microsoft Corporation \f1\lang2052\'b9\'d8\'c1\'aa\'b9\'ab\'cb\'be\lang1033\'a3\'a9\lang2052\'d3\'eb\'c4\'fa\'d6\'ae\'bc\'e4\'b4\'ef\'b3\

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\logo.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:	24:q36cnTKM/3kTIQiBmYKHeQWalGt1Sj9kYIt1uZ+bYOQe0IChR95aW:qqiTKMPuUBm7eQJGtYJM1uZCVszaW
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\thm.wxl

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	6.135205733555905
Encrypted:	false
SSDEEP:	48:c5DiTlOtKesi+hDtkQf7lz+W0gopN3m5+3cNONeN1ra8vWqPtlTKxKUTKlKXRoR+:uDiTlV5kQR9GLeE0ZxV6gIV
MD5:	3D1E15DEEACE801322E222969A574F17
SHA1:	58074C83775E1A884FED6679ACF9AC78ABB8A169
SHA-256:	2AC8B7C19A5189662DE36A0581C90DBAD96DF259EC00A28F609B644C3F39F9CA
SHA-512:	10797919845C57C5831234E866D730EBD13255E5BF8BA8087D53F1D0FC5D72DC6D5F6945DBEBEE69ACC6A2E20378750C4B78083AE0390632743C184532358E10
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [..] - .......... ..................Install ........../passive \| /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ..................... UI.../log log.txt - ............. %TEMP% ...

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\thm.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5881
Entropy (8bit):	5.175177119212422
Encrypted:	false
SSDEEP:	96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
MD5:	0056F10A42638EA8B4BEFC614741DDD6
SHA1:	61D488CFBEA063E028A947CB1610EE372D873C9F
SHA-256:	6B1BA0DEA830E556A58C883290FAA5D49C064E546CBFCD0451596A10CC693F87
SHA-512:	5764EC92F65ACC4EBE4DE1E2B58B8817E81E0A6BC2F6E451317347E28D66E1E6A3773D7F18BE067BBB2CB52EF1FA267754AD2BF2529286CF53730A03409D398E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="64" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="80" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader)</T

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.ba1\wixstdba.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	6.262646414883502
Encrypted:	false
SSDEEP:	1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
MD5:	A52E5220EFB60813B31A82D101A97DCB
SHA1:	56E16E4DF0944CB07E73A01301886644F062D79B
SHA-256:	E7C8E7EDD9112137895820E789BAAAECA41626B01FB99FEDE82968DDB66D02CF
SHA-512:	D6565BA18B5B9795D6BDE3EF94D8F7CD77BF8BB69BA3FE7ADEFB80FC7C5D888CDFDC79238D86A0839846AEA4A1E51FC0CAED3D62F7054885E8B15FAD9F6C654E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................x=....x...... .....0.....n..x.....x8....x9....x>...Rich..........................PE..L......R...........!.....2..........1........P...............................0.......1....@.............................................l...........................0S..............................`...@............P...............................text...M0.......2.................. ..`.rdata..yd...P...f...6..............@..@.data..../..........................@....rsrc...l...........................@..@.reloc..B ......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\.be\vcredist_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462408
Entropy (8bit):	6.935259199929042
Encrypted:	false
SSDEEP:	12288:zymOcB+pwPprnVmLmDsC+FU+ZOSzc9tzruE8l0:zLOsDFncLmKDZOSzQFI0
MD5:	DEE60960E1A4F58051BBD5FAB56BAAD8
SHA1:	9CBB3F53ED6085B93E3814349C9F00AEFB2167F9
SHA-256:	B93A755312C1A3D2B6E50DDFB41A497233949CFCEA894A7375EB618836E270EA
SHA-512:	C7E874BB9910F20261F15F5164FDF98FACF0A98D6FE291706DD843E1EAE4715E9D6B989A07CD91AC57018F89C6C32349E5F5D7F9E78835C088A7EB616115B7FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0............@.................................t!..,........7...............>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	Microsoft Cabinet archive data, 5572128 bytes, 14 files, at 0x44 +A "F_CENTRAL_mfc120_x64" +A "F_CENTRAL_mfc120chs_x64", flags 0x4, number 1, extra bytes 20 in head, 369 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	5588256
Entropy (8bit):	7.99767041850619
Encrypted:	true
SSDEEP:	98304:Hg4abEOU/Md/0jHDSSBEnOEEYiCh36RawfXnZGZ+O/nBymG6YvO3ukHkEV6xhJch:A44EOU/Mp0CKCLE7ChqRawcZ+Ensf6Ow
MD5:	0BEEF111C0BFB2062C0BB46AA1370063
SHA1:	BD7528FEA489F81F79D6EFCFE018DA1C6C9B2103
SHA-256:	4FFACA883B53AB6DF5898C7B1E1F02D39CEB33E2061E77A6C4F42984395568C0
SHA-512:	873CE73ABBB6FD228C49870461C48DEAFB967536D0BA3CD21CBC479824553B69FD774DC7C0D2110FEB0E198AAC27390A118E84D925FEF257FDAB21321ED9C430
Malicious:	false
Preview:	MSCF.... .U.....D........................... .U..?..........l...q.....U.......DCL. .F_CENTRAL_mfc120_x64.......U...DCL. .F_CENTRAL_mfc120chs_x64.....@GV...DCL. .F_CENTRAL_mfc120cht_x64..$....V...DCL. .F_CENTRAL_mfc120deu_x64...... X...DCL. .F_CENTRAL_mfc120enu_x64.. ..8.Y...DCL. .F_CENTRAL_mfc120esn_x64..$...?Z...DCL. .F_CENTRAL_mfc120fra_x64......d[...DCL. .F_CENTRAL_mfc120ita_x64.....0.\...DCL. .F_CENTRAL_mfc120jpn_x64......S]...DCL. .F_CENTRAL_mfc120kor_x64......$^...DCL. .F_CENTRAL_mfc120rus_x64...U.(9_...DCL. .F_CENTRAL_mfc120u_x64..f...3....DCL. .F_CENTRAL_mfcm120_x64..f..h.....DCL. .F_CENTRAL_mfcm120u_x64.....8;..CK.}.xT....$K........]...n..]..].@.3.J..X..v%...%.e\.O.bK......! U.BM"..DP.Q{.B........#.....}......g.s.33.N..V%.J....hT..I..#...N.$...r.........s.....w.......1s.9...w.r...q.3.Q0n.....uu..]2u..'...........?.Wi....Jo...?e...7S}...?.R{..R.k./!X.......?....?.........+).......Gc-......$=.y.x..E...5..$=....T..S.l.]j..1."I. ."qJ.....N.........3g7..Q...I

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\cab5046A8AB272BF37297BB7928664C9503

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	Microsoft Cabinet archive data, 1018378 bytes, 5 files, at 0x44 +A "F_CENTRAL_msvcp120_x64" +A "F_CENTRAL_msvcr120_x64", flags 0x4, number 1, extra bytes 20 in head, 80 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1034506
Entropy (8bit):	7.9961086563023605
Encrypted:	true
SSDEEP:	24576:0oyrq0XyESRH8bAWElH8ffJjZXfOBJtTHO:0oyrqzbRuRElWxjZPONu
MD5:	8A8D47DCEA8F149B188D55EE80C2EA2D
SHA1:	DFDB1EAC5EACF6B094897D12699970CC02CDFA6C
SHA-256:	9B805FFEE2DAEAB2F0A074026D07CE1050CA0B20778D1C8A649FE07241CCFA65
SHA-512:	EF081B2B401A779FB374874D26C65C4C7D2E70C980946E343C135DEA67C3C78B1134FB3D69FB1366C5E88B729490B99250304AEA5413ECE9AE6D29690D520A3F
Malicious:	false
Preview:	MSCF............D................................?..............P.............DCL. .F_CENTRAL_msvcp120_x64...........DCL. .F_CENTRAL_msvcr120_x64..Z..@.....DCL. .F_CENTRAL_vcamp120_x64..p.... ...DCL. .F_CENTRAL_vccorlib120_x64.......%...DCL. .F_CENTRAL_vcomp120_x64....o.4..CK.}.x.E.xO2.&......`.qU6.P0.NH"=f.......w....s......x.......xL.$..! ......t!...^U....p....../.N...w.wT5.7W... ..G..a.....3.g...=..(.....u&...G..>.YT\|...w;'N..{..['9.K.q.~.3k.H....6.Wbb.d..C.N.....P.i.cL.t..0..K....;..=..0~.......>N..O....s.u(]G.>...$!/[.n.?N.`...Y.p..CL.0."......j..y&...1................u.Io._Z..n.F..._........@{AE.4....uw..r.".^8..H.[......qBQ...aa\...J.p.q..!....a.@]...&x'.B..c.O..\.,ap.;.^.L.\.c..B?.......b.D#..p........x.b<....M..^.D.!...p...n.....D%..."4.....*.7..Nx..........jZ<>.yz.....@v._].+.a.X.1....]#..S.7d[....5.7..t..#.....:.%.$.S......9...:....e.4...x....D../...).....c...#......a.c..b....x:.t.;..z#.......:\|. ]...+N.....u7..-.&y.......F,z..N.s....

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\vcRuntimeAdditional_x64

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005., Template: x64;1033, Revision Number: {0990E7AB-85D7-456A-B8F8-1E1E56A29571}, Create Time/Date: Sat Oct 5 11:36:18 2013, Last Saved Time/Date: Sat Oct 5 11:36:18 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.7908315301004905
Encrypted:	false
SSDEEP:	3072:gJRJyjFGJvLIcXcSqviQICInggp/lVNmbQ8K:vSIcXgvi37k
MD5:	03FF53F29935C047D7630297E17B96E1
SHA1:	6F922B2D00A6C3274B39F0161C9B89C7AEFA9EB5
SHA-256:	F2C8327F44A0B47619AF5B47D37A90D0F3F7C61D94768AEFE8D8ADFC84A8ED55
SHA-512:	93F5CCB7B276CB089E511201417F522B34E8F7794CEFA8A24440C22B03C8AF81602852E42AC13BEF6078A212D746FB22E76CA72BFC8D185757FCB4B88CBF89B6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{1b103cea-f037-4504-81de-956057b442c3}\vcRuntimeMinimum_x64

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005., Template: x64;1033, Revision Number: {FE26E34E-F44B-4B4D-A2C9-878D87759F44}, Create Time/Date: Sat Oct 5 11:36:26 2013, Last Saved Time/Date: Sat Oct 5 11:36:26 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.731930109143771
Encrypted:	false
SSDEEP:	3072:qPSJyjFGJvLIcXcSqviQICInggioVNmzM+8:0SIcXgvi3L8
MD5:	6DC9B26E10641A0D15DCC60A26B38906
SHA1:	68AD317CD51C85AAFECD11E765823B39E0EE952E
SHA-256:	25284A481A749AA531682505AAAFDCFA929318E9970EF94B64EBDACC3A089490
SHA-512:	9312DD991FA80113D2732A53E85EF3762D89812F64626FF37B1213694FD2E27B7304FAD06FC7FA161BE6F377206BEB6CE88609E4D161A24E6927F59FDF7DD8D3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISB8A8F.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182008
Entropy (8bit):	5.744800976220097
Encrypted:	false
SSDEEP:	3072:kIFNKUw8ALJ+C2T0FSmmiYQT4TF2E+JYHdeZ2bgA/qrJc:4Un0mT8Sc/T4R1b9xg8P
MD5:	1AE40C548AE265EFF8D25EA7538A5196
SHA1:	D52AECA6FD0739684F78516713B911D53DFE21C1
SHA-256:	5DEBB7234F9A709A8AE79B5DF86253E966F286B27CA87C484D3FA7C5F105A550
SHA-512:	6982C4BFF243B49AF6E93C178E3C68825D4B1688FA976A930B53B8DDE2001080B83BBC3C6650127D0DE175D6C937CA6359B00B8B0C6AA8AC84239B16C6E12E7E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.*.!.D.!.D.!.D../..D.D../..(.D../....D.... .D.!.E.[.D......D.....%.D..... .D.!.. .D..... .D.Rich!.D.........................PE..d...V..U.........."......X...v.................@....................................e.....`..................................................J..................$...................`t..8...............................p............p...............................text....W.......X.................. ..`.rdata.......p.......\..............@..@.data... B...`.......D..............@....pdata..$............`..............@..@.rsrc................v..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\cor8A2E.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65503
Entropy (8bit):	3.783333450686201
Encrypted:	false
SSDEEP:	1536:biZVg/LPnypGccYM3MFe/Xvv+JcvpqLm416lt91FHWEi7I8qQdeVH3+HF2FnlP5r:gW/LPni+3MFe/XycRj4slt9HHWEi7I8M
MD5:	09D38CECA6A012F4CE5B54F03DB9B21A
SHA1:	01FCB72F22205E406FF9A48C5B98D7B7457D7D98
SHA-256:	F6D7BC8CA6550662166F34407968C7D3669613E50E98A4E40BEC1589E74FF5D1
SHA-512:	8C73CA3AF53A9BAF1B9801F87A8FF759DA9B40637A86567C6CC10AB491ACCB446B40C8966807BD06D52EB57384E2D6A4886510DE338019CFD7EF966B45315BA9
Malicious:	false
Preview:	; Corecomp.ini..;..; This file stores information about files that InstallShield..; will install to the Windows\System folder, such as Windows..; 95 and NT 4.0 core components and DAO, ODBC, and ActiveX files...; ..; The entries have the following format, without a space before ..; or after the equal sign:..;..; <file name>=<properties>..; ..; Currently, following properties are supported:..; 0x00000000 No registry entry is created for this file. It is..; not logged for uninstallation, and is therefore ..; never removed...;..; Inappropriate modification to this file can prevent an..; application from getting Windows 95/Windows NT logo...;..; Last Updated: 2/27/2002; rs....[Win32]....12500852.cpx=0x00000000 ..12510866.cpx=0x00000000 ..12520437.cpx=0x00000000..12520850.cpx=0x00000000..12520860.cpx=0x00000000..12520861.cpx=0x00000000 ..12520863.cpx=0x00000000 ..12520865.cpx=0x00000000..6to4svc.dll=0x00000000..82557ndi.dll=0x00000000..8514a.dll=0x000

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\dot8A6E.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23816
Entropy (8bit):	4.157085489956457
Encrypted:	false
SSDEEP:	192:hEm805ZvWFgfXDuQFCl+Z5nYe+PjPrSBO3SwR9F:f8SZvWF/QYQ3nYPLWh4
MD5:	DE5B5C9E5A9192302FE08BEA71E00D61
SHA1:	C6B2D1AF8C92788CA8844B025E2C5D11CF494379
SHA-256:	AFC858FB1D92E8D1F7B735E1A279EA70C7F7A019FE665C826BAF4FC9E5D0F3B1
SHA-512:	AA42786D6B557B769CEDA509984414FD88C38C676F617B6C6CAD23DF72C7E74AE774D245A99FAC601956ED67917119954ECB5AB4C5940BAEE81D7CB5B2EBC438
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D..U..................... .......... ...@....... ....................................@....................................K....@..x............@.......`....................................................... ............... ..H............text........ ...................... ..`.rsrc...x....@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\dot8A7E.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.677494553177857
Encrypted:	false
SSDEEP:	3:cTIMOoIRuQVK/FNURAmIRMNHNQAolFNURAmIRMNHjKbo5KWREBAW4QIMOn:8IffVKNC7VNQAofC7V2bopuAW4QIT
MD5:	DB722945AB9C024CE55E469644393824
SHA1:	191782B3B4C7BD21FABB3D5B655B7F2DEC2F4F56
SHA-256:	C7E5BDC4B79F7F8C68C5F09C0C055E97FB8C62FE1B5D469B3527AB6B767C8DF2
SHA-512:	40503C28296CEB68428E327AC79326579C067511638263A477534B8E33341F24E2944077ACCDABB947981980F91604B71B6715A1488181B9C48515AB81271ED8
Malicious:	false
Preview:	<configuration>.. <startup>.. <supportedRuntime version="v2.0.50727"/>.. <supportedRuntime version="v4.0"/>.. </startup>..</configuration>

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\DIF8A2D.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.638552692098388
Encrypted:	false
SSDEEP:	3:m1eAsIdWVVVWhs6E2QVVK2Whsyor3Vg2Wn:mdv0am2QVVgQ3Van
MD5:	1EB6253DEE328C2063CA12CF657BE560
SHA1:	46E01BCBB287873CF59C57B616189505D2BB1607
SHA-256:	6BC8B890884278599E4C0CA4095CEFDF0F5394C5796012D169CC0933E03267A1
SHA-512:	7C573896ABC86D899AFBCE720690454C06DBFAFA97B69BC49B8E0DDEC5590CE16F3CC1A30408314DB7C4206AA95F5C684A6587EA2DA033AECC4F70720FC6189E
Malicious:	false
Preview:	[<Properties>]..DIFx32Supported=No..DIFxIntel64Supported=No..DIFxAMD64Supported=No..

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\Fon8A1D.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.175273297885966
Encrypted:	false
SSDEEP:	3:m1eAsCMWRXBQYrD:mdjXIYf
MD5:	8CE28395A49EB4ADA962F828ECA2F130
SHA1:	270730E2969B8B03DB2A08BA93DFE60CBFB36C5F
SHA-256:	A7E91B042CE33490353C00244C0420C383A837E73E6006837A60D3C174102932
SHA-512:	BB712043CDDBE62B5BFDD79796299B0C4DE0883A39F79CD006D3B04A1A2BED74B477DF985F7A89B653E20CB719B94FA255FDAA0819A8C6180C338C01F39B8382
Malicious:	false
Preview:	[<Properties>]..FontRegistration=No..

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\Set8864.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.79370143429073
Encrypted:	false
SSDEEP:	6:TM3i0bB9LDYR9zg++RPczg+LnV3zg+0xDXq3vJ++:TM3i0bBNYnh+lQhL9h08c+
MD5:	16E6F308D482E99FBDBCF92265FDCAC1
SHA1:	0698E47E2040A2BD61487BF2E5D0EE2569D0C7AC
SHA-256:	E29757AAEAEDEF80BDE5AF75F82D8F768595EC8C192D2455E41DB006F6E3E25C
SHA-512:	8421CA37CCF2DD0CC0BEA5625D5F60A29D0D5AC0193289F522C6DB76AE56EC40001BC846ED107725550CDE85995060E66293F34D05F5F086C6587A16F8C5C83C
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8'?>.<Configs>..<Translator>...<Value>0</Value>..</Translator>..<LogLevel>...<Value>0</Value>..</LogLevel>..<VersionType>...<Value>0</Value>..</VersionType>..<Skin>...<Value>CommonSkin</Value>..</Skin>.</Configs>

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\Setup.xml

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	262
Entropy (8bit):	4.832996419715382
Encrypted:	false
SSDEEP:	6:TMVBd/pmRjz0zg+oPmRjQjzg+oPjIVuHzg+oPsxuITq3vJ+oPiN:TMHdBmKhsmG3hsjLhsmKcsc
MD5:	3B334A3B7167E41C12F4F68FB7185056
SHA1:	EDB887C5FAB40378E455899C52E548D1F10A6A50
SHA-256:	D40F7B546B8946B73DC50552CDF24AE4F083272379709624A264D1B4053195DE
SHA-512:	07941632801BED5F5EEC0DECEDD78CF908668B09201CC37D133E81C8F2E26F31C8992C77DDE35E30BB19ECB04DDF16E76A25EFA7279C57572F173A526E9723D3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Configs>...<Translator>....<Value>0</Value>...</Translator>...<LogLevel>....<Value>0</Value>...</LogLevel>...<VersionType>....<Value>0</Value>...</VersionType>...<Skin>....<Value>CommonSkin</Value>...</Skin>..</Configs>..

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\Str8AA0.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	3.6325552582561333
Encrypted:	false
SSDEEP:	12:Q+sw2NQ4IistCQ8lCaistCR0I5W8lCaistQQluXistQWs0VlluDuaswBDWGe0u/1:Q+s198CQ8lE8CRw8lE8QQluy8QV+luKt
MD5:	E3BB8788BD30B611F5656F37EC8BB126
SHA1:	1968E7289D4D50A6D3CA42D7B9F502D48F32D14E
SHA-256:	F1E88084CE54C00051C6282C91C28A307D5381B2FF767E613C6CD11F8F3D82A7
SHA-512:	7470AFA98BE5A2708E5CC5D54646241B47E4F23CC323092F16023BFB7E6C9FCC2A8980412D79ED7BEC10A4737D190C9D670891B78AA40318270EF6A5DA70086D
Malicious:	false
Preview:	..[.S.t.r.i.n.g.T.a.b.l.e.:.D.a.t.a.:.0.4.0.9.].....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.O.M.P.L.E.T.E.=.C.o.m.p.l.e.t.e.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.O.M.P.L.E.T.E._.D.E.S.C.=.C.o.m.p.l.e.t.e.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.U.S.T.O.M.=.C.u.s.t.o.m.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.U.S.T.O.M._.D.E.S.C._.P.R.O.=.C.u.s.t.o.m.....I.D.S._.S.Q.L.S.C.R.I.P.T._.I.N.S.T.A.L.L.I.N.G.=.E.x.e.c.u.t.i.n.g. .S.Q.L. .I.n.s.t.a.l.l. .S.c.r.i.p.t...........I.D.S._.S.Q.L.S.C.R.I.P.T._.U.N.I.N.S.T.A.L.L.I.N.G.=.E.x.e.c.u.t.i.n.g. .S.Q.L. .U.n.i.n.s.t.a.l.l. .S.c.r.i.p.t...........I.D._.S.T.R.I.N.G.1.=.h.t.t.p.:././.w.w.w...c.o.m.p.a.n.y...c.o.m.....

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\_is8AD2.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1863024
Entropy (8bit):	5.6880660516410595
Encrypted:	false
SSDEEP:	12288:as4d9dfaOdWJIhpJCPtjvntnSb8COevQonCLPub+7Gqi:khrWihDCPtjvntnSb8COevQonCfHi
MD5:	D33CE9D8DA4500CF094FA3ACC8B740A7
SHA1:	DD8C71279AA114B830C786749E07FBC75B838C08
SHA-256:	6E81640032197E610C17AD72427C2E4B17B86893C82151B0C217083E34C1DDB5
SHA-512:	6D09C605CD0CBD8CD1FB7F43F1D6560C683A6B3DBA75C09DAFF8AADD5BCEA01E4BDC39F07E28AD80BC17353FC315982007DF5C6F3CEBCEB82B2C056CCC09610B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..(...{...{...{...{...{,..{J..{...{P..{..{...{,..{...{..{...{Rich...{........PE..L......U...........!.........................................................p...............................................@..(....P..V...........pP.......@.......................................................A...............................text...@........................... ..`.rdata........... ..................@..@.data....f.......P..................@....idata.......@....... ..............@....rsrc...V....P.......0..............@..@.reloc...)...@...0... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\def8AC1.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	RIFF (little-endian) data, palette, 1168 bytes, data size 1028, 256 entries, extra bytes 0x6f66666c
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	2.551387347019812
Encrypted:	false
SSDEEP:	12:b126a96IlDkYTYcspSuB0MRG763GDwFGrZYOFBz3WI7KEpw3f6QL7nhem:Ax96Il9T3ISMg76KJrZtT2b5X
MD5:	0ABAFE3F69D053494405061DE2629C82
SHA1:	E414B6F1E9EB416B9895012D24110B844F9F56D1
SHA-256:	8075162DB275EB52F5D691B15FC0D970CB007F5BECE33CE5DB509EDF51C1F020
SHA-512:	63448F2BEF338EA44F3BF9EF35E594EF94B4259F3B2595D77A836E872129B879CEF912E23CF48421BABF1208275E21DA1FABFDC494958BCFCD391C78308EAA27
Malicious:	false
Preview:	RIFF....PAL data..........................................................f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3...............f...3..................f...3...............f..3.....f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3...................f...3..................f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3.....f...f...f...f.f.f.3.f...f...f...f..f.f.f.3.f...f...f...f...f.i.f.3.f...ff..ff..ff..fff.ff3.ff..f3..f3..f3..f3f.f33.f3..f...f...f...f.f.f.3.f...3...3...3...3.f.3.3.3...3...3...3..3.f.3.3.3...3...3...3...3.f.3.3.3...3f..3f..3f..3ff.3f3.3f..33..33..33..33f.333.33..3...3...3...3.f.3.3.3.............f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3.........................................................................................................

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\isr8AA1.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	431344
Entropy (8bit):	7.9730383756562615
Encrypted:	false
SSDEEP:	12288:+l0FRYQwGdo976C3tZZTTCtJJWIPEhvSp0HBvVLT:+g6N39WC3qJWrhvSKhBT
MD5:	DB43DAB8E9B14DFBBF7E0B44F03A8A90
SHA1:	E2E4D4B5F2AF07AFF077880A3F44144233862233
SHA-256:	E342E14B9866563518AEFE3208EA0CF8A2533FF229353DDEFEF475436BF9B5B1
SHA-512:	24B08D34A0D84C53111D2CBA03D4444C826696B22674E04C1CDA142AF89227319D887155B1F83FF195A6053A57A34EB9A8488EDA7BF4A0E2248700B2CE5216F2
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D..P..a...a...a.''....a..'....a..&....a..'..H.a..'....a.......a.......a...`...a.....!.a..&..J.a..&....a..&....a.......a..&....a.Rich..a.........................PE..L......U...........!.....^...6...............p..........................................................................S...\...+....................x...............w..8............................................................................text............>......PEC2MO...... ....rsrc....@.......4...B.............. ....reloc...............v..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\lic8854.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1054
Category:	dropped
Size (bytes):	11493
Entropy (8bit):	5.05316015112462
Encrypted:	false
SSDEEP:	192:pLfQlCKclJ3oKm9TLRjs9TE9T39Tf9TFe5Zx6vPYULnMU1/agUfVUAxlprmc8lyk:5fQcKX59Ttjs9TE9T39Tf9TFi6YULnM4
MD5:	E7EB45E877C8CB80F56E9DBC9504E757
SHA1:	5E4679A0348B03072CD59621B6666F01ADED8F6F
SHA-256:	2301902EC24434DD7475A3823902851B4BC66D23B25281392E4E310223F7A706
SHA-512:	EC1CD9A3A358BFCEE80318E03616ECCAA14D374DD713D3AE2863AE038C450D97943476EE547938732026C8DAE9ACEB06633608979CD3B466323565D5D2D40A7D
Malicious:	false
Preview:	{\rtf1\adeflang1054\ansi\ansicpg1252\uc1\adeff22\deff0\stshfdbch12\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe2052{\fonttbl{\f0\froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times};}..{\f1\fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f3\froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f5\fmodern\fcharset0\fprq1{\\panose 02070409020205020404}Courier;}..{\f12\froman\fcharset129\fprq2{\\panose 02030600000101010101}Batang{\\falt \'a8\'cfoUAA};}{\f22\froman\fcharset0\fprq2{\\panose 00000000000000000000}Angsana New;}{\f35\fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\f37\froman\fcharset129\fprq2{\\panose 02030600000101010101}@Batang;}{\f38\froman\fcharset238\fprq2 Times New Roman CE{\\falt Times};}{\f39\froman\fcharset204\fprq2 Times New Roman Cyr{\\falt Times};}..{\f41\froman\fcharset161\fprq2 Times New Roman Greek{\\falt Times};}{\f42\froman\fcharset162\fprq2 Times New Roman Tur{\\falt Ti

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\set8843.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	data
Category:	dropped
Size (bytes):	256012
Entropy (8bit):	7.372841368757717
Encrypted:	false
SSDEEP:	3072:jUgqLn4zM1TF08meQdQ5NhHMm77hplbnALofCAZz4w5YpTBqqodQcQnnSF7a5INZ:jUgqLIQlddthAo4w0BqWnShYTNtG
MD5:	51CFDC963AB67279BCE6C9D7E7C4B933
SHA1:	66E3E4DA9A3AB8B2AD2717CC772860D6383FB02B
SHA-256:	BDAFEBD536D5E00A4C284CC425CA1D4B45AA155A58F7DFA46CCE02165FBADA57
SHA-512:	25C319E84AC87337D36A68337C79DB1F112FE9C8B7E5146AC041EC61C751C19A31AAA323BD134913F53625C43D27CD4C9763D904003506085708AB7C13573345
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}a.=mQ.Y]A..M1..)!.)........................................}...m..q]}}aMm.U=].E-M.5.=.%.-...............................]......a..(..H....YQQEY.0.o=55.={.gC[..W.....O.So##` ......,..x8........X......]..H.........5MM.5s..gW.CKgCC.....;..TDh..8P@........8.....p.e..Q...\| h......%]1II.1....S[wSS.[.G.W.o....L.`H ..D.. ........t....L......ayyIa......s..w!99.!....Gs[K[............T,.0,,......\|(.....l...P...yyy!a...........w.o.....W.;o?g..+O.....4.,$\.@....<......l......}uuI}.4..@....!99.!..s.w..3{.SGk.......0.D4\.... H.............4...Ye}!e. ..D....c.w......w3.;#.#C.[.THl....(.<,4p,.$.......a..t...8..L..YQQ=Y...w.{o..`.--..S.w3.7+kk .....$..H8@.X,0...y...........x...H...1miMQ.c4....{%9-%%.-c.sO.....'7?..... @\D.....H...................iuUaaUi...MEE%M..gk........?.7wK.....@.\|$d8......$.<................e}}Qe...I]1II.1.W.[.c_.;[s.....g..W..L<l...

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcr8865.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7195312
Entropy (8bit):	7.989078407747941
Encrypted:	false
SSDEEP:	196608:A9OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMELc:fz5x7jLXkmkU4cFec
MD5:	385194EB89B6741781CB9065D8E8158E
SHA1:	AA721DB201DA3F238A9221C1FDF71C504A2DC20C
SHA-256:	C8497C8BB691C748697C429A61F31D253383E3CF1B552925022556875C63A313
SHA-512:	6D36CCF7016961A9F0A41E88F694A8DC30F57EA068D88B805ABDAE2907BD924205DDFF5CC90901504F022597D8E33E78AA70EE25437C83B358F81B513BC65C69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0........m...@.................................t!..,........7............m..>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcr8951.tmp

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6503984
Entropy (8bit):	7.986886773014506
Encrypted:	false
SSDEEP:	98304:hQEKzHx15bWUuBrNatjJh2eNUrzKRL/RaIswn7aBOC5qZxVqFb2iExMc7FvxwGvf:WRDnuBotjJh2emr8L/YIsG7MOgqHG64
MD5:	0FC525B6B7B96A87523DAA7A0013C69D
SHA1:	DF7F0A73BFA077E483E51BFB97F5E2ECEEDFB6A3
SHA-256:	A22895E55B26202EAE166838EDBE2EA6AAD00D7EA600C11F8A31EDE5CBCE2048
SHA-512:	729251371ED208898430040FE48CABD286A5671BD7F472A30E9021B68F73B2D49D85A0879920232426B139520F7E21321BA92646985216BF2F733C64E014A71D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0........c...@.................................t!..,........7..........x.b..>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\0x0409.ini

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	22490
Entropy (8bit):	3.484827950705229
Encrypted:	false
SSDEEP:	384:CTmyuV//BiTbh/Y4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/N/lWr0aa0Mhs+XVgv
MD5:	8586214463BD73E1C2716113E5BD3E13
SHA1:	F02E3A76FD177964A846D4AA0A23F738178DB2BE
SHA-256:	089D3068E42958DD2C0AEC668E5B7E57B7584ACA5C77132B1BCBE3A1DA33EF54
SHA-512:	309200F38D0E29C9AAA99BB6D95F4347F8A8C320EB65742E7C539246AD9B759608BD5151D1C5D1D05888979DAA38F2B6C3BF492588B212B583B8ADBE81FA161B
Malicious:	false
Preview:	..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\0x0804.ini

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10758
Entropy (8bit):	5.783506671145112
Encrypted:	false
SSDEEP:	192:Nw8vvP/KID2jmYt1bRNJQYRyljRpRIHDJCL0PvrmeAdovo/BVEU3EDa+7VUX7AoU:7XD6bP9PvabCU6l7
MD5:	6F4C6D5B044895684A1E11BFE98B2ABD
SHA1:	45EFEC6E70E66A248B25ED1437BC336B846F6F19
SHA-256:	792E2ED82640E22F9D86F19EC34FD4BB89450B8B874EDEB4FDCBE07935A63110
SHA-512:	04727EB781330FD11C2B3ADECDECE5FA6ED9501061497E41EFE9ED528C2E95A724AD8E6D02180F31C6E810C28F94751E6944FCDB6D7415C338BBF5CF82726973
Malicious:	false
Preview:	..[.P.r.o.p.e.r.t.i.e.s.].....F.o.n.t.N.a.m.e.=..[SO....F.o.n.t.S.i.z.e.=.9.........[.0.x.0.8.0.4.].....1.1.0.0.=..[..z.^.R.Y.S.......1.1.0.1.=.%.s.....1.1.0.2.=.%.1. ..[..z.^ck(W.Q.Y .%.2....[.\._.[.`.[.biRYO.v.[...z.0...z.P.0....1.1.0.3.=.ck(W.h.g.d\O.\|.~Hr,g....1.1.0.4.=.ck(W.h.g .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .Hr,g....1.1.0.5.=.ck(WM.n. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.ck(WM.n. .%.s.....1.1.0.7.=..[..z.^.](W.`.v.\|.~-N.[.b.N .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. ..vM.n..0 .......e/T.R.\|.~.N.O.~.~.[..0 ...US.Q. ..e/T.R. eg..e/T.R.\|.~.0....1.1.0.8.=.%.s.....1.1.2.5.=....b.[..z.^.v.......1.1.2.6.=..N.N.N..y.-N...bdk.[..z.^.v....0....1.1.2.7.=.I.n.s.t.a.l.l.e.r. .._{...e/T.R.`.v.\|.~..Mb...[.b .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. ..g.R.vM.n..0US.Q"./f"..S.zsS..e/T.R..US.Q".&T"..R.S(W.N.T/T.R.0....1.1.2.8.=..[..z.^.\.[.b .'.%.s.'. ..f.e.0/f&T.~.~......1.1.2.9.=.dk:ghV.].[....eHr .'.%.s.'..0.[..e.l.~.~.0....1.1.3.0.=.nx.[....1.1.3.1.=..S.m....1.

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\0x0409.ini

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	22490
Entropy (8bit):	3.484827950705229
Encrypted:	false
SSDEEP:	384:CTmyuV//BiTbh/Y4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/N/lWr0aa0Mhs+XVgv
MD5:	8586214463BD73E1C2716113E5BD3E13
SHA1:	F02E3A76FD177964A846D4AA0A23F738178DB2BE
SHA-256:	089D3068E42958DD2C0AEC668E5B7E57B7584ACA5C77132B1BCBE3A1DA33EF54
SHA-512:	309200F38D0E29C9AAA99BB6D95F4347F8A8C320EB65742E7C539246AD9B759608BD5151D1C5D1D05888979DAA38F2B6C3BF492588B212B583B8ADBE81FA161B
Malicious:	false
Preview:	..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\0x0804.ini

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10758
Entropy (8bit):	5.783506671145112
Encrypted:	false
SSDEEP:	192:Nw8vvP/KID2jmYt1bRNJQYRyljRpRIHDJCL0PvrmeAdovo/BVEU3EDa+7VUX7AoU:7XD6bP9PvabCU6l7
MD5:	6F4C6D5B044895684A1E11BFE98B2ABD
SHA1:	45EFEC6E70E66A248B25ED1437BC336B846F6F19
SHA-256:	792E2ED82640E22F9D86F19EC34FD4BB89450B8B874EDEB4FDCBE07935A63110
SHA-512:	04727EB781330FD11C2B3ADECDECE5FA6ED9501061497E41EFE9ED528C2E95A724AD8E6D02180F31C6E810C28F94751E6944FCDB6D7415C338BBF5CF82726973
Malicious:	false
Preview:	..[.P.r.o.p.e.r.t.i.e.s.].....F.o.n.t.N.a.m.e.=..[SO....F.o.n.t.S.i.z.e.=.9.........[.0.x.0.8.0.4.].....1.1.0.0.=..[..z.^.R.Y.S.......1.1.0.1.=.%.s.....1.1.0.2.=.%.1. ..[..z.^ck(W.Q.Y .%.2....[.\._.[.`.[.biRYO.v.[...z.0...z.P.0....1.1.0.3.=.ck(W.h.g.d\O.\|.~Hr,g....1.1.0.4.=.ck(W.h.g .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .Hr,g....1.1.0.5.=.ck(WM.n. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.ck(WM.n. .%.s.....1.1.0.7.=..[..z.^.](W.`.v.\|.~-N.[.b.N .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. ..vM.n..0 .......e/T.R.\|.~.N.O.~.~.[..0 ...US.Q. ..e/T.R. eg..e/T.R.\|.~.0....1.1.0.8.=.%.s.....1.1.2.5.=....b.[..z.^.v.......1.1.2.6.=..N.N.N..y.-N...bdk.[..z.^.v....0....1.1.2.7.=.I.n.s.t.a.l.l.e.r. .._{...e/T.R.`.v.\|.~..Mb...[.b .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. ..g.R.vM.n..0US.Q"./f"..S.zsS..e/T.R..US.Q".&T"..R.S(W.N.T/T.R.0....1.1.2.8.=..[..z.^.\.[.b .'.%.s.'. ..f.e.0/f&T.~.~......1.1.2.9.=.dk:ghV.].[....eHr .'.%.s.'..0.[..e.l.~.~.0....1.1.3.0.=.nx.[....1.1.3.1.=..S.m....1.

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\ISSetup.dll

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	798720
Entropy (8bit):	7.77027621741067
Encrypted:	false
SSDEEP:	12288:Uw8lkARCPhAWiNHDCd5wpZYOu/ssZJzDD5guP2KpSxxoH0M:Uw8yQCPhQaosZhDvpSxyU
MD5:	F9F00FD142530C2B5892F46B8F1A036B
SHA1:	3EF804D63252E8686F81AF8206E15DCD24A0E0B8
SHA-256:	8437A9931CCA96AB8477D371A19ECFAE094E4C54EC58C364B37401FA2E649653
SHA-512:	52AE1AD381E3FC20D7C05AF525552F8CD444DABA485D86DD0E61186C7E2815BFF011632E01AB305A83EC252B88F5CC0844E9982E3C78270566BD93065A2FEE57
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........h2...\...\...\.u.....\......\....a.\.....\..~....\..~....\...]...\..~....\.I....\.I....\.I...\.I....\.I....\.......\.I....\.Rich..\.................PE..L......U...........!....."...(........%......@................................%.....#................................{%.G.....%.R.....#.......................%......H..8............................................................................text....p#.............PEC2MO...... ....rsrc.........#...... .............. ....reloc........%.....................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\data1.cab

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	14335896
Entropy (8bit):	7.999178331190897
Encrypted:	true
SSDEEP:	393216:Bxr9hG1A2fooVWrydkkzNg0C2fc2JMYo33ksW:BxhhquoWr+kkNCUc2J50kf
MD5:	02A7F0028AFB0246ECADE84FBCA5CA19
SHA1:	7C67A9CB6DF336FFBB361A94110718026AA57962
SHA-256:	A72E4805479555112E0FA382B6E0C20FD25D753F670D09F29DFF30B57828022B
SHA-512:	2C097B74B264624B298D0F7B601DA871FBC0E56742CDF1C5F59FE31187A44F29850F87704E47127D1F362D4C4C6FC4F20CB5918DA39FD2E57FE01AA45542FF4C
Malicious:	false
Preview:	ISc(.....................................................................................................................................................................................................................................................................................................................................................J....................................tfW.kD.;.SP...................x.7..[.B....i.o.AA..L..F.IJ.E.A.N.._p..H...L.B.....................................................+.....6.=U....q%..IQR.ag.c7UY..z.~..H."l.`.hdeJ.......sx.r.2...`w.otS.D.......b..YL...}e.....l2.Q.!...h.."O.....dV6.%.......E-\.0........ ..kH..Tif`.V...KRS!5CA..$..Y....P...k....E.......An}.j...`.I..\.i.)0..&......=p......f..@..9p......n.J.bF...:W..J1...n..b.R. 7.3........:..a.p....l..<...<+.oWW{'b..=`.....Xi...7.........i..7.F.G.z.u..,z.K..:....O.....=.A<.a...0.=m.<......C..}.'....M_....x>.a..,Ul..Fq..a_\).......,..>...g.\..i.1i......n...>..+..*~.e.....q.\|..C

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\data1.hdr

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	29396
Entropy (8bit):	3.720172973516485
Encrypted:	false
SSDEEP:	768:P9aaIZIO6SaJvO95Zgp8X8+/lb+/DQS+PBZb+PzcF:1k7pZb8W
MD5:	507BDDD8FD510775FAFEB4BCDDE7BC7D
SHA1:	BD34B3D2BD37CC19940ED93F1759CDE97B68CCEB
SHA-256:	8650F75584B0BFA0D84008F51BAEC549D95F933BC6B26258E46551BA968C2213
SHA-512:	7CA6DB89A27645398A2884EB2B1437AC68A3E56CA6FC62810645E8D46824436E21B23F26CA28DCF51E51E947FA43C09EABABE0C7574E1E080376FE6C95CE2031
Malicious:	false
Preview:	ISc(............A'...r..........................................................................B~.....................................................................................................................................................................................................................................................J....................................tfW.kD.;.SP...................x.7..[.B....i.o.AA..L..F.IJ.E.A.N.._p..H...L.B.....................................................s...........A'.......I...I..........@.......@.....................W...c...................................o...........{...................................................................................................................................................................#.........................../...............................;...............G...........S..................................._.......................k...w.....................................................

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\layout.bin

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	data
Category:	dropped
Size (bytes):	580
Entropy (8bit):	2.0042610078197334
Encrypted:	false
SSDEEP:	6:OMY1GndIIhCzCnFpl8JDWLNglETl127W7Jtn:KFswAQyBTj
MD5:	C7DC5ADFFFF108DEC7322A9377B4E218
SHA1:	1E8359CD6A73F3730113095A548E80D05DA8BDA9
SHA-256:	A1EE393AC58AE738FC0079D56FF09470691FE15838EDB85F89B07A3922E940B5
SHA-512:	FC6615B3ACF417DAA9CBBFF70FB73E3886836B5C93C36E0396CFC9BE51CCC63E3474260B1F84ACDFE463A5AB9D2B17D70045C55460565DC90A3D0E1B391FBEC6
Malicious:	false
Preview:	c..S.@..D................................................................................................................................................................................................................................................................... ...H...............p...................................0...........................................s.e.t.u.p...i.n.i.....s.e.t.u.p...i.n.x...I.S.S.e.t.u.p...d.l.l...0.x.0.8.0.4...i.n.i...0.x.0.4.0.9...i.n.i...d.a.t.a.1...h.d.r...d.a.t.a.1...c.a.b...d.a.t.a.2...c.a.b...l.a.y.o.u.t...b.i.n...s.e.t.u.p...e.x.e...

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\setup.exe

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1191936
Entropy (8bit):	6.682246176843057
Encrypted:	false
SSDEEP:	24576:oQt5lb3YpnAuE9CDRYcDZYr1yy0llllj6XAF7GCWZf:ft5JunAuE9CD+yaOlllljC4E5
MD5:	E188643B48930186D6AC477BA67857B3
SHA1:	51C1305DD0D6330B772C4EAF18A3D38674DE3B26
SHA-256:	FB874E3CDBDD65E0658067003D5663AE62A68394CE7F1A9E69729058EA7A0648
SHA-512:	EA774B767244688DB85AAD409FDE9527E3193DF440ABCDA2609E467252B027E60E9553701E46A2129B3691A01398680EBE96B25B1D43FBEA4280F5EB55EE5233
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X=..6n..6n..6n[2.n..6n.3.n..6n.3.n\|.6n[2.n..6n.3.n..6n...n..6n..7nY.6n...n..6n[2.n..6n[2.n..6n...n..6n[2.n..6nRich..6n........PE..L...X..U.....................p....................@........................................................................../..,.......(...........................@...8...........................P)..@............................................text...;........................... ..`.rdata..x...........................@..@.data....K...`...&...F..............@....rsrc...(............l..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\setup.ini

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2422
Entropy (8bit):	3.672251874347952
Encrypted:	false
SSDEEP:	48:rsAMDeB+5pEDXiomcPTmssu/+S8gvn6CJkkY09TzcqYtxkYOvl5ZAMXvrcOyb0pn:rsAMD35pPcrGqrvnp6kY05w7tCYOvlnR
MD5:	A5796064347CA23B634BE2CE0F5F2F4A
SHA1:	25DE30F651B05B1074B8F70914C800AAE2EFAEA8
SHA-256:	8A6F5FEFB3CB4804A66753A5A788E6FE4A89C1C783572561B4425C5F3EB15D98
SHA-512:	F86189F8C9BB9DA31A38C31CE2BCAD46B9E4B4B5D8AEDFD606AAD23E4218E18D9F322F95B4C942C66ABCCF2ADC68287610CECC4F4499A7118602DA9739D7EE01
Malicious:	false
Preview:	..[.S.t.a.r.t.u.p.].....P.r.o.d.u.c.t.=.L.o.c.a.l.P.l.a.y.b.a.c.k.....P.r.o.d.u.c.t.G.U.I.D.=.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.....C.o.m.p.a.n.y.N.a.m.e.=.h.i.k.v.i.s.i.o.n.....C.o.m.p.a.n.y.U.R.L.=.h.t.t.p.:././.w.w.w...h.i.k.v.i.s.i.o.n...c.o.m.....E.r.r.o.r.R.e.p.o.r.t.U.R.L.=.h.t.t.p.:././.w.w.w...i.n.s.t.a.l.l.s.h.i.e.l.d...c.o.m./.i.s.e.t.u.p./.P.r.o.E.r.r.o.r.C.e.n.t.r.a.l...a.s.p.?.E.r.r.o.r.C.o.d.e.=.%.d. .:. .0.x.%.x.&.E.r.r.o.r.I.n.f.o.=.%.s.....M.e.d.i.a.F.o.r.m.a.t.=.1.....L.o.g.M.o.d.e.=.1.....S.m.a.l.l.P.r.o.g.r.e.s.s.=.N.....S.p.l.a.s.h.T.i.m.e.=.....C.h.e.c.k.M.D.5.=.Y.....C.m.d.L.i.n.e.=.....S.h.o.w.P.a.s.s.w.o.r.d.D.i.a.l.o.g.=.N.....S.c.r.i.p.t.D.r.i.v.e.n.=.4.........[.L.a.n.g.u.a.g.e.s.].....D.e.f.a.u.l.t.=.0.x.0.4.0.9.....S.u.p.p.o.r.t.e.d.=.0.x.0.8.0.4.,.0.x.0.4.0.9.....R.e.q.u.i.r.e.E.x.a.c.t.L.a.n.g.M.a.t.c.h.=.0.x.0.4.0.4.,.0.x.0.8.0.4.....R.T.L.L.a.n.g.s.=.0.x.0.4.0.1.,.0.x.0.4.0.d.........[.0.x.0.4.0.9.].....0.x.0.4.0.

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\Disk1\setup.inx

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	data
Category:	dropped
Size (bytes):	256012
Entropy (8bit):	7.372841368757717
Encrypted:	false
SSDEEP:	3072:jUgqLn4zM1TF08meQdQ5NhHMm77hplbnALofCAZz4w5YpTBqqodQcQnnSF7a5INZ:jUgqLIQlddthAo4w0BqWnShYTNtG
MD5:	51CFDC963AB67279BCE6C9D7E7C4B933
SHA1:	66E3E4DA9A3AB8B2AD2717CC772860D6383FB02B
SHA-256:	BDAFEBD536D5E00A4C284CC425CA1D4B45AA155A58F7DFA46CCE02165FBADA57
SHA-512:	25C319E84AC87337D36A68337C79DB1F112FE9C8B7E5146AC041EC61C751C19A31AAA323BD134913F53625C43D27CD4C9763D904003506085708AB7C13573345
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}a.=mQ.Y]A..M1..)!.)........................................}...m..q]}}aMm.U=].E-M.5.=.%.-...............................]......a..(..H....YQQEY.0.o=55.={.gC[..W.....O.So##` ......,..x8........X......]..H.........5MM.5s..gW.CKgCC.....;..TDh..8P@........8.....p.e..Q...\| h......%]1II.1....S[wSS.[.G.W.o....L.`H ..D.. ........t....L......ayyIa......s..w!99.!....Gs[K[............T,.0,,......\|(.....l...P...yyy!a...........w.o.....W.;o?g..+O.....4.,$\.@....<......l......}uuI}.4..@....!99.!..s.w..3{.SGk.......0.D4\.... H.............4...Ye}!e. ..D....c.w......w3.;#.#C.[.THl....(.<,4p,.$.......a..t...8..L..YQQ=Y...w.{o..`.--..S.w3.7+kk .....$..H8@.X,0...y...........x...H...1miMQ.c4....{%9-%%.-c.sO.....'7?..... @\D.....H...................iuUaaUi...MEE%M..gk........?.7wK.....@.\|$d8......$.<................e}}Qe...I]1II.1.W.[.c_.;[s.....g..W..L<l...

C:\Users\user\AppData\Local\Temp\{BF172FD2-5CBE-4AB8-9EBD-2755BF244CA6}\setup.ini

Download File

Process:	C:\Users\user\Desktop\LocalPlayback.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2422
Entropy (8bit):	3.672251874347952
Encrypted:	false
SSDEEP:	48:rsAMDeB+5pEDXiomcPTmssu/+S8gvn6CJkkY09TzcqYtxkYOvl5ZAMXvrcOyb0pn:rsAMD35pPcrGqrvnp6kY05w7tCYOvlnR
MD5:	A5796064347CA23B634BE2CE0F5F2F4A
SHA1:	25DE30F651B05B1074B8F70914C800AAE2EFAEA8
SHA-256:	8A6F5FEFB3CB4804A66753A5A788E6FE4A89C1C783572561B4425C5F3EB15D98
SHA-512:	F86189F8C9BB9DA31A38C31CE2BCAD46B9E4B4B5D8AEDFD606AAD23E4218E18D9F322F95B4C942C66ABCCF2ADC68287610CECC4F4499A7118602DA9739D7EE01
Malicious:	false
Preview:	..[.S.t.a.r.t.u.p.].....P.r.o.d.u.c.t.=.L.o.c.a.l.P.l.a.y.b.a.c.k.....P.r.o.d.u.c.t.G.U.I.D.=.6.6.7.4.B.C.C.5.-.B.C.5.7.-.4.4.6.B.-.B.8.3.B.-.F.A.5.3.5.0.1.E.0.F.D.C.....C.o.m.p.a.n.y.N.a.m.e.=.h.i.k.v.i.s.i.o.n.....C.o.m.p.a.n.y.U.R.L.=.h.t.t.p.:././.w.w.w...h.i.k.v.i.s.i.o.n...c.o.m.....E.r.r.o.r.R.e.p.o.r.t.U.R.L.=.h.t.t.p.:././.w.w.w...i.n.s.t.a.l.l.s.h.i.e.l.d...c.o.m./.i.s.e.t.u.p./.P.r.o.E.r.r.o.r.C.e.n.t.r.a.l...a.s.p.?.E.r.r.o.r.C.o.d.e.=.%.d. .:. .0.x.%.x.&.E.r.r.o.r.I.n.f.o.=.%.s.....M.e.d.i.a.F.o.r.m.a.t.=.1.....L.o.g.M.o.d.e.=.1.....S.m.a.l.l.P.r.o.g.r.e.s.s.=.N.....S.p.l.a.s.h.T.i.m.e.=.....C.h.e.c.k.M.D.5.=.Y.....C.m.d.L.i.n.e.=.....S.h.o.w.P.a.s.s.w.o.r.d.D.i.a.l.o.g.=.N.....S.c.r.i.p.t.D.r.i.v.e.n.=.4.........[.L.a.n.g.u.a.g.e.s.].....D.e.f.a.u.l.t.=.0.x.0.4.0.9.....S.u.p.p.o.r.t.e.d.=.0.x.0.8.0.4.,.0.x.0.4.0.9.....R.e.q.u.i.r.e.E.x.a.c.t.L.a.n.g.M.a.t.c.h.=.0.x.0.4.0.4.,.0.x.0.8.0.4.....R.T.L.L.a.n.g.s.=.0.x.0.4.0.1.,.0.x.0.4.0.d.........[.0.x.0.4.0.9.].....0.x.0.4.0.

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\BootstrapperApplicationData.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (560), with CRLF line terminators
Category:	modified
Size (bytes):	5968
Entropy (8bit):	3.74889207964087
Encrypted:	false
SSDEEP:	96:X0eVJbgV2V4hLveBFAn6ueLqsZ+0wPycjn6qLoe6c4qkV0wMLvycNL415rtna5rE:X001KsgBFEvFwxLodhkzLa0L4NEBLFLA
MD5:	4E9AD8FEE683402B9FB3381549B7F98B
SHA1:	343E5E117C821AEF323B7EAF8138B91DF6EA424E
SHA-256:	148F262B214F5E472BA32DB9824342BBDA91D6F4C751A2DA0BBC2B70E2794BD2
SHA-512:	A28DF0A08B2F2C377B465E840D7C249FE766B8EE744F70F09D65905D85995251F811CEB4DED42D447CD28DD021C0662F9E5F1AC03C57F7F1767E485648DB3C2B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.U.x.B.l.o.c.k.e.r. .S.h.o.r.t.N.a.m.e.=.".M.i.n.i.m.u.m.O.S.L.e.v.e.l.". .T.y.p.e.=.".S.t.o.p.". .C.o.n.d.i.t.i.o.n.=.".N.O.T.(.(.V.e.r.s.i.o.n.N.T. .&.g.t.;. .v.6...1.). .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.6...1. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).).". .D.i.s.p.l.a.y.T.e.x.t.=.".#.l.o.c...M.i.n.i.m.u.m.O.S.L.e.v.e.l.". ./.>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T. .&.g.t.;.=. .v.6...0. .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.5...1. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .2.). .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.5...2. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\license.rtf

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	6841
Entropy (8bit):	5.231818976502303
Encrypted:	false
SSDEEP:	192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
MD5:	1E47EE7B71B22488068343DF4CE30534
SHA1:	DEAEE13F21AB70B57F44F0AA3128EC7AD9E3816A
SHA-256:	8518F0420972C1DBE8A323FFC6F57863AF0B80C6A3B27FD0C6FC9BDABB7E2D13
SHA-512:	C4C653BFD1FC493B0EFD8F9C75495287818179DC35969D1FB1927FAAC3FF9189FDE1131C5ABBCC3963F707412A7F8AD05A9E6855B7D47D6DF1F80D25D67BE9ED
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\\generator Riched20 6.2.9200}{\\mmathPr\mnaryLim0\mdispDef1\mwrapIndent1440 }\viewkind4\uc1 ..\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT SOFTWARE LICENSE TERMS\par....\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 MICROSOFT VISUAL C++ REDISTRIBUTABLE FOR VISUAL STUDIO 2013 \par....\pard\nowidctlpar\sb120\sa120\b0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. Please read them. They apply to the software named above, which includes the media on which you received it, if any. The terms also apply to any Microsoft\par....\pard\nowidctlpar\fi-360\li360\sb120\sa120\f1\'b7\tab\f0 updates,\par..\f1\'b7\tab\f0 supplements,\par..\f1\'b7\tab\f0 Internet-based services, and\par..\f1\'b7\tab\f0 support services\pa

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\logo.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:	24:q36cnTKM/3kTIQiBmYKHeQWalGt1Sj9kYIt1uZ+bYOQe0IChR95aW:qqiTKMPuUBm7eQJGtYJM1uZCVszaW
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\thm.wxl

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.052095286906672
Encrypted:	false
SSDEEP:	48:c5DiTl/+desK19hDUNKwsqq8+JIDxN3mt7NlN1NVvAdMcgLPDHVXK8KTKjKnSnYF:uDiTl/BbTxmup/vrxATd
MD5:	FBFCBC4DACC566A3C426F43CE10907B6
SHA1:	63C45F9A771161740E100FAF710F30EED017D723
SHA-256:	70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
SHA-512:	063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\thm.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5881
Entropy (8bit):	5.175177119212422
Encrypted:	false
SSDEEP:	96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
MD5:	0056F10A42638EA8B4BEFC614741DDD6
SHA1:	61D488CFBEA063E028A947CB1610EE372D873C9F
SHA-256:	6B1BA0DEA830E556A58C883290FAA5D49C064E546CBFCD0451596A10CC693F87
SHA-512:	5764EC92F65ACC4EBE4DE1E2B58B8817E81E0A6BC2F6E451317347E28D66E1E6A3773D7F18BE067BBB2CB52EF1FA267754AD2BF2529286CF53730A03409D398E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="64" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="80" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader)</T

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\wixstdba.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	6.262646414883502
Encrypted:	false
SSDEEP:	1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
MD5:	A52E5220EFB60813B31A82D101A97DCB
SHA1:	56E16E4DF0944CB07E73A01301886644F062D79B
SHA-256:	E7C8E7EDD9112137895820E789BAAAECA41626B01FB99FEDE82968DDB66D02CF
SHA-512:	D6565BA18B5B9795D6BDE3EF94D8F7CD77BF8BB69BA3FE7ADEFB80FC7C5D888CDFDC79238D86A0839846AEA4A1E51FC0CAED3D62F7054885E8B15FAD9F6C654E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................x=....x...... .....0.....n..x.....x8....x9....x>...Rich..........................PE..L......R...........!.....2..........1........P...............................0.......1....@.............................................l...........................0S..............................`...@............P...............................text...M0.......2.................. ..`.rdata..yd...P...f...6..............@..@.data..../..........................@....rsrc...l...........................@..@.reloc..B ......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.be\vcredist_x86.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	461368
Entropy (8bit):	6.931191292112627
Encrypted:	false
SSDEEP:	12288:iymOcB+pwPprnVmLmDsC+FU+ZOSzDBtzY7UWfR2:iLOsDFncLmKDZOSz1FO5
MD5:	2335AB0C0E19C0EF416D07DF66FEE649
SHA1:	1E8794AFF453F7647A6C149F3D38F7A3FF4CCD1B
SHA-256:	F0E46C0F9B2991FA6D187C6B2BED28139C67804CC58CC45C77F06A6F217CB21A
SHA-512:	518580D7A0D8F9610C8EC0204AE879A91A24325FB5E45348E6F0769AA25A69525992BC0F722DF113993AA29A1A917DE8FBECFB39D547D6F25354C3488BF06A62
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0............@.................................t!..,........7...............>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\cab54A5CABBE7274D8A22EB58060AAB7623

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	Microsoft Cabinet archive data, many, 980926 bytes, 5 files, at 0x44 +A "F_CENTRAL_msvcp120_x86" +A "F_CENTRAL_msvcr120_x86", flags 0x4, number 1, extra bytes 20 in head, 66 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	997054
Entropy (8bit):	7.998241664100315
Encrypted:	true
SSDEEP:	12288:obKhh4wRyjIryAelsIwEuomOyqKywY+BNnVgOUq6iqOnJB9I3PWbURdqWxb2tiS/:obKFRyjI4fLuvX96ixnLaf5rAi7zNUp
MD5:	12AD6C51AA6F9DA5CCB2E2B55ABF1910
SHA1:	F35A335989ABFAAA10B265A2BAE8809D7CA835AA
SHA-256:	32B7F3223DAB68F489286F2D4253B634EED0E67754176370291F7E13AE6008A2
SHA-512:	8EB51AB4A76C09FB70408BF36132C33DD247CDDD178D6B2CA15FC13E583C54C73B4DBF09BCED81B893EFFE757A05F9C0EDBF7A15F6351136D66583ABB78DD426
Malicious:	false
Preview:	MSCF............D................................?..............B.............EC.. .F_CENTRAL_msvcp120_x86...........EC.. .F_CENTRAL_msvcr120_x86.....@.....EC.. .F_CENTRAL_vcamp120_x86...........EC.. .F_CENTRAL_vccorlib120_x86...........EC.. .F_CENTRAL_vcomp120_x86.X..OD0..CK.Z{x.U.... ......Rh.@...`.@:.]..#.TwW....:.....a...?p.....q...VQpE............>pD.Yv..U.]..&......w..{.....0.c....9..2...<.........^...f..._P..r....%"..hT....E..U...R......\|o.......j..)./T..F.TG..V^#pE.`.5.......WU..X.`@.<-XO\|.7...g\.XW5/Qv.]=.OF.c9...b....+q$.3).EZb.r.....=.1.h.j_.....6.prq.V.^...5.M..].....L.:...^....u.0.;.v..-..9...Km.........Ho#3.. .X.....{!Ud......nxb.-.]I..A;_.a.A..Xw92o....P..6`........7.....o.`........a.^P.....@.A.........A.!............}...g.......FP......4.0........A......Aq........!....j.-.......4..r.....;.+.....3...u{=....rf.hmb-.,...qZ.,.rfv..3.....x...}.lo.}...{dr...;}7....K.Wp...l~....L...<....^u..............D....\|.<...kc..t...S}e.W.

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	Microsoft Cabinet archive data, 4916768 bytes, 14 files, at 0x44 +A "F_CENTRAL_mfc120_x86" +A "F_CENTRAL_mfc120chs_x86", flags 0x4, number 1, extra bytes 20 in head, 296 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	4932896
Entropy (8bit):	7.998852405602732
Encrypted:	true
SSDEEP:	98304:CPDJ5hAeLcePRtKu3LJs4QGHYl3afvVoqjXxK47Idv6Y7Ffxa/2CNy3:gDJ5hAe4eacLJJQOy3Mv6qtey2mHNM
MD5:	CFCBFA2494A3E3AB9215AA6E5872ED14
SHA1:	0A4D5018ACE1D4336C0DF051CFCCB2F6268CB8A8
SHA-256:	215A9436ED61CAFAC64849DBF5C66FF3D3AA0EE5FF977684523DCE8E59E9CB59
SHA-512:	CE0A9EAF2B46D9339E6AD892EACE32F426900D2448D9373904DFA042E20B1B891F8C93E5B6B6CBBD00471E4A74619C54E541BE862F7CC8F82230437C31292E51
Malicious:	false
Preview:	MSCF.... .K.....D........................... .K..?..........l...(.....C.......EC.. .F_CENTRAL_mfc120_x86.......C...EC.. .F_CENTRAL_mfc120chs_x86.....@7D...EC.. .F_CENTRAL_mfc120cht_x86..$....D...EC.. .F_CENTRAL_mfc120deu_x86.......F...EC.. .F_CENTRAL_mfc120enu_x86.. ..8.G...EC.. .F_CENTRAL_mfc120esn_x86..$.../H...EC.. .F_CENTRAL_mfc120fra_x86......TI...EC.. .F_CENTRAL_mfc120ita_x86.....0qJ...EC.. .F_CENTRAL_mfc120jpn_x86......CK...EC.. .F_CENTRAL_mfc120kor_x86.......L...EC.. .F_CENTRAL_mfc120rus_x86...C.()M...EC.. .F_CENTRAL_mfc120u_x86..D........EC.. .F_CENTRAL_mfcm120_x86..D..hT....EC.. .F_CENTRAL_mfcm120u_x86.........CK.\|.xTE.v.....H@v.!../.......U.:I.4.t.....EYd...d......DVE..EA.....\...T..=U..7M..3...M...[..rk;..V.$u.\|V.1.....v&...o...`....5........l.]`q..;.#....\..fw....%.0.-,>=+..g..^.jSU..g.x...n.11....a......]..x..,!/<...`[.'.....t..{EY...F....3Ey...W.!8.[@..m[F.c)...scz.[w.5i\-......].+t!wF0....D....@U.d.s$Nt..J........,.%..l..g.[..%;-..X..Z...%..y.......5

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\vcRuntimeAdditional_x86

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x86 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005., Template: Intel;1033, Revision Number: {5703FD24-BF2D-4D14-AB2F-E415A0361E63}, Create Time/Date: Sat Oct 5 11:36:30 2013, Last Saved Time/Date: Sat Oct 5 11:36:30 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.789241614671289
Encrypted:	false
SSDEEP:	3072:KVwJyjFGJvLIcXcSqviQICInggZvkNmez8:ESIcXgvi3zu
MD5:	D0A78FCAC0B92A149FE51C76371C989A
SHA1:	EDC4CB1484DDC7A5633EFAD60EA0899445AC1CA0
SHA-256:	FF206329EF1E41C038A12CA1E10634C647A8F1022E2130B7C49D91DBD48FB79A
SHA-512:	AFC617447B63E515BF17870704DFED6586E0070BCAED8787CFC4F2D7F19290DC1DF12A2FF3F76E15B8A6188698A8B5DD7742B2226C2371F627C16BB766D8DD58
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\vcRuntimeMinimum_x86

Download File

Process:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x86 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005., Template: Intel;1033, Revision Number: {E9934153-EAB1-4DA6-AA72-86C8BB1EDF2C}, Create Time/Date: Sat Oct 5 11:36:36 2013, Last Saved Time/Date: Sat Oct 5 11:36:36 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.730016728994943
Encrypted:	false
SSDEEP:	3072:MVyJyjFGJvLIcXcSqviQICInggRKyNmNX8:ESIcXgvi36D
MD5:	E3E632C282F2B368BCA82AACB80ACEAF
SHA1:	04A046E2EBB681B53F46DB1EC1434FAEF8B17618
SHA-256:	1937F3FEA43918D3FB8B8BB74FD1210467F9186AD06729DE82F8F0448AE65509
SHA-512:	B9FC13D5BFAF1EA72BFF323302AA6C89AFE52C6AAD469B01D78B28422DC66CD6B7423D42200795905DE0B673466CF65800FBBBF0496D6CF2C4FC8E48E0412BF5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6c4c8c.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x86 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005., Template: Intel;1033, Revision Number: {E9934153-EAB1-4DA6-AA72-86C8BB1EDF2C}, Create Time/Date: Sat Oct 5 11:36:36 2013, Last Saved Time/Date: Sat Oct 5 11:36:36 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.730016728994943
Encrypted:	false
SSDEEP:	3072:MVyJyjFGJvLIcXcSqviQICInggRKyNmNX8:ESIcXgvi36D
MD5:	E3E632C282F2B368BCA82AACB80ACEAF
SHA1:	04A046E2EBB681B53F46DB1EC1434FAEF8B17618
SHA-256:	1937F3FEA43918D3FB8B8BB74FD1210467F9186AD06729DE82F8F0448AE65509
SHA-512:	B9FC13D5BFAF1EA72BFF323302AA6C89AFE52C6AAD469B01D78B28422DC66CD6B7423D42200795905DE0B673466CF65800FBBBF0496D6CF2C4FC8E48E0412BF5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6c4c8f.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x86 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005., Template: Intel;1033, Revision Number: {E9934153-EAB1-4DA6-AA72-86C8BB1EDF2C}, Create Time/Date: Sat Oct 5 11:36:36 2013, Last Saved Time/Date: Sat Oct 5 11:36:36 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.730016728994943
Encrypted:	false
SSDEEP:	3072:MVyJyjFGJvLIcXcSqviQICInggRKyNmNX8:ESIcXgvi36D
MD5:	E3E632C282F2B368BCA82AACB80ACEAF
SHA1:	04A046E2EBB681B53F46DB1EC1434FAEF8B17618
SHA-256:	1937F3FEA43918D3FB8B8BB74FD1210467F9186AD06729DE82F8F0448AE65509
SHA-512:	B9FC13D5BFAF1EA72BFF323302AA6C89AFE52C6AAD469B01D78B28422DC66CD6B7423D42200795905DE0B673466CF65800FBBBF0496D6CF2C4FC8E48E0412BF5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6c4c90.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x86 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005., Template: Intel;1033, Revision Number: {5703FD24-BF2D-4D14-AB2F-E415A0361E63}, Create Time/Date: Sat Oct 5 11:36:30 2013, Last Saved Time/Date: Sat Oct 5 11:36:30 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.789241614671289
Encrypted:	false
SSDEEP:	3072:KVwJyjFGJvLIcXcSqviQICInggZvkNmez8:ESIcXgvi3zu
MD5:	D0A78FCAC0B92A149FE51C76371C989A
SHA1:	EDC4CB1484DDC7A5633EFAD60EA0899445AC1CA0
SHA-256:	FF206329EF1E41C038A12CA1E10634C647A8F1022E2130B7C49D91DBD48FB79A
SHA-512:	AFC617447B63E515BF17870704DFED6586E0070BCAED8787CFC4F2D7F19290DC1DF12A2FF3F76E15B8A6188698A8B5DD7742B2226C2371F627C16BB766D8DD58
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6c4c93.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x86 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005., Template: Intel;1033, Revision Number: {5703FD24-BF2D-4D14-AB2F-E415A0361E63}, Create Time/Date: Sat Oct 5 11:36:30 2013, Last Saved Time/Date: Sat Oct 5 11:36:30 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.789241614671289
Encrypted:	false
SSDEEP:	3072:KVwJyjFGJvLIcXcSqviQICInggZvkNmez8:ESIcXgvi3zu
MD5:	D0A78FCAC0B92A149FE51C76371C989A
SHA1:	EDC4CB1484DDC7A5633EFAD60EA0899445AC1CA0
SHA-256:	FF206329EF1E41C038A12CA1E10634C647A8F1022E2130B7C49D91DBD48FB79A
SHA-512:	AFC617447B63E515BF17870704DFED6586E0070BCAED8787CFC4F2D7F19290DC1DF12A2FF3F76E15B8A6188698A8B5DD7742B2226C2371F627C16BB766D8DD58
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6c4c94.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005., Template: x64;1033, Revision Number: {FE26E34E-F44B-4B4D-A2C9-878D87759F44}, Create Time/Date: Sat Oct 5 11:36:26 2013, Last Saved Time/Date: Sat Oct 5 11:36:26 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.731930109143771
Encrypted:	false
SSDEEP:	3072:qPSJyjFGJvLIcXcSqviQICInggioVNmzM+8:0SIcXgvi3L8
MD5:	6DC9B26E10641A0D15DCC60A26B38906
SHA1:	68AD317CD51C85AAFECD11E765823B39E0EE952E
SHA-256:	25284A481A749AA531682505AAAFDCFA929318E9970EF94B64EBDACC3A089490
SHA-512:	9312DD991FA80113D2732A53E85EF3762D89812F64626FF37B1213694FD2E27B7304FAD06FC7FA161BE6F377206BEB6CE88609E4D161A24E6927F59FDF7DD8D3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6c4c97.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005., Template: x64;1033, Revision Number: {FE26E34E-F44B-4B4D-A2C9-878D87759F44}, Create Time/Date: Sat Oct 5 11:36:26 2013, Last Saved Time/Date: Sat Oct 5 11:36:26 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.731930109143771
Encrypted:	false
SSDEEP:	3072:qPSJyjFGJvLIcXcSqviQICInggioVNmzM+8:0SIcXgvi3L8
MD5:	6DC9B26E10641A0D15DCC60A26B38906
SHA1:	68AD317CD51C85AAFECD11E765823B39E0EE952E
SHA-256:	25284A481A749AA531682505AAAFDCFA929318E9970EF94B64EBDACC3A089490
SHA-512:	9312DD991FA80113D2732A53E85EF3762D89812F64626FF37B1213694FD2E27B7304FAD06FC7FA161BE6F377206BEB6CE88609E4D161A24E6927F59FDF7DD8D3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6c4c98.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005., Template: x64;1033, Revision Number: {0990E7AB-85D7-456A-B8F8-1E1E56A29571}, Create Time/Date: Sat Oct 5 11:36:18 2013, Last Saved Time/Date: Sat Oct 5 11:36:18 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.7908315301004905
Encrypted:	false
SSDEEP:	3072:gJRJyjFGJvLIcXcSqviQICInggp/lVNmbQ8K:vSIcXgvi37k
MD5:	03FF53F29935C047D7630297E17B96E1
SHA1:	6F922B2D00A6C3274B39F0161C9B89C7AEFA9EB5
SHA-256:	F2C8327F44A0B47619AF5B47D37A90D0F3F7C61D94768AEFE8D8ADFC84A8ED55
SHA-512:	93F5CCB7B276CB089E511201417F522B34E8F7794CEFA8A24440C22B03C8AF81602852E42AC13BEF6078A212D746FB22E76CA72BFC8D185757FCB4B88CBF89B6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6c4c9b.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005., Template: x64;1033, Revision Number: {0990E7AB-85D7-456A-B8F8-1E1E56A29571}, Create Time/Date: Sat Oct 5 11:36:18 2013, Last Saved Time/Date: Sat Oct 5 11:36:18 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.7908315301004905
Encrypted:	false
SSDEEP:	3072:gJRJyjFGJvLIcXcSqviQICInggp/lVNmbQ8K:vSIcXgvi37k
MD5:	03FF53F29935C047D7630297E17B96E1
SHA1:	6F922B2D00A6C3274B39F0161C9B89C7AEFA9EB5
SHA-256:	F2C8327F44A0B47619AF5B47D37A90D0F3F7C61D94768AEFE8D8ADFC84A8ED55
SHA-512:	93F5CCB7B276CB089E511201417F522B34E8F7794CEFA8A24440C22B03C8AF81602852E42AC13BEF6078A212D746FB22E76CA72BFC8D185757FCB4B88CBF89B6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4E9F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	6063
Entropy (8bit):	5.745921287946757
Encrypted:	false
SSDEEP:	96:pdzNpwHNpvppKju867NY5J5J5J5J58Ub8hWkgWTS5Wxi8baNpbH8M8eeNpheW44T:pdDyf7nTWkgWTeWHu4e6lg29WtziL
MD5:	A040073AC728C87E3E45B2458395A3F0
SHA1:	023385D18BC253244B608752C20A88471D08C717
SHA-256:	3964159FF08589036AC509F2E8580DEB4AAAFBF7B221CA1EBC67074BEB638094
SHA-512:	3E679D7311AB84ECB7463C90E0541DFAC0DF94B243B09488AB47727BDB8D38C47CC8CF7DB7593D6A6A13B2E25DDC572B376B084354DF37CF2C2024DD20742898
Malicious:	false
Preview:	...@IXOS.@.....@.FXY.@.....@.....@.....@.....@.....@......&.{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}:.Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005..vc_runtimeMinimum_x86.msi.@.....@.R...@.....@........&.{E9934153-EAB1-4DA6-AA72-86C8BB1EDF2C}.....@.....@.....@.....@.......@.....@.....@.......@....:.Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{FE80AAC7-9373-345B-8C89-01D4359338F8}@.02:\SOFTWARE\Microsoft\VisualStudio\12.0\VC\Runtimes\x86\Version.@.......@.....@.....@......&.{0835C947-D6D2-4E52-AF14-0231D04E88EA} .C:\Windows\SysWOW64\msvcr120.dll.@.......@.....@.....@......&.{74260D9F-D644-423B-B2D4-0291EA4BA8BE} .C:\Windows\SysWOW64\msvcp120.dll.@.......@.....@.....@......&.{63B83B20-1AB9-4F49-B0B2-4489724CA96C}#.C:\Windows\SysWOW64\vccorlib120.dll.@.......@.....@.....@......&.

C:\Windows\Installer\MSI53FF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10008
Entropy (8bit):	5.691032898134317
Encrypted:	false
SSDEEP:	192:wzynAr7SfdqW5fhnzwliQ+JbTe+Ae+Ao+G5aseIFt44aWRmB1:wzynAr7SfdqW5fhnzwsQeecCZNF6rWRs
MD5:	97FD3ACA170035235E232E2BFB6004DF
SHA1:	09A0EE379F1C83641D44675CDFC14CD29B12D1D5
SHA-256:	540F395781CBB22335BC77AD565E2FEFA5FD30B9DE7985AB797F10DFC83370B7
SHA-512:	49194C22BA3BCDC71A1ECBEF902046FDACF9EF21FAD19F74F4D96FA2A09E950C8F051B59163360A5EFA564C2D284E42073ED24D14B6B730BF2A4F1D977ADDFB8
Malicious:	false
Preview:	...@IXOS.@.....@.FXY.@.....@.....@.....@.....@.....@......&.{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}=.Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005..vc_runtimeAdditional_x86.msi.@.....@.R...@.....@........&.{5703FD24-BF2D-4D14-AB2F-E415A0361E63}.....@.....@.....@.....@.......@.....@.....@.......@....=.Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{1D481A21-C43F-38B9-B0D1-E090FD2D2643}@.02:\SOFTWARE\Microsoft\VisualStudio\12.0\VC\Runtimes\x86\Version.@.......@.....@.....@......&.{7EA36934-F736-408F-BD04-A2A710E04773}..C:\Windows\SysWOW64\mfc120.dll.@.......@.....@.....@......&.{B5B46CD9-9426-401F-9C3B-646807EFE00B}..C:\Windows\SysWOW64\mfc120u.dll.@.......@.....@.....@......&.{D4263C2B-DA4A-4000-A8E0-4BE8E46A9A3C}..C:\Windows\SysWOW64\mfcm120.dll.@.......@.....@.....@......

C:\Windows\Installer\MSI6BFD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	6077
Entropy (8bit):	5.761128644818028
Encrypted:	false
SSDEEP:	96:BLxdpwNzdpEOkR18Ub6QL8M8M8M8M8Obb8RcNIQWSefrYWPdpEbN8eedp6eW4ag2:N8ZBRcIrDo7e8PWk
MD5:	E3327243E667A53553E908C5FCE809E9
SHA1:	C7A9AADB0F21E6C01E4115DFCBB82064DD40469E
SHA-256:	59B3AEFAFE3425199BF5375F195F04064882D3F9D60D5F7A861BD0A397BADEDB
SHA-512:	FEEBA444BAA2643516C99E073A42BBA9979AF85E6EC9EE3042208791BCBFD784904DFDF17A4C6488224D4F99F535AAC04DFF6E53478FC4677ACC7FF6BBE72891
Malicious:	false
Preview:	...@IXOS.@.....@.GXY.@.....@.....@.....@.....@.....@......&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005..vc_runtimeMinimum_x64.msi.@.....@.R...@.....@........&.{FE26E34E-F44B-4B4D-A2C9-878D87759F44}.....@.....@.....@.....@.......@.....@.....@.......@....:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{BC1F4291-6F0A-38EB-984E-C2E555837FE1}@.02:\SOFTWARE\Microsoft\VisualStudio\12.0\VC\Runtimes\x64\Version.@.......@.....@.....@......&.{E5B92048-5859-4AF1-AEAD-B97EBF00B087} .C:\Windows\system32\msvcr120.dll.@.......@.....@.....@......&.{570C624B-D57C-4CD1-9013-1B80C800093B} .C:\Windows\system32\msvcp120.dll.@.......@.....@.....@......&.{14E8634F-8AEA-4CD1-AC48-BEBFDA18523A}#.C:\Windows\system32\vccorlib120.dll.@.......@.....@.....@......&.

C:\Windows\Installer\MSI7005.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10023
Entropy (8bit):	5.7102455613853556
Encrypted:	false
SSDEEP:	192:NvpqO1leceYPSNhYiS+iifiG1i0viQTeIA1vI3XNdyHWu43T:NBqO1ledYPSNhgV4XD8Wf
MD5:	D8E8C937DFCF0ACA5320766477D406A2
SHA1:	169D6D911E82F673DAA8B8D668C82B1E0C303660
SHA-256:	AC4980E38F1A29F362BB9C11DD001A94E1D35D631E1B06E6CC4FBBADF9AAC83E
SHA-512:	6896EFABB5AA97D5B4EED2E09627570B547FDB9342B2DDFE9FCB3752B8BA7DA024635C56E1B16788F0C4B7CBF0A51F81A0A76B9F0BDC912197A2C16F93E04FDD
Malicious:	false
Preview:	...@IXOS.@.....@.GXY.@.....@.....@.....@.....@.....@......&.{929FBD26-9020-399B-9A7A-751D61F0B942}=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005..vc_runtimeAdditional_x64.msi.@.....@.R...@.....@........&.{0990E7AB-85D7-456A-B8F8-1E1E56A29571}.....@.....@.....@.....@.......@.....@.....@.......@....=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{191E6DE4-E7B2-3CE9-B48B-25D0FFF3D88E}@.02:\SOFTWARE\Microsoft\VisualStudio\12.0\VC\Runtimes\x64\Version.@.......@.....@.....@......&.{E70078E7-D25B-421C-A415-0AB472053F72}..C:\Windows\system32\mfc120.dll.@.......@.....@.....@......&.{7D2EA505-A879-4E71-8632-F3DE9B679CE6}..C:\Windows\system32\mfc120u.dll.@.......@.....@.....@......&.{1F74928D-AA17-468C-A7D7-6A730A8DB25B}..C:\Windows\system32\mfcm120.dll.@.......@.....@.....@......

C:\Windows\Installer\SourceHash{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2074816130643202
Encrypted:	false
SSDEEP:	12:JSbX72FjwXAlfLIlHuRpZhG7777777777777777777777777ZDHFSD58bAzsvnIv:JAUIwEy58basUuO6cF
MD5:	D0FB092C241C8F0EECC2ADCB7E3FA237
SHA1:	793F2817889196439F3A150208FF01B1759EAE8D
SHA-256:	8CAC2AF4011AF7C4AF6AF1C819606E92247EE27AE5861813E4B9CEC374286476
SHA-512:	A0874176815A5D5C65F82148D1E98730C90813C8F87615B36DCF62C3DD812247304652B1229348648BC326258CDEBDD009EDC99603B9BB174020719DF2243055
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{929FBD26-9020-399B-9A7A-751D61F0B942}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.208143060897465
Encrypted:	false
SSDEEP:	12:JSbX72FjUXAlfLIlHuRpWBhG7777777777777777777777777ZDHFbOSJ4+Yp80o:JQUIwUiFOSJkcF
MD5:	BB23BD0FEE27F2D33AC73D81F6380A70
SHA1:	E5166724F92AAEDDDD9944F47CDDA227A0040796
SHA-256:	24CDF84998CCEE6E3115CDAA3980894B78B7D2F6F26FDD7A68D3ECA4CB50539D
SHA-512:	D9CE5315005B928880D308BD3B77D0399C3E61CE04D33EE565EF3EBE70FA479ACD9A89B83B3BF5608E5D6383EBA7097F1151D9FC13414BC436B0E5D868725A2B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.206626417183955
Encrypted:	false
SSDEEP:	12:JSbX72FjLXXAlfLIlHuRpZhG7777777777777777777777777ZDHFubeJesalS/I:JBHUIwEcq4sYicF
MD5:	29E57F6112BED455D090264822592B2E
SHA1:	2D0014116A07E0B515A35B010D1DCA229529CCD9
SHA-256:	337CC01806228285D55D87B485371CB5C00F5F7BFDC7A389C91E89153CB5A4AF
SHA-512:	0B0D6124A9805B65EF27C73B54B9C28BD4A3E154F3F966C680E210778D1344EFB87BF06B14ADCB583AAA16E86D5FFFBDE8E8A8C5D925EF88F7A2EDC5E2AE956A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2085501139561257
Encrypted:	false
SSDEEP:	12:JSbX72FjQZXAlfLIlHuRpWBhG7777777777777777777777777ZDHF4DTXJECNKn:JyJUIwUiiEaKQcF
MD5:	B6DC3E89A00AA77E1C6C7103A4D2AB42
SHA1:	B451F4DF518153F45985F586FD64B4D83973BE0A
SHA-256:	78929DA0DBFF96CD1591E6A92E73B0E25E9EB7A99A4E613A31D279D0FCCD5B07
SHA-512:	0EE8EE0E6CD1E69668DBE646ADAAF43D3A91335395097C510145D8AD55AA0FA15D5E791F8DA966328414F6BAA6E4E188B846D72F93D89A9CE92C9B2B374B823B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	modified
Size (bytes):	20480
Entropy (8bit):	1.5907377300064671
Encrypted:	false
SSDEEP:	48:c8Ph0uRc06WXiZnT5md96RLjxL4iSmRSsuFOVSIVkQZmc:zh013nTo9aLVL4iVRFkgJkQZmc
MD5:	114782C24ECC5B334EBE8C64FD85F942
SHA1:	5AB5B3AA808100019768C1CF08EC5A5876DBB456
SHA-256:	B67E94E8AAD3273067F1B568FBCDEC46AF948919B2768FD6F402DC92A874C428
SHA-512:	4AC7784B2CDEA1D5CF4ED63F1016BE0990925E6AA5B3B271E53C02B6E7585261B1A886047A10B10AC90643C1420464265C6F868275D24DA05DFF292D5F684F68
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362973257705189
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgauj:zTtbmkExhMJCIpEm
MD5:	FBC06306184E16C605027F6DD1393160
SHA1:	05EC7CE1054F1482DC55F35C5B764197292F377C
SHA-256:	2958B2E91EA386457E4F0E3ACD96C43E4BE19FABF3B7964B57AF413F4463515B
SHA-512:	1858017E1731B89676E6C94242ECB82C48AC4571F01C9032718E20CD03DE8E0C43FBF215C5E3192D1C5885140EDEC87B92A2B2AEB8B7FEECC835541160E84E16
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\mfc120chs.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46248
Entropy (8bit):	6.134571748867257
Encrypted:	false
SSDEEP:	768:WdzvsXN+ptLkrHyTby9XVLK8iLkbHbppuW5Z5:Cz0XN+ptLUHCbyBVLK85eKZ5
MD5:	1D343669E50F2CF53901C0B1A85D67F8
SHA1:	18955A82D87302066BE07E1DDD2E2C83FAD3A3BE
SHA-256:	68EC84B251DFB616E48141D674F423E70489B2B749164C0CC5C809C259F4E2AF
SHA-512:	F8D7B9BF92FA111D10C2827B88E0072EB483D25EF57274AA6D6DD49DDC7275D9637195D1BF30ED7EAE005B417591A65969C40846C63F96E960F90E27FE06A684
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..L.....OR.........."!.........t...........................................................@............................................. s...........v...>...........................................................................................rsrc... s.......t..................@..@....................................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\SysWOW64\mfc120cht.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46248
Entropy (8bit):	6.179706372945047
Encrypted:	false
SSDEEP:	768:4efucVI4TA7kn4TJVM3i/EhKg+8iDUpDSHRSa:FucVI4TA4noVM3XhKg+8uUyRSa
MD5:	928EF91C2BCC8F82725CDB1A5ED711D9
SHA1:	72DBE1129AE70BF08BF508B02DFDE428C05C9212
SHA-256:	BB8111CFEE6EB4A9F113EA1CB1C573DE990A987635B7111821C73D6CBFDBE38B
SHA-512:	F6454427AE2D655AF8396CDD33742768AD5C0677E6278D47BC5E5FB5C1E1DAE9610AA92271FA8E6ADB781DC6CE382ADFC14C78682FC23449D378F7C4F9AEAE39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..L.....OR.........."!.........t......................................................b?....@.............................................Hs...........v...>...........................................................................................rsrc...Hs.......t..................@..@....................................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\SysWOW64\mfc120deu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	74920
Entropy (8bit):	4.756155783917953
Encrypted:	false
SSDEEP:	1536:0VPidQr0UZqnn0BDLWPu6V4aGCWRZ+e0petNSaQhp0vcsjsr8gWt8C1dCuf9y85i:0VidQr0UZqnnSLWPu6V4aGCWRZX0bhpX
MD5:	B82A4BA3EBAEBD8810F2304C0535DA4C
SHA1:	54611D7788ABCBAF2C3460F457AD8A76806DE5DE
SHA-256:	9248457F55D091F97D282F14D3D55BC28CBA5024B69050209DF0F0A8806F8B5A
SHA-512:	AA8ADFCCD9CD6865B9F63D74EC45AEAC62E2D84DE7A8DDC4AAC53B4D5BE402E02EF8107D579DAD305A56B9638464C323AC636E4659EA84E8E687F07E2ECF7F0A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..L.....OR.........."!......................................................................@.............................................H................>...........................................................................................rsrc...H...........................@..@....................................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\SysWOW64\mfc120enu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65192
Entropy (8bit):	4.900787098406691
Encrypted:	false
SSDEEP:	768:xyijcBEhCgyEO6B1CLPLNq5f/nWHBNheOU2fd5N+8iUbH1rV:xRzfyEO6B8PLNYf/nWHNTdT+8J1rV
MD5:	BC61781863211ABBC7C15248CCFAF9A0
SHA1:	00C5A5F79A64393CE56147D2A0F19E250BF284EC
SHA-256:	9E222C509F5D1E7D451A37220B9C6574DEC36FB1C5042426278478E640CF0052
SHA-512:	C076A8197AFCBB98027175D42658CB9408B92CC5D1DFB8CC7BA92B2CE926300A9CCE5A1AB5A0B0178042232EE91DD2AE21F0DF722EF1249033145F3ADE1BC000
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..L.....OR.........."!................................................................y'....@..............................................................>...........................................................................................rsrc...............................@..@....................................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\SysWOW64\mfc120esn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73896
Entropy (8bit):	4.729865858952854
Encrypted:	false
SSDEEP:	768:Hw0KnBU6fN6rg/PKuCOCF3OKWRElJRZRIvpy8i2m7JHfQ0:Zwq6fN68/PKuFm3OKWkRZRIk8L0ff
MD5:	0F79E653D7F5180678E457CE39813F0E
SHA1:	1502BEC70A4F611976336F3B2B0976520465D6C9
SHA-256:	AE5EEB021006B52F66D9594F3FE7B26C934E41ECF24D252871E46442AFF39B55
SHA-512:	332BCC256AD78F201F49135BFEE4DC1B2D87C2B98E4D63159750C3356A711F02D07B4E10CDD0F02CE39CDEF39F55F95BE60281E01A279B51CB382D088E0D2E1F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..L.....OR.........."!......................................................................@..............................................................>...........................................................................................rsrc...............................@..@....................................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\SysWOW64\mfc120fra.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	74920
Entropy (8bit):	4.7398849390733115
Encrypted:	false
SSDEEP:	768:+26iNYajZELmOYImN8YxAaTafCp5eFQZmZUjyyyyyyyyyyyyyyyUGQFUbWo2Neem:+NuqLmOQA2SCHj0jo8K7W
MD5:	F09B21C8959133053E94A4AF14D6B46F
SHA1:	5100D71973CFB310F89DA5E53DB7B87AE7311992
SHA-256:	0FA0A1FD83269C78C322BF8BE59F8A8BB93143AE5731CB263F2F2C91175EAE47
SHA-512:	FDED7775E1679CEE895AFB43BC7110C212548A76B95A819F32F54F97FDCCB1E0756093B4BA2DC45147F3E4D5AC357B21625E75AED821232F2C776E23DBA9D852
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..L.....OR.........."!.....................................................................@.............................................x................>...........................................................................................rsrc...x...........................@..@....................................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......)..............,.......-...........0.../...H.......`.......x...........................

C:\Windows\SysWOW64\mfc120ita.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72872
Entropy (8bit):	4.73664045671538
Encrypted:	false
SSDEEP:	768:3uE6XaCyqbK15MS1igDGxNIlW3gyCQQQjeqS1hDsiiUWTVP8ijvH9c:mass5MS1igSxNIlW37oETF8U9c
MD5:	FFA0B900C2C0401D902465591E165E16
SHA1:	7D73D542296B53562F424946D02E8C73D08171B2
SHA-256:	B175C54C7FAF7B29BA8EE5C3EB647E05FD8AC5E6CBFE638A27815F621795F2EB
SHA-512:	7AAEEC584EADB80150C10A1121EB63E89B6845BDF0497B66F78AC03A6FC9CE3B075613B55D01A3EC348E26853A1A1BB201D8C217CF7A4CA0398FD8AE6E23786D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..L.....OR.........."!......................................................................@.............................................`................>...........................................................................................rsrc...`...........................@..@....................................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\SysWOW64\mfc120jpn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53928
Entropy (8bit):	5.970860603810259
Encrypted:	false
SSDEEP:	768:panVn/eGtJxtr10/euKRHIWQ8iphTwHj+2T1y+:0np/eg/uMW8lzT1y+
MD5:	4BA51DA48F1BA2222664017724251775
SHA1:	09B4B1F07C8DA202355CBB4A7D4139A308B9C948
SHA-256:	776D3E99FA205289D1B85A5EAD9ED1A412526CBD6428A9B2E7BC857DC4734646
SHA-512:	ACE2ACCF29FE99FF58E083A14BAECF521F3C206A9BACCAF9122D78C0A3C6A2AF0A2A5103685B00294A7F252BFDD516409814EFAB8DD6807C2279557F51CA0B25
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..L.....OR.........."!................................................................+.....@..............................................................>...........................................................................................rsrc...............................@..@....................................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\SysWOW64\mfc120kor.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53416
Entropy (8bit):	6.097205008917309
Encrypted:	false
SSDEEP:	768:EzO54LQTNtQraHniJNB2I7CvqR8i2Hv+r:b51TNthniJv2I7CvqR8Hv+r
MD5:	6201122886A4557A3E97647F95FB34AC
SHA1:	AD8831969784C168C861D15708528E2D359EAB96
SHA-256:	07CC905FCDBE661903851F371584388AB338C9CC2DEE3FE0F91D3562E7B68078
SHA-512:	91299874BEF31D3333BEED2096E0987BC8F7263412DF34A53C8FC553779119688AFCFF32902641032B551F2BC490751F0646B78B75B0CD05B05DDC273F58DC33
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..L.....OR.........."!................................................................+S....@..............................................................>...........................................................................................rsrc...............................@..@....................................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\SysWOW64\mfc120rus.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	5.28547454088543
Encrypted:	false
SSDEEP:	768:oZq/gFXOv9GuqN9TMIVhtZ3FckD+SkP8i7iHrEr:d6XOv9OhTVI8frEr
MD5:	DFB441CA61002365F2DB2EF8769455E4
SHA1:	F189F4B46CC8530F3A53D9BB7BB0749893BE2A04
SHA-256:	D4E11F22D3C71CD99EE3731777B1943FF3A6B828C1EEAAFAEA0AFFF56646E7DC
SHA-512:	AF785EB2F5928DD35A09F428F0C8F995784AE737A4FADC7DB887D687042652B3E01FE32C84697C744BE712287578845B42603ABEDF41B9721C710C7E4AB21391
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..L.....OR.........."!................................................................U.....@..............................................................>...........................................................................................rsrc...............................@..@....................................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\SysWOW64\vcamp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	339616
Entropy (8bit):	6.476536011761002
Encrypted:	false
SSDEEP:	6144:ODyAW5+4f+wKjFqfEz2v2ut90DOXmYRlk6Zg:yW/GwKj6EUDL0KP7C
MD5:	3BCA5A693F9F772FC8F92A61E45320FC
SHA1:	C84A6BB36D9D4CDE3BECF4135CF8BDD0E43F68EE
SHA-256:	25FD2EB39C27717838D115B44A53C89D028C0E00967C7FCE4474E832E108DB7F
SHA-512:	D43F62D92A851DFDFDB1578D3D7943E44B4D69F40441CB30BBB8983CADD3AB55C43E60F59FCC105B8E9A8BAE2B4610FFB76EC69EC201E1250A3FBC3F6B6AE798
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..a&..2&..2&..2`.{2"..2`.y2#..2`.F2(..2`.G2!..2.cm2-..2&..2...2`.C2,..2`.z2'..2`.}2'..2&.12'..2`.x2'..2Rich&..2................PE..L.....OR.........."!.....>...................P............................... ............@.........................0...-7..t...........8$...............>.......?..P...............................``..@...............t............................text...]=.......>.................. ..`.data...t4...P...2...B..............@....idata...............t..............@..@.rsrc...8$.......&..................@..@.reloc...?.......@..................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\vcomp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	119456
Entropy (8bit):	6.615804595453349
Encrypted:	false
SSDEEP:	3072:a11AajtOJq44zQHMSdTq0HDzVub/xLy+82rH:K1iqBMzHu/xLZH
MD5:	27BC360D67F269A61BB052E10C9FCEEB
SHA1:	8D81406C8DD3ED8894D8AEE07DD718DCFD2035C5
SHA-256:	FC12360FF09830BF08B7A2A238016EEA2B9E9475CBEA4C22043B264E76B3420C
SHA-512:	2807AF25E00EA11C0ACFAE20D44EE0F02B2331C469F14F5D42814805AE16B7B2A11FBCD7F9046F3E11ADC434133057DADAB62BECA63EB70793FD755F3F827755
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..]............L...+...L. .....L...c....84.........i...L.......L.#.....L.$.....L.!.....Rich............PE..L....OR.........."!.....T...Z..............p...................................... .....@..........................T......X...<........................>..........P...............................pO..@...............X............................text...5R.......T.................. ..`.data...h/...p.......X..............@....idata...............j..............@..@.rsrc................t..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc120chs.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46248
Entropy (8bit):	6.135373688897719
Encrypted:	false
SSDEEP:	768:KdzvsXN+ptLkrHyTby9XVLv+8i94HMpuWR:+z0XN+ptLUHCbyBVLv+8HrW
MD5:	58BBC79A32110C948466CAE4315E0E1B
SHA1:	AA130D3C040BE702A6EC20EE6949529C2A3BF0B1
SHA-256:	75BC225D5AF5E8F267EE940A722AEA1696A969FAE777994881D3ACE490D97BF0
SHA-512:	93B34D22ECF567DFD962A0C100581B4DD1B7C3C3B098F44090BAA8F0DA428E908B829391B4D5567836FD307FD551CA2FAD40F93DF8AEE6F64BA87D9BA6693725
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." .........t............................................................`............................................................. s...........v...>...........................................................................................rsrc... s.......t..................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120cht.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46248
Entropy (8bit):	6.175910557379163
Encrypted:	false
SSDEEP:	768:fefucVI4TA7kn4TJVM3i/EhKX8iEHTTi:wucVI4TA4noVM3XhKX8tTTi
MD5:	C38C69B5A41B667654244E53F1A814C8
SHA1:	20555F17E7073AB06A151B4E48E7A08AB9D93A7E
SHA-256:	829871005A8BB56838F1EE22D786070E87BDCCF9204A07612D6505004D29A5F0
SHA-512:	E982D8EA039B4F481C1C2A33FC4305B86118FD0F364F852BA5F0D415352E46EFEAB3E6D67522381F5FBF1C744DB4D596AD7202CF729E4795A65BC4199DAC4FA9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." .........t......................................................[T....`.............................................................Hs...........v...>...........................................................................................rsrc...Hs.......t..................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120deu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74920
Entropy (8bit):	4.756035033790749
Encrypted:	false
SSDEEP:	1536:eVPidQr0UZqnn0BDLWPu6V4aGCWRZ+e0petNSaQhp0vcsjsr8gWt8C1dCuf9y8K0:eVidQr0UZqnnSLWPu6V4aGCWRZX0bhpY
MD5:	C5EBC101E92D1849A7B3880047FDBCA8
SHA1:	0577B78FA1FC550989E0E412E1CA4C39BC6F3E26
SHA-256:	9CC7EE7335777AA1EB393EAB8BFE5250C0F2FED10AC3A7C58EE3C4EF9662F6D8
SHA-512:	302B2C9B7071E8B5FABBB75C1B82ED7565925B55D0C05E735E68F3D8754519D9C049C028B9A30AED4E1865E756DEEF49AE293BA6C31FC90884F98D877AADFBB9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`.............................................................H................>...........................................................................................rsrc...H...........................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120enu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65192
Entropy (8bit):	4.8999531962025005
Encrypted:	false
SSDEEP:	768:TyijcBEhCgyEO6B1CLPLNq5f/nWHBNheOU2fd528iPlHZsTDyN:TRzfyEO6B8PLNYf/nWHNTdc8qZsTDyN
MD5:	1708B225DAE258B847A447628C6A7A5D
SHA1:	C1337818DBA48C18C17BD9D231CC996CE73D161C
SHA-256:	87554AF8B85815F5ABA84933DE6809D76E1C1BFEAD70B2FDC7439E5A6B5302EB
SHA-512:	17E8D7CF07E1FECC2F2BEED8DE53CD4CF22232C988816F9A41B42F8FB23F323A15629B897A09AF75EDC135DD4F317855A8F4026A110F6ED22FF8A431A1AF2ED0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`..............................................................................>...........................................................................................rsrc...............................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120esn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73896
Entropy (8bit):	4.7300024182207325
Encrypted:	false
SSDEEP:	768:Dw0KnBU6fN6rg/PKuCOCF3OKWRElJRZRIvpt+8i2LvHfIcH6n:twq6fN68/PKuFm3OKWkRZRIr+89zNan
MD5:	5FB33B2CED7AA5D69707EB31C4D4B7AF
SHA1:	6D9F59B14829C425D5EB3943E5704EBA341A5134
SHA-256:	09F4506791B162CB14039FA3C656358E55089995534626F8E7FAC0B4C66C3BBD
SHA-512:	7B95DD952872DF943110997A08E362DE03DB4D8383E626F4DD3930E78E6137076F9E2E2F2938693D647893D87E9F8FAD12C9D4D78159A675A7A4B23BFBD8A6F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`..............................................................................>...........................................................................................rsrc...............................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120fra.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74920
Entropy (8bit):	4.740550737279396
Encrypted:	false
SSDEEP:	768:y26iNYajZELmOYImN8YxAaTafCp5eFQZmZUjyyyyyyyyyyyyyyyUGQFUbWo2NemV:yNuqLmOQA2SCHj0jY+8dBx
MD5:	EDF43FB1F708B1D5ECF6AF64B2106275
SHA1:	C5DEB6320BEA70FFA8CF67664F5BACE47D992A3C
SHA-256:	0FCF915499D7A0DF41D115E3D578310B6F5CF1C17956C08C3A42340F08B87646
SHA-512:	C20EB350A046AD566E2AE7916596E4BA72E300E78C088F4B982A16733DFCC322E218284AC133E2A9C079C9D770FA4F0DB4F7A445061495D4209250AC71CC13C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`.............................................................x................>...........................................................................................rsrc...x...........................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120ita.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72872
Entropy (8bit):	4.737269819960536
Encrypted:	false
SSDEEP:	768:XuE6XaCyqbK15MS1igDGxNIlW3gyCQQQjeqS1hDsiiUWTVq8iB3HHNpuWu:Gass5MS1igSxNIlW37oETE8umN
MD5:	729AC7C4146890693FC7F8AAF8D20539
SHA1:	0394FEEF49CF0A5C60451527B3A2CAA0D6E51C52
SHA-256:	6884B0886E3001D08A38A9C4CEC196A6A8AEC348BB24CD4FD91A05F120103341
SHA-512:	8281F095C8C56FC6A8D4BBF39B155B7EC02466AA89606B917DD3237E623F7DBF95020456C69A88A3C15B4478B14F6EBD81A21F366EBB78A6C7C310D8133B33AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`.............................................................`................>...........................................................................................rsrc...`...........................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120jpn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	53928
Entropy (8bit):	5.97139967075836
Encrypted:	false
SSDEEP:	768:YanVn/eGtJxtr10/euKRHIWC8iNah0HbpuW9:nnp/eg/uMY82Iu
MD5:	3C976744835F3DD9D6EF459A650B3E30
SHA1:	80CC70F77CCBA3602A0D11ABF0C98CBFFFDEEAAF
SHA-256:	57DFF553B1608EA493F69697178C378E74D68B472B14D52A9EB1AD627DFBD54D
SHA-512:	D60EBD0094319A2FFDA01397D577A4A6AA538C96F879794DB95AA0518D4DA62C64737F03F8B243672607429DADC7BC680F1C662FB1BB2F2B259DC4F36DC281CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." .................................................................(....`..............................................................................>...........................................................................................rsrc...............................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120kor.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	53416
Entropy (8bit):	6.098181898861317
Encrypted:	false
SSDEEP:	768:ozO54LQTNtQraHniJNB2I7Cvqt8iqqHvkaz:v51TNthniJv2I7Cvqt8Ysaz
MD5:	46ABA46ED83A1CD9C8E6B5B7076D2F7D
SHA1:	7889B34C82EE63F4C11B5BA160B699F4346D693B
SHA-256:	DED612342B84998C1D8681746C81F970F15B31DB4928118C743B9D24510B820A
SHA-512:	B5F230B791D35E7D0296311AA6D7695FBE1E21E86FA41E5E96DC578C86A0BBABB438730398FD314CFB8D99C56B8188EC6A45F77CB4C7D9CFE7AE1F6280710112
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`..............................................................................>...........................................................................................rsrc...............................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120rus.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	5.284986668872065
Encrypted:	false
SSDEEP:	768:dZq/gFXOv9GuqN9TMIVhtZ3FckD+SjN8iNsH/KspuWO:K6XOv9OhTVh8wGSL
MD5:	F6E6EBB21B23EB772930732288451936
SHA1:	251D39E307FE5230AC510956D3FFE23FF63F2037
SHA-256:	1AD8F734737AFB18FF78D211351FFBE422196C5F6591407E53082E0F68A89FFC
SHA-512:	B16823C3D07C2AD271E216BA1494F34CDEE503C58AD48FAC7001D8BE5BF7E51B37685816BC7B38CBB6C8E0C59F97A7FCC876FD96DB8AE6235BA8D166259F0DFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ................................................................Ah....`..............................................................................>...........................................................................................rsrc...............................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\vcamp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	481952
Entropy (8bit):	5.988082434617548
Encrypted:	false
SSDEEP:	6144:iU0XBBJv5MQmJxQDe2T0gnsWo0PdHK5P5ZImCKTR10tKe3D17KQMc2FqpPM0tOAO:iNDP0ghMxCKROKeVKxjF+PJ1q
MD5:	182B2AA59F75B2A6F74E7B518E3D8383
SHA1:	32EA5A8B93187C39FBE5FC0D362B625C74A468D6
SHA-256:	EF3F1A0FA0ABA642A4735E99814E7A218FB1D43E0CDDC90CE63C62486BF5D384
SHA-512:	5890996E728705C614118AC19421D8EA2012A044205B36EC0DE5E4CC02DE56AFC5BF78A61824663E0F2C4850E2F6823EF59ADB5ACE2C65AA1E16F1C68AAF5AAF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..\............T.<......W&.....T.>.....T.......T.........*.............T.......T.=.....T.:.......v.....T.?.....Rich............................PE..d.....OR.........." .........B.......@.......................................P...........`.........................................0;..$8..Ts..........8$.......:.......>...@......................................@...p............................................text............................... ..`.rdata..............................@..@.data...H=.......8...z..............@....pdata...:.......<..................@..@.rsrc...8$.......&..................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Windows\System32\vcomp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	137376
Entropy (8bit):	6.230586249062871
Encrypted:	false
SSDEEP:	3072:J7jlPQfmOYa0clSifLdmEkHHJprdHZfgjmsGQsGCxN0BfrMW7pQb/FW8xOi:4f11SikEkJprd5yrGQ1f0/DOi
MD5:	FD7F0D239E2227244F10E309C322E167
SHA1:	1F8C667DF810FED8FB42A6680A15465AC1E288EB
SHA-256:	AE710D6670D922FBBF0ADCBEC743FE75E572CF21CF7579FAF5F347A606C37CBB
SHA-512:	F726F5EF9175163F5BA6A96C95C9AAC38DAE354BA1289EB714C522B9E3CF5DD49EFD09B3FD548016B0FF702EC8B1E0B2570226844BC6405F794E4069B0B5A5D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nB..#.L#.L#.Llr(L.#.Llr)LM#.Llr.L"#.L...L/#.L#.LL#.Llr,L$#.Llr.L+#.Llr.L+#.Llr.L+#.LRich*#.L................PE..d.....OR.........." .................Z....................................... .......=....`.................................................X...<...............$........>..........P3..............................`...p............0...............................text...G........................... ..`.rdata...z...0...\|... ..............@..@.data...,:..........................@....pdata..$...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF000369B7BB1DD334.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2696386290365842
Encrypted:	false
SSDEEP:	48:xt8unJb0FXiKT5TV1d96RLjxL4iSmRSsuFOVSIVkQZmc:n81/T9d9aLVL4iVRFkgJkQZmc
MD5:	EF0E4CBA5A6C4C4337749976209B649B
SHA1:	BEDEEA445ABC6889BE2196173C91E809837A653C
SHA-256:	8099B0B7BC9979903E85D191859A21286044AC5A191A1B6ECF1C786FCA3698DE
SHA-512:	94162F7A012E3C60CFAFCD4B218B7E25D044645CA7012B9D321AA0D2332A1BDFB1882E4085381D446BD3841B1CE4FD838093B419B535C869203B8F11D21A4E6A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0B2410DF9F7DD12C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5907377300064671
Encrypted:	false
SSDEEP:	48:c8Ph0uRc06WXiZnT5md96RLjxL4iSmRSsuFOVSIVkQZmc:zh013nTo9aLVL4iVRFkgJkQZmc
MD5:	114782C24ECC5B334EBE8C64FD85F942
SHA1:	5AB5B3AA808100019768C1CF08EC5A5876DBB456
SHA-256:	B67E94E8AAD3273067F1B568FBCDEC46AF948919B2768FD6F402DC92A874C428
SHA-512:	4AC7784B2CDEA1D5CF4ED63F1016BE0990925E6AA5B3B271E53C02B6E7585261B1A886047A10B10AC90643C1420464265C6F868275D24DA05DFF292D5F684F68
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0DB6E3F7990A05D9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5844288355689327
Encrypted:	false
SSDEEP:	48:N8Ph0uRc06WXiJnT5Kd/Emqi16UESmRSsuFOMSITQZbEmqi:wh01HnTcHXEVRFk5XQZ
MD5:	525FCA5CAFF5E93D8531903242C673ED
SHA1:	C0B8A33F29D8155592C3835CE5339C81231DF6B4
SHA-256:	D4C42A88F63A12FF18DFB6FB584381954853AAF990E9F879F9F80CDB83E48637
SHA-512:	F0CC0176BE12928FCC30D24074BF22E8653A7CC36D5A24699FF24F11F2728B361DA2AF11A3DAD514218E47A10C2680F80E9034CA42C596D46F078E9C77BA1640
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF10071166B599346F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.14220032530374838
Encrypted:	false
SSDEEP:	24:wARymveJZwBiEYsjipVjipVsS0W1VKuF1gNlGbWJ+qdMClHARymvkMClmVj3m:emv2Z9EdSRSmRSsuFOt1dFmvk6
MD5:	63D21BAD264DF09C5144E33DAED0C1D3
SHA1:	44C0BE9CA781B851718690082DF5CCC9673746D2
SHA-256:	4548B4BB3AA0AA718798C821DEC6485D00410A329CC343069D00945290AEADEF
SHA-512:	E75D98185BE6EFD71FD342ED30CD978A74492B8C490D94BF76E128F12DB5E89D5C606AB3FD83FB39BF458A9BA3BE198C287735977426B42E5C8274BFF72035A5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF11191F65FA51981A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF169ADE7E6BE4F80C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1716C4667B531A4B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.268936751120112
Encrypted:	false
SSDEEP:	48:kt8unJb0FXiOT5TVIdH6RLBLE/SmRSsuFOMSIVkQZ6c:g81zT92HaLBLE/VRFk5JkQZ6c
MD5:	88ED549A55FE1298A426455C7EB99F87
SHA1:	393037F592EA632C8B45AD67935258CB8BE59F93
SHA-256:	579D282DC616D25B413CB83EF89BC82D338F2504D55EB6644B71E4F02CD6A5CC
SHA-512:	F622D4B0D1B988834F19C91F318196EB1DDDF1D8AE5BD16289D8979CDAA1C26007A7EAEF60E7993341E4CD54C6E938D0C2D5CAD89D0FFA5B5D90153C4032984E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF18AF089E9E5D6D31.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF19ACBD4DD4DF1121.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10213395772452796
Encrypted:	false
SSDEEP:	6:xPLG7iVCnLG7iVrKOzPLHKOuq+kpxEoHeM9RalSfIsa+QliVky6lJl0t/:50i8n0itFzDHFubeJesalS/a+QDr01
MD5:	E8CE189EA22F5871DCEC4C2175FA7B3F
SHA1:	5E9CD251EDEBD52B123751CBE2E2EFCC8EF3D324
SHA-256:	488C2F1F5C09F8E35FAFF56A5C69B7CB204B66C01CABB23214BE031A0590275C
SHA-512:	B8F4EE8D67710FF37B46B99283EB93B5336E97FD2AFA922FD8325F3570F6043571DA56E66F505049EBC93B0145F93EEB6860ACD66DBD908DB333D74C91FB6CC0
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1A0FF75DC1117746.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2696386290365842
Encrypted:	false
SSDEEP:	48:xt8unJb0FXiKT5TV1d96RLjxL4iSmRSsuFOVSIVkQZmc:n81/T9d9aLVL4iVRFkgJkQZmc
MD5:	EF0E4CBA5A6C4C4337749976209B649B
SHA1:	BEDEEA445ABC6889BE2196173C91E809837A653C
SHA-256:	8099B0B7BC9979903E85D191859A21286044AC5A191A1B6ECF1C786FCA3698DE
SHA-512:	94162F7A012E3C60CFAFCD4B218B7E25D044645CA7012B9D321AA0D2332A1BDFB1882E4085381D446BD3841B1CE4FD838093B419B535C869203B8F11D21A4E6A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1A139A91E83B931A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2650273687564504
Encrypted:	false
SSDEEP:	48:BT8u9Jb0FXi6T5TVZd/Emqi16UESmRSsuFOMSITQZbEmqi:J8LPT95HXEVRFk5XQZ
MD5:	1F2BE778A1C06C9D50D73D6CD22C833A
SHA1:	7CF9089E8264F1690051AF75C611B2D944B6CC9E
SHA-256:	9CDBB93E5D2A2312861305BCCF416429D0EB07410B3F45DFE1352F1A305651D0
SHA-512:	A5490C4A42D878B960F8E6403A88DD8C5A61414055796BF8177EEC10879A8D7D02F33E658FD47017423023DC0035A0ECF2B6D0B4BD489F32A4AD0234E1BB9529
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2432138DF0145C0F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2BC60ABEB47811EC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10235320659675191
Encrypted:	false
SSDEEP:	12:50i8n0itFzDHFSD58bAzsvnIH1oOBDr01:mF0mly58basUuO6
MD5:	B0543A0543CAA4B3BE838914865B700F
SHA1:	449ECEEDE342197F6742CDD4AC70A5AEBC83E2CC
SHA-256:	7E0F07110CE1E890ABA58AE658C93AF34F2336CE5D4477F7B25D690CF52E79C7
SHA-512:	22CAE6296067C48EAAF77B298FDDC7BD9DC5234755308AD8681BC7E07E3143F00DB73C7C11701E798A8EF0FA0DCE5FC6D293162BEB7B9ACE5DD2E986958AD9FD
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2ED80F8E0B5F360B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3F6B0D23C3FC00E1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF42F9C4F0203B0018.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.14376234844755825
Encrypted:	false
SSDEEP:	24:cZ6cpqEYaazipVjipVsS0W1VKuF1gNlG5r+udMClpMClmVj1LFGm1LF:cZ6cQEVmSRSmRSsuFO8xdH6RLBL
MD5:	ADCEA9A45FC21C467CD41512E41C7E9F
SHA1:	6BB4B40650BCAED1EB56F63734B03E14DD436FD4
SHA-256:	ED7D03D915BB73F6502FF327E89F427AB6AC0D136DEA0A170B1D93AF918CF2C6
SHA-512:	043C487FAA12829B423D4420278E2D4C0B551FED4005A31E3F0008A11ED76A42F23FBD76D535B71C3321E90182F943C3287E53F72B35058F2100B2A8F05096D4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4F906C13DE5C216E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5861668197649532
Encrypted:	false
SSDEEP:	48:iy8Ph0uRc06WXilnT5ddFmvk6sZSmRSsuFOVSITQZ9mv:mh01LnTZFfPZVRFkgXQZ9
MD5:	D17559A1CE3C0D0C51A2ED574FC2998C
SHA1:	7A5C50384AFB7A34607BBC71F90155A0FF34C723
SHA-256:	4173B5DB774989190B0E64D03B2334D067C3B19304121EA97C35ADC4061D766B
SHA-512:	EE201FF2D7A58025D51100FE2D699789BA192EE29E6D019001A27445608D6A5EFC519409EE2A2E2005B52296EC0D85EABC234F81E021C6615AC1548A8F0CE4A5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF536340503EFC7231.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF60705592BCC68C90.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.14419792115754163
Encrypted:	false
SSDEEP:	24:88OZmcpqEYaazipVjipVsS0W1VKuF1gNlGbWw+WdMClZ8sMClmVj1Lj4m1LF:+ZmcQEVmSRSmRSsuFOUJd96RLjxL
MD5:	E0B1E98F1630D86779E333E7E53CADB3
SHA1:	34751D7635C55BC2E0C05BD57E2007B494E5AD79
SHA-256:	F7F4E4BEAC5F98BE1483B8B6083382BB04E8E9D268748598EDF172B383F0FBF1
SHA-512:	07E984E241B8E124FBF2973544E711B70AE5E6448DB8711536A332DCE78882A5184785AC28DC97248B23A7906F8F543F1CB91F241B5A3B6658FF376A1270216C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6303E8343006DCDB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5893664443049516
Encrypted:	false
SSDEEP:	48:o8Ph0uRc06WXidnT5bdH6RLBLE/SmRSsuFOMSIVkQZ6c:3h01znTfHaLBLE/VRFk5JkQZ6c
MD5:	3A9E097854CC49DD59E70B5982724A42
SHA1:	1C28E5739892DE79DD67BAE468330833F1768CB6
SHA-256:	B69661ACB7C3A5811AAB3D21C7BA60A8B229B8FD42DC09022E94163969AD3417
SHA-512:	117F622553318B07BCF10891E6C0606A3C05D0E0BFB3BBF89B67A6161451BA08FAEED693C4FA69300263938F4D4587A94FDF2C686CCAA55D79F06B0011310E9F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF64227C3C94EA9FE2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2658674198730475
Encrypted:	false
SSDEEP:	48:AvT8u9Jb0FXi2T5TVedFmvk6sZSmRSsuFOVSITQZ9mv:Ab8LbT9MFfPZVRFkgXQZ9
MD5:	D0D76D3F0E434F9BEA17582AD3C5E108
SHA1:	3833A7315411C8B45F020E9BF2E8A72C885D401C
SHA-256:	5D14F86B544C5B88C562C3D026F3914BB8B103C7127D83C78DDAEFF427FC1A2C
SHA-512:	9D8857D04FFD756A56481CD68B73C5D63DA49ABDA10748261E3BDD353B9414A530E7AEF5B80E9605CC99FAE5C64BC420ABC26170325C975A2E4CF9B9DEB2DE1F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7414FE3A4A137E10.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5844288355689327
Encrypted:	false
SSDEEP:	48:N8Ph0uRc06WXiJnT5Kd/Emqi16UESmRSsuFOMSITQZbEmqi:wh01HnTcHXEVRFk5XQZ
MD5:	525FCA5CAFF5E93D8531903242C673ED
SHA1:	C0B8A33F29D8155592C3835CE5339C81231DF6B4
SHA-256:	D4C42A88F63A12FF18DFB6FB584381954853AAF990E9F879F9F80CDB83E48637
SHA-512:	F0CC0176BE12928FCC30D24074BF22E8653A7CC36D5A24699FF24F11F2728B361DA2AF11A3DAD514218E47A10C2680F80E9034CA42C596D46F078E9C77BA1640
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF76FF6C876C0BFD74.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.14159648923872314
Encrypted:	false
SSDEEP:	24:kEmqWVdZiiEYsjipVjipVsS0W1VKuF1gNlG5I3+kdMClBEmqWV1MClmVjLm:kEmqidZpEdSRSmRSsuFOP7d/Emqi16
MD5:	86C8A5C9820690F8FFA7A0724F4CD729
SHA1:	FAD36DD34C59B49E0C43816F5B946A3B755385D5
SHA-256:	B0844E6623D4D8CD5FEAF0A1A90CBEB85B25CCABD6EDD39FA28FB15902922C5A
SHA-512:	867D8FB5834D48798758FB1928BB9E2A8C1B0679D3DD8BEED3C482EEB8B22F88BE60A8377FCEA52F99D5823A8BAC3753158CABA20335A29DD44C369F6E270C4F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF81ECD322F8600CAE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF838D95FF5FB04A90.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8E36FD6CB8A575BE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2696386290365842
Encrypted:	false
SSDEEP:	48:xt8unJb0FXiKT5TV1d96RLjxL4iSmRSsuFOVSIVkQZmc:n81/T9d9aLVL4iVRFkgJkQZmc
MD5:	EF0E4CBA5A6C4C4337749976209B649B
SHA1:	BEDEEA445ABC6889BE2196173C91E809837A653C
SHA-256:	8099B0B7BC9979903E85D191859A21286044AC5A191A1B6ECF1C786FCA3698DE
SHA-512:	94162F7A012E3C60CFAFCD4B218B7E25D044645CA7012B9D321AA0D2332A1BDFB1882E4085381D446BD3841B1CE4FD838093B419B535C869203B8F11D21A4E6A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF90FF957E69F6F381.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.268936751120112
Encrypted:	false
SSDEEP:	48:kt8unJb0FXiOT5TVIdH6RLBLE/SmRSsuFOMSIVkQZ6c:g81zT92HaLBLE/VRFk5JkQZ6c
MD5:	88ED549A55FE1298A426455C7EB99F87
SHA1:	393037F592EA632C8B45AD67935258CB8BE59F93
SHA-256:	579D282DC616D25B413CB83EF89BC82D338F2504D55EB6644B71E4F02CD6A5CC
SHA-512:	F622D4B0D1B988834F19C91F318196EB1DDDF1D8AE5BD16289D8979CDAA1C26007A7EAEF60E7993341E4CD54C6E938D0C2D5CAD89D0FFA5B5D90153C4032984E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF96FDBFF93CCD201D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF973B7E94CBE79E86.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10343497915702723
Encrypted:	false
SSDEEP:	6:xPLG7iVCnLG7iVrKOzPLHKO27DUyHXJEM9TEkssGiNKcBlIVky6l80t/:50i8n0itFzDHF4DTXJECNKqp801
MD5:	B5F71D86463E8127906D2F043DE873CB
SHA1:	EC9FCB57A19E02016EB06A875A9D40C58713A5F9
SHA-256:	82A11C1DCA0E561A30D834C95B90A3E82B8BBDFD001B3DC68CC19687C7A342AD
SHA-512:	1B9D96ABDBAC664745D1145D499817524F6F8C72DA8A6660C61494C32D54C7D4A3579EF288BC29C717D8BC0DFEE7312166A37977763061BD347341B34B8D7000
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF99B886D60B172568.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.268936751120112
Encrypted:	false
SSDEEP:	48:kt8unJb0FXiOT5TVIdH6RLBLE/SmRSsuFOMSIVkQZ6c:g81zT92HaLBLE/VRFk5JkQZ6c
MD5:	88ED549A55FE1298A426455C7EB99F87
SHA1:	393037F592EA632C8B45AD67935258CB8BE59F93
SHA-256:	579D282DC616D25B413CB83EF89BC82D338F2504D55EB6644B71E4F02CD6A5CC
SHA-512:	F622D4B0D1B988834F19C91F318196EB1DDDF1D8AE5BD16289D8979CDAA1C26007A7EAEF60E7993341E4CD54C6E938D0C2D5CAD89D0FFA5B5D90153C4032984E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA05BF038CE6D6269.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA9AA057EB6B64714.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB437754F3BABA584.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2650273687564504
Encrypted:	false
SSDEEP:	48:BT8u9Jb0FXi6T5TVZd/Emqi16UESmRSsuFOMSITQZbEmqi:J8LPT95HXEVRFk5XQZ
MD5:	1F2BE778A1C06C9D50D73D6CD22C833A
SHA1:	7CF9089E8264F1690051AF75C611B2D944B6CC9E
SHA-256:	9CDBB93E5D2A2312861305BCCF416429D0EB07410B3F45DFE1352F1A305651D0
SHA-512:	A5490C4A42D878B960F8E6403A88DD8C5A61414055796BF8177EEC10879A8D7D02F33E658FD47017423023DC0035A0ECF2B6D0B4BD489F32A4AD0234E1BB9529
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB82E0EFE2FC85EEF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10291969417758479
Encrypted:	false
SSDEEP:	6:xPLG7iVCnLG7iVrKOzPLHKOUChUtV7w/QYM9TEkjuDiAmPlIVky6l80t/:50i8n0itFzDHFbOSJ4+Yp801
MD5:	E17A37C452A8FE282F34B77028C00494
SHA1:	120916072CFF00B9AF422758A1BE37189E34CEA9
SHA-256:	A6D1980A3923B3C548013AB71745DD7978724A67C6EA3002AB7E74D5783EFA81
SHA-512:	A1CCCB30DC3D894C52A8CC070A7991F6C872ABE1A6B454C06C08BA3054FF8954E3A407DFB0F28B2A013A8468AE0BF8052ACB70B6C1B47C5B99657B2BEA6DEE3B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB9934FBE80B3F0CD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBA3DB368CD8DA69E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC2A31685B11C92E5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2658674198730475
Encrypted:	false
SSDEEP:	48:AvT8u9Jb0FXi2T5TVedFmvk6sZSmRSsuFOVSITQZ9mv:Ab8LbT9MFfPZVRFkgXQZ9
MD5:	D0D76D3F0E434F9BEA17582AD3C5E108
SHA1:	3833A7315411C8B45F020E9BF2E8A72C885D401C
SHA-256:	5D14F86B544C5B88C562C3D026F3914BB8B103C7127D83C78DDAEFF427FC1A2C
SHA-512:	9D8857D04FFD756A56481CD68B73C5D63DA49ABDA10748261E3BDD353B9414A530E7AEF5B80E9605CC99FAE5C64BC420ABC26170325C975A2E4CF9B9DEB2DE1F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC31C196470DB2464.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC34936F97E5E09E5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5861668197649532
Encrypted:	false
SSDEEP:	48:iy8Ph0uRc06WXilnT5ddFmvk6sZSmRSsuFOVSITQZ9mv:mh01LnTZFfPZVRFkgXQZ9
MD5:	D17559A1CE3C0D0C51A2ED574FC2998C
SHA1:	7A5C50384AFB7A34607BBC71F90155A0FF34C723
SHA-256:	4173B5DB774989190B0E64D03B2334D067C3B19304121EA97C35ADC4061D766B
SHA-512:	EE201FF2D7A58025D51100FE2D699789BA192EE29E6D019001A27445608D6A5EFC519409EE2A2E2005B52296EC0D85EABC234F81E021C6615AC1548A8F0CE4A5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC585B2E7668878CD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD33D888942A41EC2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2650273687564504
Encrypted:	false
SSDEEP:	48:BT8u9Jb0FXi6T5TVZd/Emqi16UESmRSsuFOMSITQZbEmqi:J8LPT95HXEVRFk5XQZ
MD5:	1F2BE778A1C06C9D50D73D6CD22C833A
SHA1:	7CF9089E8264F1690051AF75C611B2D944B6CC9E
SHA-256:	9CDBB93E5D2A2312861305BCCF416429D0EB07410B3F45DFE1352F1A305651D0
SHA-512:	A5490C4A42D878B960F8E6403A88DD8C5A61414055796BF8177EEC10879A8D7D02F33E658FD47017423023DC0035A0ECF2B6D0B4BD489F32A4AD0234E1BB9529
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD5101CE646CC83AA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE1DC9EE30FB3F35C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2658674198730475
Encrypted:	false
SSDEEP:	48:AvT8u9Jb0FXi2T5TVedFmvk6sZSmRSsuFOVSITQZ9mv:Ab8LbT9MFfPZVRFkgXQZ9
MD5:	D0D76D3F0E434F9BEA17582AD3C5E108
SHA1:	3833A7315411C8B45F020E9BF2E8A72C885D401C
SHA-256:	5D14F86B544C5B88C562C3D026F3914BB8B103C7127D83C78DDAEFF427FC1A2C
SHA-512:	9D8857D04FFD756A56481CD68B73C5D63DA49ABDA10748261E3BDD353B9414A530E7AEF5B80E9605CC99FAE5C64BC420ABC26170325C975A2E4CF9B9DEB2DE1F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE23309FEAC57690D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5907377300064671
Encrypted:	false
SSDEEP:	48:c8Ph0uRc06WXiZnT5md96RLjxL4iSmRSsuFOVSIVkQZmc:zh013nTo9aLVL4iVRFkgJkQZmc
MD5:	114782C24ECC5B334EBE8C64FD85F942
SHA1:	5AB5B3AA808100019768C1CF08EC5A5876DBB456
SHA-256:	B67E94E8AAD3273067F1B568FBCDEC46AF948919B2768FD6F402DC92A874C428
SHA-512:	4AC7784B2CDEA1D5CF4ED63F1016BE0990925E6AA5B3B271E53C02B6E7585261B1A886047A10B10AC90643C1420464265C6F868275D24DA05DFF292D5F684F68
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEE14A837D8DC3E62.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5893664443049516
Encrypted:	false
SSDEEP:	48:o8Ph0uRc06WXidnT5bdH6RLBLE/SmRSsuFOMSIVkQZ6c:3h01znTfHaLBLE/VRFk5JkQZ6c
MD5:	3A9E097854CC49DD59E70B5982724A42
SHA1:	1C28E5739892DE79DD67BAE468330833F1768CB6
SHA-256:	B69661ACB7C3A5811AAB3D21C7BA60A8B229B8FD42DC09022E94163969AD3417
SHA-512:	117F622553318B07BCF10891E6C0606A3C05D0E0BFB3BBF89B67A6161451BA08FAEED693C4FA69300263938F4D4587A94FDF2C686CCAA55D79F06B0011310E9F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEF4EE7FC4F89C8E6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF68D72E0B4DBD16D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFE0F8D2EA7A0DB91.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.992730106375394
TrID:	Win32 Executable (generic) a (10002005/4) 95.94% DirectShow filter (201580/2) 1.93% Windows ActiveX control (116523/4) 1.12% Win32 EXE PECompact compressed (v2.x) (59071/9) 0.57% Win32 EXE PECompact compressed (generic) (41571/9) 0.40%
File name:	LocalPlayback.exe
File size:	80'556'152 bytes
MD5:	ef3eafbf2d877473b2802e1add2857ad
SHA1:	c60a150229844a0f1822556700c6a8cefd683a30
SHA256:	88fcc295ae1a01ca93de900d4fd56411dbf197453d07e2c109faa714558bf81b
SHA512:	27c2a3552a8fced7826cff45951cc204d0c26ea23fb2d1bcca3d53f5dd08658c0b1ce230c4d86a8ab4e9fd7cf6dd8a327c03b996114e9735220b68c6b04fadd9
SSDEEP:	1572864:QzzU2JzqdRLou6zU2J6sXLZ7yrapqfs3BflOoLpRw:QV8RFi64d7ymUfAflOgpRw
TLSH:	85083303BA81A02EE6A10131CC7F6E6456947DB74B224A9BB794FE5C2DF02D1B937707
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X=..6n..6n..6n[2.n..6n.3.n..6n.3.n\|.6n[2.n..6n.3.n..6n...n..6n..7nY.6n...n..6n[2.n..6n[2.n..6n...n..6n[2.n..6nRich..6n.......

File Icon


Icon Hash:	55497933cc61714d

Static PE Info

General

Entrypoint:	0x45e1af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x55F79958 [Tue Sep 15 04:06:48 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	59bf583aed393d5efd11b26367bfdcc8

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	19/04/2016 00:56:10 20/04/2019 00:56:10
Subject Chain	CN="HANGZHOU HIKVISION DIGITAL TECHNOLOGY CO.,LTD.", O="HANGZHOU HIKVISION DIGITAL TECHNOLOGY CO.,LTD.", STREET=\u676d\u5dde\u5e02\u897f\u6e56\u533a\u9a6c\u584d\u8def36\u53f7, L=Hangzhou, S=Zhejiang, C=CN, OID.1.3.6.1.4.1.311.60.2.1.2=ZHEJIANG, OID.1.3.6.1.4.1.311.60.2.1.3=CN, SERIALNUMBER=91330000733796106p, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	AA7AE4115F92468FF44FF17DD1EC45F3
Thumbprint SHA-1:	1AAB0FCFCD993B25BCF42041E192C77C254A6A44
Thumbprint SHA-256:	45853064191CA820195581969F53E1FA85294F722825063BBFAFA746CA785AF7
Serial:	11217AC8455F6698571A5CFA13EAC185C34A

Entrypoint Preview

Instruction
call 00007FD2B4E7548Fh
jmp 00007FD2B4E679AEh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+14h]
push esi
test eax, eax
je 00007FD2B4E67BAEh
cmp dword ptr [ebp+08h], 00000000h
jne 00007FD2B4E67B85h
call 00007FD2B4E66A3Ch
push 00000016h
pop esi
mov dword ptr [eax], esi
call 00007FD2B4E6E602h
mov eax, esi
jmp 00007FD2B4E67B97h
cmp dword ptr [ebp+10h], 00000000h
je 00007FD2B4E67B59h
cmp dword ptr [ebp+0Ch], eax
jnc 00007FD2B4E67B7Bh
call 00007FD2B4E66A1Eh
push 00000022h
jmp 00007FD2B4E67B52h
push eax
push dword ptr [ebp+10h]
push dword ptr [ebp+08h]
call 00007FD2B4E64708h
add esp, 0Ch
xor eax, eax
pop esi
pop ebp
ret
push ebp
mov ebp, esp
xor edx, edx
mov eax, edx
cmp dword ptr [ebp+0Ch], eax
jbe 00007FD2B4E67B83h
mov ecx, dword ptr [ebp+08h]
cmp word ptr [ecx], dx
je 00007FD2B4E67B7Bh
inc eax
add ecx, 02h
cmp eax, dword ptr [ebp+0Ch]
jc 00007FD2B4E67B64h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+0Ch]
push edi
test ecx, ecx
je 00007FD2B4E67C08h
push esi
push ebx
mov ebx, ecx
mov esi, dword ptr [esp+14h]
test esi, 00000003h
mov edi, dword ptr [esp+10h]
jne 00007FD2B4E67B7Dh
shr ecx, 02h
jne 00007FD2B4E67BFBh
jmp 00007FD2B4E67B99h
mov al, byte ptr [esi]
add esi, 01h
mov byte ptr [edi], al
add edi, 01h
sub ecx, 01h
je 00007FD2B4E67B9Dh
test al, al
je 00007FD2B4E67BA1h
test esi, 00000003h
jne 00007FD2B4E67B57h

Rich Headers

Programming Language:

[ C ] VS2012 UPD1 build 51106
[C++] VS2012 UPD1 build 51106
[RES] VS2012 UPD1 build 51106
[LNK] VS2012 UPD1 build 51106

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd2ff8	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xdb000	0x4c328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4cceb68	0x4510
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xad740	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xc2950	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xad000	0x6b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xaba3b	0xabc00	a078f72dc5c50680c37fc31180f5fe0e	False	0.4699227278930131	data	6.54130481451023	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xad000	0x28478	0x28600	62fb3997483276798e4411f74dd073da	False	0.42553333010835914	data	5.191327893018176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xd6000	0x4be4	0x2600	219685e8ad701f96ae982d565dd2110b	False	0.2778577302631579	data	4.352684547786983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xdb000	0x4c328	0x4c400	ed45db0360676911036ebdd1c16436ca	False	0.35971759733606556	data	6.534164934723333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
GIF	0xdbed4	0x339f	GIF image data, version 89a, 350 x 624	English	United States	0.9129020052970109
PNG	0xdf274	0x39ed	PNG image data, 360 x 150, 8-bit/color RGBA, non-interlaced			0.9975723244992919
PNG	0xe2c64	0x2fc9	PNG image data, 240 x 227, 8-bit/color RGBA, non-interlaced			0.9968119022316685
RT_BITMAP	0xe5c30	0x14220	Device independent bitmap graphic, 220 x 370 x 8, image size 81400			0.34390764454792394
RT_BITMAP	0xf9e50	0x1b5c	Device independent bitmap graphic, 180 x 75 x 4, image size 6900			0.18046830382638493
RT_BITMAP	0xfb9ac	0x38e4	Device independent bitmap graphic, 180 x 75 x 8, image size 13500			0.26689096402087337
RT_BITMAP	0xff290	0x1238	Device independent bitmap graphic, 60 x 60 x 8, image size 3600			0.23499142367066894
RT_BITMAP	0x1004c8	0x6588	Device independent bitmap graphic, 161 x 152 x 8, image size 24928, resolution 3796 x 3796 px/m, 256 important colors			0.3035934133579563
RT_BITMAP	0x106a50	0x11f88	Device independent bitmap graphic, 161 x 152 x 24, image size 73568, resolution 3780 x 3780 px/m			0.12790729268557766
RT_ICON	0x1189d8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0			0.21341463414634146
RT_ICON	0x119040	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0			0.34139784946236557
RT_ICON	0x119328	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0			0.5202702702702703
RT_ICON	0x119450	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.47334754797441364
RT_ICON	0x11a2f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.6101083032490975
RT_ICON	0x11aba0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.596820809248555
RT_ICON	0x11b108	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.2932572614107884
RT_ICON	0x11d6b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.4343339587242026
RT_ICON	0x11e758	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.7198581560283688
RT_ICON	0x11ebc0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.35618279569892475
RT_ICON	0x11eea8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.42473118279569894
RT_DIALOG	0x11f190	0x1ce	data			0.48917748917748916
RT_DIALOG	0x11f360	0x266	data			0.4527687296416938
RT_DIALOG	0x11f5c8	0x2b0	data			0.438953488372093
RT_DIALOG	0x11f878	0x54	data			0.6904761904761905
RT_DIALOG	0x11f8cc	0x34	data			0.8846153846153846
RT_DIALOG	0x11f900	0xd6	data			0.6495327102803738
RT_DIALOG	0x11f9d8	0x114	data			0.5036231884057971
RT_DIALOG	0x11faec	0xd6	data			0.5841121495327103
RT_DIALOG	0x11fbc4	0x246	data			0.4690721649484536
RT_DIALOG	0x11fe0c	0x3c8	data			0.4194214876033058
RT_DIALOG	0x1201d4	0x14e	data			0.5359281437125748
RT_DIALOG	0x120324	0x1e8	data			0.49385245901639346
RT_DIALOG	0x12050c	0x1c6	data			0.5286343612334802
RT_DIALOG	0x1206d4	0x1ee	data			0.49190283400809715
RT_DIALOG	0x1208c4	0x7c	data			0.7580645161290323
RT_DIALOG	0x120940	0x3bc	data			0.4372384937238494
RT_DIALOG	0x120cfc	0x158	data			0.5581395348837209
RT_DIALOG	0x120e54	0x1da	data			0.5168776371308017
RT_DIALOG	0x121030	0x10a	data			0.6015037593984962
RT_DIALOG	0x12113c	0xde	data			0.6441441441441441
RT_DIALOG	0x12121c	0x1d4	data			0.5085470085470085
RT_DIALOG	0x1213f0	0x1dc	data			0.5210084033613446
RT_DIALOG	0x1215cc	0x294	data			0.48787878787878786
RT_STRING	0x121860	0x160	data	English	United States	0.5340909090909091
RT_STRING	0x1219c0	0x23e	data	English	United States	0.40418118466898956
RT_STRING	0x121c00	0x378	data	English	United States	0.4222972972972973
RT_STRING	0x121f78	0x252	data	English	United States	0.4393939393939394
RT_STRING	0x1221cc	0x1f4	data	English	United States	0.442
RT_STRING	0x1223c0	0x66a	data	English	United States	0.3617539585870889
RT_STRING	0x122a2c	0x366	data	English	United States	0.41379310344827586
RT_STRING	0x122d94	0x27e	data	English	United States	0.4561128526645768
RT_STRING	0x123014	0x518	data	English	United States	0.39800613496932513
RT_STRING	0x12352c	0x882	data	English	United States	0.3002754820936639
RT_STRING	0x123db0	0x23e	data	English	United States	0.45121951219512196
RT_STRING	0x123ff0	0x3ba	data	English	United States	0.3280922431865828
RT_STRING	0x1243ac	0x12c	data	English	United States	0.5266666666666666
RT_STRING	0x1244d8	0x4a	data	English	United States	0.6756756756756757
RT_STRING	0x124524	0xda	data	English	United States	0.6100917431192661
RT_STRING	0x124600	0x110	data	English	United States	0.5845588235294118
RT_STRING	0x124710	0x20a	data	English	United States	0.4521072796934866
RT_STRING	0x12491c	0xba	Matlab v4 mat-file (little endian) P, numeric, rows 0, columns 0	English	United States	0.5860215053763441
RT_STRING	0x1249d8	0xa8	data	English	United States	0.6607142857142857
RT_STRING	0x124a80	0x12a	data	English	United States	0.5201342281879194
RT_STRING	0x124bac	0x422	data	English	United States	0.2741020793950851
RT_STRING	0x124fd0	0x5c2	data	English	United States	0.37720488466757124
RT_STRING	0x125594	0x40	data	English	United States	0.671875
RT_STRING	0x1255d4	0xcaa	data	English	United States	0.2313386798272671
RT_STRING	0x126280	0x284	data	English	United States	0.4363354037267081
RT_GROUP_ICON	0x126504	0x84	data			0.6363636363636364
RT_GROUP_ICON	0x126588	0x14	data			1.25
RT_GROUP_ICON	0x12659c	0x14	data			1.25
RT_VERSION	0x1265b0	0x44c	data			0.4290909090909091
RT_MANIFEST	0x1269fc	0x622	XML 1.0 document, ASCII text, with CRLF line terminators			0.44522292993630574
RT_MANIFEST	0x127020	0x307	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (715), with CRLF line terminators	English	United States	0.4941935483870968

Imports

DLL	Import
COMCTL32.dll
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
LZ32.dll	LZClose, LZOpenFileW, LZCopy
msi.dll
KERNEL32.dll	VirtualQuery, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, FindResourceExW, FreeLibrary, LoadLibraryExW, lstrcmpiW, lstrcpynW, lstrcatW, LoadLibraryW, GetPrivateProfileIntW, IsBadReadPtr, CompareStringW, CompareStringA, GetSystemDefaultLangID, GetUserDefaultLangID, ExpandEnvironmentStringsW, GetCurrentDirectoryW, FileTimeToLocalFileTime, GetFileTime, SetFileAttributesW, HeapAlloc, HeapFree, GetProcessHeap, CopyFileW, GetSystemInfo, GetSystemTimeAsFileTime, CreateEventW, CreateMutexW, ReleaseMutex, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, QueryPerformanceFrequency, SetErrorMode, RaiseException, WriteFile, SetFilePointer, GetFileSize, GetFileAttributesW, GetDriveTypeW, GetDiskFreeSpaceW, FindFirstFileW, FindClose, CreateDirectoryW, VerLanguageNameW, IsValidLocale, FreeResource, GetPrivateProfileSectionNamesA, GetPrivateProfileStringA, GetPrivateProfileIntA, lstrcatA, lstrcmpiA, LoadResource, FlushFileBuffers, WriteConsoleW, SetStdHandle, OutputDebugStringW, SetConsoleCtrlHandler, SetFilePointerEx, GetConsoleMode, GetConsoleCP, EnumSystemLocalesW, GetUserDefaultLCID, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetFileType, HeapReAlloc, GetStdHandle, HeapSize, AreFileApisANSI, GetModuleHandleExW, GetStringTypeW, GetCurrentThreadId, GetCPInfo, GetOEMCP, IsValidCodePage, CreateSemaphoreW, GetStartupInfoW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, SetUnhandledExceptionFilter, UnhandledExceptionFilter, FatalAppExitA, GetLocaleInfoW, WideCharToMultiByte, lstrcpyA, GetTickCount, ExitThread, CreateThread, GetExitCodeProcess, ReadFile, GetCommandLineW, FormatMessageW, LocalFree, GetVersionExW, GetWindowsDirectoryW, InterlockedDecrement, InterlockedIncrement, GetTempPathW, CreateFileW, FindResourceW, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, SizeofResource, LockResource, SetLastError, GetLastError, DuplicateHandle, RemoveDirectoryW, DeleteFileW, SetCurrentDirectoryW, lstrlenW, lstrcpyW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, CreateProcessW, Sleep, CloseHandle, GetACP, IsProcessorFeaturePresent, IsDebuggerPresent, RtlUnwind, InterlockedExchange, lstrcpynA, LocalAlloc, FindNextFileW, WritePrivateProfileSectionW, GetPrivateProfileSectionW, lstrcmpW, GetShortPathNameW, GetCurrentThread, QueryPerformanceCounter, ReadConsoleW, SearchPathW, lstrcmpA, SystemTimeToFileTime, ResetEvent, SetEvent, VirtualProtect, Process32NextW, Process32FirstW, CreateToolhelp32Snapshot, GetDateFormatW, GetTimeFormatW, GetTempFileNameW, GetEnvironmentVariableW, CompareFileTime, SetFileTime, MultiByteToWideChar, MoveFileExW, WriteProcessMemory, VirtualProtectEx, GetSystemDirectoryW, FlushInstructionCache, SetThreadContext, GetThreadContext, ResumeThread, TerminateProcess, ExitProcess, GetCurrentProcess, MulDiv, WaitForSingleObject, OpenProcess, GetProcessTimes, lstrlenA, GetLocalTime, GetCurrentProcessId, GetVersion, LCMapStringW, DecodePointer, EncodePointer, LeaveCriticalSection, EnterCriticalSection
USER32.dll	SetActiveWindow, SetDlgItemTextW, GetDlgItem, SetForegroundWindow, DialogBoxIndirectParamW, MoveWindow, SendMessageW, CharUpperBuffW, SetWindowTextW, GetWindowRect, MessageBoxW, GetWindowLongW, SetWindowLongW, LoadIconW, TranslateMessage, wsprintfW, EndDialog, WaitForInputIdle, SystemParametersInfoW, GetWindow, FillRect, GetSysColor, MapWindowPoints, RemovePropW, GetPropW, SetPropW, EndPaint, BeginPaint, EnableMenuItem, GetSystemMetrics, SetFocus, DefWindowProcW, GetMessageW, LoadStringW, LoadImageW, ReleaseDC, GetDC, CreateDialogParamW, GetParent, GetWindowTextW, CharNextW, GetDesktopWindow, GetClientRect, IsWindowEnabled, CreateDialogIndirectParamW, DispatchMessageW, IsDialogMessageW, FindWindowExW, ScreenToClient, EnableWindow, MsgWaitForMultipleObjects, SendDlgItemMessageW, SetWindowPos, ShowWindow, DestroyWindow, IsWindow, ExitWindowsEx, CharUpperW, wsprintfA, CallWindowProcW, CreateWindowExW, DrawIcon, DrawTextW, UpdateWindow, GetWindowDC, InvalidateRect, DrawFocusRect, CopyRect, InflateRect, EnumChildWindows, GetClassNameW, MapDialogRect, RegisterClassExW, GetDlgItemTextW, IntersectRect, MonitorFromPoint, PostMessageW, PeekMessageW, IsWindowVisible
GDI32.dll	SetPixel, TextOutW, SetTextColor, SetBkMode, SetBkColor, SaveDC, RestoreDC, CreateSolidBrush, UnrealizeObject, CreateHalftonePalette, GetDIBColorTable, SelectPalette, SelectObject, RealizePalette, GetSystemPaletteEntries, GetDeviceCaps, DeleteDC, CreatePalette, CreateCompatibleDC, BitBlt, GetObjectW, TranslateCharsetInfo, DeleteObject, CreateFontIndirectW, CreateCompatibleBitmap, CreateDCW, CreatePatternBrush, GetStockObject, GetTextExtentPoint32W, DeleteMetaFile, CreateDIBitmap, CreateBitmap, CreateRectRgn, PatBlt, PlayMetaFile, SelectClipRgn, SetMapMode, SetMetaFileBitsEx, StretchBlt, SetStretchBltMode, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx
ADVAPI32.dll	RegQueryValueExW, RegCreateKeyExW, CryptVerifySignatureW, CryptSignHashW, CryptHashData, CryptCreateHash, CryptAcquireContextW, FreeSid, AllocateAndInitializeSid, EqualSid, GetTokenInformation, OpenThreadToken, RegEnumKeyW, RegCreateKeyW, LookupPrivilegeValueW, AdjustTokenPrivileges, OpenProcessToken, RegOpenKeyW, RegEnumValueW, RegOpenKeyExW, RegQueryInfoKeyW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegSetValueExW, RegCloseKey
SHELL32.dll	SHGetMalloc, SHGetPathFromIDListW, SHGetSpecialFolderLocation, ShellExecuteExW
ole32.dll	StringFromGUID2, CoCreateGuid, CoLoadLibrary, CreateItemMoniker, GetRunningObjectTable, CoUninitialize, CoInitializeEx, ProgIDFromCLSID, CreateStreamOnHGlobal, CoInitializeSecurity, CoCreateInstance, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree
OLEAUT32.dll	VariantInit, LoadTypeLib, RegisterTypeLib, SetErrorInfo, CreateErrorInfo, VarBstrCmp, SysAllocString, SysFreeString, SysStringLen, SysAllocStringLen, SysReAllocStringLen, GetErrorInfo, SysStringByteLen, SysAllocStringByteLen, VariantChangeType, VariantClear, VarUI4FromStr, VarBstrCat
CRYPT32.dll	CertOpenSystemStoreW, CryptAcquireCertificatePrivateKey, CryptImportPublicKeyInfo, CertCompareCertificate, CertAddCertificateContextToStore, CertGetCertificateContextProperty, CertSetCertificateContextProperty, CertGetIssuerCertificateFromStore, CertFindCertificateInStore, CertEnumCertificatesInStore, CertSaveStore, CertOpenStore, PFXImportCertStore
RPCRT4.dll	UuidCreate, UuidToStringW, UuidFromStringW, RpcStringFreeW
gdiplus.dll	GdipGetImageWidth, GdipGetImageHeight, GdipAlloc, GdipFree, GdiplusStartup, GdipCloneImage, GdipDrawImageRectI, GdipSetInterpolationMode, GdipDeleteGraphics, GdipCreateFromHDC, GdipCreateBitmapFromResource, GdipCreateBitmapFromFileICM, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromFile, GdipCreateBitmapFromStream, GdipDisposeImage

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T13:01:17.260694+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49983	49.51.129.211	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 13:01:16.396188021 CEST	49983	80	192.168.2.7	49.51.129.211
Oct 24, 2024 13:01:16.401561975 CEST	80	49983	49.51.129.211	192.168.2.7
Oct 24, 2024 13:01:16.401751995 CEST	49983	80	192.168.2.7	49.51.129.211
Oct 24, 2024 13:01:16.402729988 CEST	49983	80	192.168.2.7	49.51.129.211
Oct 24, 2024 13:01:16.408006907 CEST	80	49983	49.51.129.211	192.168.2.7
Oct 24, 2024 13:01:17.260489941 CEST	80	49983	49.51.129.211	192.168.2.7
Oct 24, 2024 13:01:17.260694027 CEST	49983	80	192.168.2.7	49.51.129.211

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 13:01:16.368952036 CEST	50746	53	192.168.2.7	1.1.1.1
Oct 24, 2024 13:01:16.389944077 CEST	53	50746	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 13:01:16.368952036 CEST	192.168.2.7	1.1.1.1	0x85d8	Standard query (0)	hikdownload.hik-connect.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 13:01:16.389944077 CEST	1.1.1.1	192.168.2.7	0x85d8	No error (0)	hikdownload.hik-connect.com		49.51.129.211	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hikdownload.hik-connect.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49983	49.51.129.211	80	5600	C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 13:01:16.402729988 CEST	97	OUT	GET /4200/tool/windows/LocalPlayback/package.json HTTP/1.1 Host: hikdownload.hik-connect.com
Oct 24, 2024 13:01:17.260489941 CEST	407	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 11:01:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 242 Connection: keep-alive Server: Tengine Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body bgcolor="white"><h1>404 Not Found</h1><p>The requested URL was not found on this server.<hr/>Powered by Tengine</body></html>

Target ID:	2
Start time:	06:59:43
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\LocalPlayback.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LocalPlayback.exe"
Imagebase:	0x400000
File size:	80'556'152 bytes
MD5 hash:	EF3EAFBF2D877473B2802E1ADD2857AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:59:48
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F60EF52-B8AE-4C65-B672-4ECBA9C7EF64}
Imagebase:	0x7ff75d260000
File size:	182'008 bytes
MD5 hash:	1AE40C548AE265EFF8D25EA7538A5196
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:59:48
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DEBE9773-6CCB-402A-A045-44F23FC2C3BA}
Imagebase:	0x7ff75d260000
File size:	182'008 bytes
MD5 hash:	1AE40C548AE265EFF8D25EA7538A5196
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:59:48
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E46B7176-3FFC-40C6-B559-180C9F23E714}
Imagebase:	0x7ff75d260000
File size:	182'008 bytes
MD5 hash:	1AE40C548AE265EFF8D25EA7538A5196
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:59:48
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E5BF0CED-81A6-4ECC-9E75-24C1C03367D2}
Imagebase:	0x7ff75d260000
File size:	182'008 bytes
MD5 hash:	1AE40C548AE265EFF8D25EA7538A5196
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:59:48
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{83415305-25EC-4DB0-8231-2F0B7AC0579F}
Imagebase:	0x7ff75d260000
File size:	182'008 bytes
MD5 hash:	1AE40C548AE265EFF8D25EA7538A5196
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:59:53
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3309AE38-3356-4998-B51D-DDEA1CA316CD}
Imagebase:	0x7ff75d260000
File size:	182'008 bytes
MD5 hash:	1AE40C548AE265EFF8D25EA7538A5196
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:55:48
Start date:	24/10/2024
Path:	C:\Windows\System32\SrTasks.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Imagebase:	0x7ff711230000
File size:	59'392 bytes
MD5 hash:	2694D2D28C368B921686FE567BD319EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:55:48
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:55:48
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe /q
Imagebase:	0x410000
File size:	6'503'984 bytes
MD5 hash:	0FC525B6B7B96A87523DAA7A0013C69D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:55:49
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x86.exe" /q -burn.unelevated BurnPipe.{DBEA4BDC-32D1-4571-8C40-9D2304124BE9} {91C7A57E-FB61-4624-AACC-1188F529C9A7} 8120
Imagebase:	0x410000
File size:	6'503'984 bytes
MD5 hash:	0FC525B6B7B96A87523DAA7A0013C69D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:55:52
Start date:	24/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6ab9c0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	08:55:57
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe /q
Imagebase:	0x3b0000
File size:	7'195'312 bytes
MD5 hash:	385194EB89B6741781CB9065D8E8158E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:55:57
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{77F7B223-84F4-43AE-9469-CC107488BB8B}\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\vcredist_x64_2013.exe" /q -burn.unelevated BurnPipe.{0942DD9A-AF4A-432E-BD2D-A92FFBEDB9E9} {F3730AF5-9EE5-4B54-A568-50E8BA9679B4} 1876
Imagebase:	0x3b0000
File size:	7'195'312 bytes
MD5 hash:	385194EB89B6741781CB9065D8E8158E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:56:03
Start date:	24/10/2024
Path:	C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe" /burn.runonce
Imagebase:	0xf10000
File size:	461'368 bytes
MD5 hash:	2335AB0C0E19C0EF416D07DF66FEE649
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:56:03
Start date:	24/10/2024
Path:	C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe"
Imagebase:	0xf10000
File size:	461'368 bytes
MD5 hash:	2335AB0C0E19C0EF416D07DF66FEE649
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	08:56:26
Start date:	24/10/2024
Path:	C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LocalPlayback\LocalPlayback.exe"
Imagebase:	0xc30000
File size:	1'877'776 bytes
MD5 hash:	7DE44B22F47E7F2B625C6A3611FE7471
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	3.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	53

Executed Functions

Function 00424C8F Relevance: 61.8, APIs: 31, Strings: 4, Instructions: 537
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00424C99

Part of subcall function 00423F76: __EH_prolog3.LIBCMT ref: 00423F7D
Part of subcall function 00423F76: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000008,https://,00000000,00000000,00000007,http://,00000000,?), ref: 00423FD7

Part of subcall function 00424A4A: SetFilePointer.KERNELBASE(000000FF,?,000000FF,?), ref: 00424A65

FindFirstFileW.KERNELBASE(?,?), ref: 00424D1F
lstrcpyW.KERNEL32(?,00000000), ref: 00424E0A
lstrlenW.KERNEL32(?), ref: 00424E17
lstrcpyW.KERNEL32(?,00000000), ref: 00424E49
lstrlenW.KERNEL32(?), ref: 00424E56
lstrcpyW.KERNEL32(?,00000000), ref: 00424E85
lstrlenW.KERNEL32(?), ref: 00424E8F

Part of subcall function 00423079: FindClose.KERNELBASE(?,00000000,004410CC), ref: 0042308C

Strings

x$L, xrefs: 0042504A, 00425050
.cab, xrefs: 004250D0
data, xrefs: 00425163
data1.cab, xrefs: 00425176

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Filelstrcpylstrlen$Find$CloseCreateFirstH_prolog3H_prolog3_Pointer
String ID: .cab$data$data1.cab$x$L
API String ID: 2212002782-3050389258
Opcode ID: eb18f9c597cf9e4ebe6698aeb144e5b35675dd5261d81b0c743936e4a7ca352e
Instruction ID: 3843fdc0f88157833b95fbaeae4f30d9cdeba3b7f96c913795862cdda23dbba1
Opcode Fuzzy Hash: eb18f9c597cf9e4ebe6698aeb144e5b35675dd5261d81b0c743936e4a7ca352e
Instruction Fuzzy Hash: 82327571E0022C9ADB20EBA4DC45FDEB778AF56304F4001EAE50AA3551DB785F89CF5A

Function 0041B88A Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0041B894
_memset.LIBCMT ref: 0041B8C3
_memset.LIBCMT ref: 0041B8E0
_memset.LIBCMT ref: 0041B8FA
_memset.LIBCMT ref: 0041B914
_memset.LIBCMT ref: 0041B92E
_memset.LIBCMT ref: 0041B948
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 0041B959
GetModuleHandleW.KERNEL32(Advapi32,CreateWellKnownSid), ref: 0041B97A
GetProcAddress.KERNEL32(00000000), ref: 0041B97D

Strings

CreateWellKnownSid, xrefs: 0041B970
Advapi32, xrefs: 0041B975
H, xrefs: 0041BA26
advapi32, xrefs: 0041BA72
SetEntriesInAclW, xrefs: 0041BA67

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _memset$AddressDescriptorH_prolog3_HandleInitializeModuleProcSecurity
String ID: Advapi32$CreateWellKnownSid$H$SetEntriesInAclW$advapi32
API String ID: 2000725198-1905010947
Opcode ID: 4eea191ee7cb3b7656562b5d488397179956fa1050e56265fc91d750e860e2a2
Instruction ID: b1f580ffdca7f70f0bc90f6815aac9f327823fbbb2abe33968f800e5be94917c
Opcode Fuzzy Hash: 4eea191ee7cb3b7656562b5d488397179956fa1050e56265fc91d750e860e2a2
Instruction Fuzzy Hash: C691ECB1D4122DAEDB20DF95CC85BDEBABCFB08700F5044EBA509E2241D7749A85CF65

Function 0043A720 Relevance: 35.3, APIs: 5, Strings: 15, Instructions: 290
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0043A72A

Part of subcall function 00447BB4: __EH_prolog3_GS.LIBCMT ref: 00447BBB
Part of subcall function 00447BB4: RegQueryValueExW.KERNELBASE(?,?,00000000,00000008,00000000,004C2418,0000005C,0041A47F,?,-80000001,?,?), ref: 00447C30

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

GetCurrentProcessId.KERNEL32(bin,00000000), ref: 0043A877
_memset.LIBCMT ref: 0043A8B7
GetLocalTime.KERNEL32(?), ref: 0043A93C

Part of subcall function 004398B8: __EH_prolog3_GS.LIBCMT ref: 004398C2
Part of subcall function 004398B8: _memset.LIBCMT ref: 004398E7
Part of subcall function 004398B8: SHGetSpecialFolderLocation.SHELL32(00000000,004C2418,?,?,00000000,00000000), ref: 00439905
Part of subcall function 004398B8: SHGetPathFromIDListW.SHELL32(?,?), ref: 00439923
Part of subcall function 004398B8: SHGetMalloc.SHELL32(?), ref: 00439930

GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000104), ref: 0043A9F4

Strings

TraceStarted: %.2ld/%.2ld/%.2ld %.2ld:%.2ld:%.2ld, xrefs: 0043A97D
SetupExe: %ls, xrefs: 0043AA18
x$L, xrefs: 0043A8D8
setuptrace, xrefs: 0043A87E
SetupExeVersion: %ld.%ld.%ld.%ld, xrefs: 0043AA90
%s%s%d.%s, xrefs: 0043A884
Category|SubCategory|Details, xrefs: 0043AADF
FileNamePath, xrefs: 0043A7E9
x$L, xrefs: 0043A829, 0043A889, 0043A8DD
TraceData:, xrefs: 0043AAC6
bin, xrefs: 0043A872
TraceStd, xrefs: 0043A77A
FormatVersion=00000112, xrefs: 0043A90D
ISlogit, xrefs: 0043A73F, 0043A744, 0043A791, 0043A803
(c) Copyright 2004 InstallShield Software Corporation (All Rights Reserved), xrefs: 0043A926

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_$ErrorFreeLastString_memset$CurrentFileFolderFromListLocalLocationMallocModuleNamePathProcessQuerySpecialTimeValue
String ID: TraceData:$%s%s%d.%s$(c) Copyright 2004 InstallShield Software Corporation (All Rights Reserved)$Category|SubCategory|Details$FileNamePath$FormatVersion=00000112$ISlogit$SetupExe: %ls$SetupExeVersion: %ld.%ld.%ld.%ld$TraceStarted: %.2ld/%.2ld/%.2ld %.2ld:%.2ld:%.2ld$TraceStd$bin$setuptrace$x$L$x$L
API String ID: 2855092573-251341602
Opcode ID: 93c77b769e63ca683d91903a4864ebedd4da64819e0f43082bb220ee7156fcd9
Instruction ID: 445f10e9b133c5e87535a28cb66b0880991c8b12f24430954134dfd26bc4371c
Opcode Fuzzy Hash: 93c77b769e63ca683d91903a4864ebedd4da64819e0f43082bb220ee7156fcd9
Instruction Fuzzy Hash: 5AA1B6B1D00119ABDB10EB95CC46FEE7B7CAF45704F1000AFF905A6182EB785A05DBBA

Function 00499420 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,00495E2D,PNG,?,?,?,?,-^I,0049605F,?,-^I,00000000,?,?,?,?), ref: 00499448
FindResourceW.KERNEL32(?,00495E2D,00000002,?,00495E2D,?,00000000), ref: 00499459

Strings

PNG, xrefs: 00499441
-^I, xrefs: 00499420

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: FindResource
String ID: -^I$PNG
API String ID: 1635176832-2513401084
Opcode ID: 900416326f484f5a23a4dbb0dad0d209d7f0fed118f2182cb96053ae2cdbf372
Instruction ID: 659199c5029eb1d675b708d43f7adb74847011a9e6d3687d157de0a037f5f5b9
Opcode Fuzzy Hash: 900416326f484f5a23a4dbb0dad0d209d7f0fed118f2182cb96053ae2cdbf372
Instruction Fuzzy Hash: B73186B2A012167BDF015F69AC45AAFBFACEF05315F00017AFD09C2211D775CD1187A9

Function 0041F059 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 172librarystringloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041F063
_memset.LIBCMT ref: 0041F0A7
LoadLibraryW.KERNEL32(?,?,?), ref: 0041F0CB
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExW), ref: 0041F0F8
lstrcpyW.KERNEL32(?,00000000,?,?,?), ref: 0041F11F
lstrcatW.KERNEL32(?,004AD878), ref: 0041F131
GetDiskFreeSpaceExW.KERNELBASE(00000000,?,?), ref: 0041F190
GetLastError.KERNEL32 ref: 0041F19C
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0041F201
GetDiskFreeSpaceW.KERNELBASE(00000000,?,?,?,?), ref: 0041F2D9

Part of subcall function 0042302B: FreeLibrary.KERNELBASE(?,?,004437B0,x$L,00000000,?,?,InstalledProductName,?,00000000,?,?), ref: 0042303E

Strings

GetDiskFreeSpaceExW, xrefs: 0041F0F2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Free$DiskSpace$Library$AddressErrorH_prolog3_LastLoadProc_memsetlstrcatlstrcpy
String ID: GetDiskFreeSpaceExW
API String ID: 1728024551-1645579703
Opcode ID: df0b38d91968924a28d009d1298ad3138e16315c83863ea65ba5356e99e53b19
Instruction ID: 2560366188de5d905656997641afe808d31218057e6d6fe7efe67932e62cbb03
Opcode Fuzzy Hash: df0b38d91968924a28d009d1298ad3138e16315c83863ea65ba5356e99e53b19
Instruction Fuzzy Hash: 7C711FB5D012289BCB21DF54CD84ADAB7B8AF58304F4041EAEA09A7251DB349FC5CF99

Function 00495AB0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 119libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0043D482: __EH_prolog3_GS.LIBCMT ref: 0043D489
Part of subcall function 0043D482: GetWindowsDirectoryW.KERNEL32(00000000,00000104,00000078,00495B01,?,00000000,F14A3287,?,?,?), ref: 0043D4E1
Part of subcall function 0043D482: __CxxThrowException@8.LIBCMT ref: 0043D50E

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

LoadLibraryW.KERNEL32(?,x$L,Shcore.dll,?,00000000,?,?), ref: 00495B6D
GetProcAddress.KERNEL32(00000000,GetDpiForMonitor), ref: 00495B85
MonitorFromPoint.USER32(00000001,00000001,00000002), ref: 00495B9B
GetDC.USER32(00000000), ref: 00495BD0
GetDeviceCaps.GDI32(00000000,00000058), ref: 00495BDF
ReleaseDC.USER32(00000000,00000000), ref: 00495BEE
MulDiv.KERNEL32(00000060,00000064,00000060), ref: 00495BFE

Strings

Shcore.dll, xrefs: 00495B2E
x$L, xrefs: 00495B49, 00495B4C
`, xrefs: 00495BC2
GetDpiForMonitor, xrefs: 00495B7B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$AddressCapsDeviceDirectoryException@8FromH_prolog3H_prolog3_LibraryLoadMonitorPointProcReleaseThrowWindows
String ID: GetDpiForMonitor$Shcore.dll$`$x$L
API String ID: 1830457265-2264427624
Opcode ID: 80deb1d0ff127753b465b99b0e80ce6a299192b6cff0ce777a88f5bf60c03735
Instruction ID: 178ac9b78e7e0f67c82918355a80ed554a7b69dbc56c6f3a54f480966fd13b31
Opcode Fuzzy Hash: 80deb1d0ff127753b465b99b0e80ce6a299192b6cff0ce777a88f5bf60c03735
Instruction Fuzzy Hash: F7419271E40318AFDB21DBA4CC45FDEBBB4EF49704F14016AF905A7281EBB85944CB69

Function 0045004E Relevance: 18.1, APIs: 12, Instructions: 138threadmemoryCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00450072
OpenThreadToken.ADVAPI32(00000000,?,?,00450002,00000001,00000001), ref: 00450079
GetLastError.KERNEL32(?,?,00450002,00000001,00000001), ref: 00450089
GetCurrentProcess.KERNEL32(00000008,00000001,?,?,00450002,00000001,00000001), ref: 00450098
OpenProcessToken.ADVAPI32(00000000,?,?,00450002,00000001,00000001), ref: 0045009F
GetLastError.KERNEL32(?,?,00450002,00000001,00000001), ref: 004500A5
GetTokenInformation.KERNELBASE(00000001,00000002,00000000,00000000,?,?,?,?,00450002,00000001,00000001), ref: 004500D6
GetLastError.KERNEL32(?,?,00450002,00000001,00000001), ref: 004500EB
GetTokenInformation.KERNELBASE(00000001,00000002,00000000,?,?,?,?,00450002,00000001,00000001), ref: 0045010A
AllocateAndInitializeSid.ADVAPI32(00000001,00000002,00000020,00000223,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00450002,00000001,00000001), ref: 00450134
EqualSid.ADVAPI32(00000004,?,?,?,00450002,00000001,00000001), ref: 0045014F
FreeSid.ADVAPI32(?,?,?,00450002,00000001,00000001), ref: 0045017B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Token$ErrorLast$CurrentInformationOpenProcessThread$AllocateEqualFreeInitialize
String ID:
API String ID: 884311744-0
Opcode ID: 565b8319d7d0a27ae4eac091350561a3eaa2e8a3c3cf02aadedb9a1ed00da7f7
Instruction ID: 152400de14c5196d5cdea4c826d56466eabdbab97c3ea6be8ea9241eaebec842
Opcode Fuzzy Hash: 565b8319d7d0a27ae4eac091350561a3eaa2e8a3c3cf02aadedb9a1ed00da7f7
Instruction Fuzzy Hash: 7441C235D05209AFEF109BA4DC45FBFBBACEF05305F10442AF901A6192DA3999498B6A

Function 00425602 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000000), ref: 00425626
SetErrorMode.KERNELBASE(00000000), ref: 0042562E
CoInitializeEx.COMBASE(00000000,00000002), ref: 00425634

Part of subcall function 004442B1: GetVersionExW.KERNEL32(?), ref: 004442D5

#17.COMCTL32 ref: 0042564B
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000104), ref: 00425698

Strings

EXE=%s, xrefs: 004256CA
EXEProcessBegin, xrefs: 004256DD
ISSetupInit, xrefs: 004256F5
x$L, xrefs: 0042567C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorMode$FileInitializeModuleNameVersion
String ID: EXE=%s$EXEProcessBegin$ISSetupInit$x$L
API String ID: 1856150884-1555487937
Opcode ID: a09f44c47cc05a501723e75517e99a4bf307ad074ab2261fc4270d2f75557d6a
Instruction ID: ed6f31b468ad66013a2bcd3128e2b800c1ff5378eff554aeded9d09d5cca71aa
Opcode Fuzzy Hash: a09f44c47cc05a501723e75517e99a4bf307ad074ab2261fc4270d2f75557d6a
Instruction Fuzzy Hash: E33195B1900208ABDB14EBA1DD46FED77789F05704F40006AF609AB1D2DBB45E44CBAE

Function 0041C834 Relevance: 13.6, APIs: 9, Instructions: 144fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000), ref: 0041C85D
CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000,?,00000000), ref: 0041C886
GetSystemInfo.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,?,?,0041A66B,?,?,?), ref: 0041C8A8
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,?,?,00000000), ref: 0041C8BA
IsBadReadPtr.KERNEL32(?,000000F8), ref: 0041C8F1
UnmapViewOfFile.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,0041A66B,?,?,?), ref: 0041C912
MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,?,?,00000000), ref: 0041C922
GetLastError.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,0041A66B,?,?,?,?), ref: 0041C9A6
IsBadReadPtr.KERNEL32(?,000000F8), ref: 0041C955

Part of subcall function 00405170: CloseHandle.KERNELBASE(?,?,00417486), ref: 00405183

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: File$View$CreateRead$CloseErrorHandleInfoLastMappingSystemUnmap
String ID:
API String ID: 1839224775-0
Opcode ID: 8ece44edb24b69c27233c465356dbd45219ed297cfd79eb9be6bcb00f8d20d03
Instruction ID: e0779c611ba344591d02f9615ca80b1682cf29dfd2e3a5e4e5cf05540f9e732a
Opcode Fuzzy Hash: 8ece44edb24b69c27233c465356dbd45219ed297cfd79eb9be6bcb00f8d20d03
Instruction Fuzzy Hash: 98513DB0E41219AFDB10DFA5CC85AAEBBB8EF05744F50416AE502A7290D7749E80CF98

Function 0041C3F9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041C400
GetPrivateProfileIntW.KERNEL32(Startup,AllUsers,00000000,-00000004), ref: 0041C442

Strings

AllUsers, xrefs: 0041C438
Startup, xrefs: 0041C43D

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_PrivateProfile
String ID: AllUsers$Startup
API String ID: 477331544-1531790124
Opcode ID: b2d4f6f23854d689427d8c1093454fe10304ce327578cd2202f4c2dc8aae09ad
Instruction ID: 09592064eca5753293031b310d9edfaf6f2fba8a2e3ab43e84a3c717b10a909a
Opcode Fuzzy Hash: b2d4f6f23854d689427d8c1093454fe10304ce327578cd2202f4c2dc8aae09ad
Instruction Fuzzy Hash: AB01B1707402109FEB14DFA48D987AC77E0BF5A708F90006EE405D7291CB78ED4ACB88

Function 004372CC Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 175
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 004372D6
BeginPaint.USER32(?,?,0000019C,00438857), ref: 004372F4
GetDlgItem.USER32(?,000000D9), ref: 00437307
IsWindow.USER32(00000000), ref: 00437310
_memset.LIBCMT ref: 0043732E

Part of subcall function 0040CE0A: __EH_prolog3_GS.LIBCMT ref: 0040CE14

GetDeviceCaps.GDI32(?,0000005A), ref: 00437357

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

lstrcpyW.KERNEL32(?,?,MS Sans Serif,?), ref: 004373BE

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

CreateFontIndirectW.GDI32(?), ref: 004373DC
GetSysColor.USER32(0000000F), ref: 00437405
CreateSolidBrush.GDI32(00000000), ref: 0043740C
LoadStringW.USER32(?,0000073E,?,000000A0), ref: 00437456
SaveDC.GDI32(?), ref: 00437469
SelectObject.GDI32(?,00000000), ref: 0043747C
SelectObject.GDI32(?,00000000), ref: 00437489
FillRect.USER32(?,?,00000000), ref: 0043749D
GetWindowRect.USER32(00000000,?), ref: 004374AB
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004374C5
SetBkMode.GDI32(?,00000001), ref: 004374D3
GetSysColor.USER32(00000014), ref: 004374DB
SetTextColor.GDI32(?,00000000), ref: 004374EE
lstrlenW.KERNEL32(?), ref: 004374FD
TextOutW.GDI32(?,?,?,?,00000000), ref: 0043751F
GetSysColor.USER32(00000010), ref: 00437523
SetTextColor.GDI32(?,00000000), ref: 00437530
lstrlenW.KERNEL32(?), ref: 00437539
TextOutW.GDI32(?,?,?,?,00000000), ref: 00437559
RestoreDC.GDI32(?,?), ref: 00437567
EndPaint.USER32(?,?), ref: 00437590

Strings

MS Sans Serif, xrefs: 00437398
x$L, xrefs: 004373C4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Color$ErrorLastText$StringWindow$CreateFreeH_prolog3_ObjectPaintRectSelectlstrlen$BeginBrushCapsDeviceFillFontH_prolog3IndirectItemLoadModePointsRestoreSaveSolid_memsetlstrcpy
String ID: MS Sans Serif$x$L
API String ID: 1449101240-3827839863
Opcode ID: 3a843fb85059e34652070e7b55f1699c17b20c2c99214713dfc2762c3b6e95f6
Instruction ID: b28a094fb6ddfa471c606c21ae7e00b3b3d62a5e51ef5307f5ff4768d5db055c
Opcode Fuzzy Hash: 3a843fb85059e34652070e7b55f1699c17b20c2c99214713dfc2762c3b6e95f6
Instruction Fuzzy Hash: BC710771D01228AFDB219B50CC48FEABBB9FB09305F0040EAF60EA6560DB349E85CF55

Function 004278A5 Relevance: 51.3, APIs: 6, Strings: 23, Instructions: 520
registrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040E537: __EH_prolog3_GS.LIBCMT ref: 0040E53E

Part of subcall function 0040D135: __EH_prolog3_GS.LIBCMT ref: 0040D13F

SendDlgItemMessageW.USER32(000003EB,0000000C,00000000,?), ref: 00427910

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

RegDeleteValueW.ADVAPI32(?,?), ref: 00427AF6
RegDeleteValueW.ADVAPI32(?,?), ref: 00427C15

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 004018C0: RegCloseKey.KERNELBASE(00000000,?,0040E7D6), ref: 004018CA

Strings

Prerequisites rebooting, xrefs: 00428051
($L, xrefs: 00427E8E, 00427E91
($L, xrefs: 0042793D, 00427977, 004279A3, 004279DD, 00427940, 004279A6
Showing initialization dialog for prerequisites., xrefs: 00427E6A
Software\Microsoft\Windows\CurrentVersion, xrefs: 00427A14
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00427F66
($L, xrefs: 0042802C
%%IS_PREREQ%%-%s, xrefs: 00427969
ISSetupPrerequisistes, xrefs: 00427F91
..\..\Shared\Setup\SetupPrereqMgr.cpp, xrefs: 004278B4, 00427B14, 00427E47, 00427FC0, 00428036
%%IS_PREREQF%%-%s, xrefs: 004279CF
($L, xrefs: 00427E76
6, xrefs: 004278BE
x$L, xrefs: 00427963, 0042796E
Running setup prerequisites (%s)..., xrefs: 004278AE
,)L, xrefs: 00427E56
,)L, xrefs: 00428031
Prerequisites returning %d, xrefs: 00427B0E, 00427FBA
Z, xrefs: 00427B1E
,)L, xrefs: 00427E7D
x$L, xrefs: 004279C9, 004279D4
,)L, xrefs: 00427C44
x$L, xrefs: 004278D0, 00427FFD, 004278DB

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$DeleteFreeH_prolog3_StringValue$CloseItemMessageSend
String ID: ISSetupPrerequisistes$%%IS_PREREQ%%-%s$%%IS_PREREQF%%-%s$($L$($L$($L$($L$,)L$,)L$,)L$,)L$..\..\Shared\Setup\SetupPrereqMgr.cpp$6$Prerequisites rebooting$Prerequisites returning %d$Running setup prerequisites (%s)...$Showing initialization dialog for prerequisites.$Software\Microsoft\Windows\CurrentVersion$Software\Microsoft\Windows\CurrentVersion\RunOnce$Z$x$L$x$L$x$L
API String ID: 3343362164-2835322306
Opcode ID: b454c517722caa377c747ceb18a83673a9ba786f28c7dcec31808040eca2fc8b
Instruction ID: df5aa786b663deac107e1b26d251d1929bcf905185ff7d6039cfd4b455d29143
Opcode Fuzzy Hash: b454c517722caa377c747ceb18a83673a9ba786f28c7dcec31808040eca2fc8b
Instruction Fuzzy Hash: 59325F71D04268DFDB11DBA5CD44BEEB7B8AF14304F5440EEE409A3291DBB86A48CF65

Function 0041E006 Relevance: 44.3, APIs: 1, Strings: 24, Instructions: 572
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0041E010

Part of subcall function 0044AC24: __EH_prolog3.LIBCMT ref: 0044AC2B

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0044C877: __EH_prolog3_GS.LIBCMT ref: 0044C881

Part of subcall function 0044CF00: __EH_prolog3_GS.LIBCMT ref: 0044CF0A

Part of subcall function 004090B1: __EH_prolog3_GS.LIBCMT ref: 004090B8

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 0044CE21: __EH_prolog3_GS.LIBCMT ref: 0044CE28

Part of subcall function 0041D96E: __EH_prolog3_GS.LIBCMT ref: 0041D978

Part of subcall function 0040B175: __EH_prolog3_GS.LIBCMT ref: 0040B17C

Strings

x$L, xrefs: 0041E017, 0041E069, 0041E7E7, 0041E0BC, 0041E129, 0041E1BB, 0041E7D3, 0041E225, 0041E26E, 0041E2B7, 0041E307, 0041E34F, 0041E397, 0041E3E0, 0041E44D, 0041E4D2, 0041E557, 0041E5DC, 0041E66C, 0041E6F2, 0041E777, 0041E7D9
SmallProgress, xrefs: 0041E32D
CompanyName, xrefs: 0041E423
AllUsers, xrefs: 0041E2E5
Skin, xrefs: 0041E52D
LogMode, xrefs: 0041E24C
http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d : 0x%x&ErrorInfo=%s, xrefs: 0041E594
ShowPasswordDialog, xrefs: 0041E375
MediaFormat, xrefs: 0041E203
Startup, xrefs: 0041E0AD, 0041E0B2, 0041E11B, 0041E1AD, 0041E21B, 0041E264, 0041E2AD, 0041E301, 0041E345, 0041E38D, 0041E3D6, 0041E43F, 0041E4C4, 0041E549, 0041E5CE, 0041E65A, 0041E6DF, 0041E6E4, 0041E769
ScriptDriven, xrefs: 0041E095
x$L, xrefs: 0041E125, 0041E147, 0041E1B7, 0041E1D9, 0041E773, 0041E7C8, 0041E78E, 0041E79E, 0041E128, 0041E1BA, 0041E776, 0041E791, 0041E7A1
cmdline, xrefs: 0041E74D
SplashTime, xrefs: 0041E295
ErrorReportURL, xrefs: 0041E5B2
InstallGUID, xrefs: 0041E63E
LauncherName, xrefs: 0041E6C3
%, xrefs: 0041E7B7
CompanyURL, xrefs: 0041E4A8
setup.exe, xrefs: 0041E6A5
ProductGUID, xrefs: 0041E18D
CheckMD5, xrefs: 0041E3BE
ProductCode, xrefs: 0041E188, 0041E199
Product, xrefs: 0041E0FF

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_$ErrorLast$FreeH_prolog3String
String ID: %$AllUsers$CheckMD5$CompanyName$CompanyURL$ErrorReportURL$InstallGUID$LauncherName$LogMode$MediaFormat$Product$ProductCode$ProductGUID$ScriptDriven$ShowPasswordDialog$Skin$SmallProgress$SplashTime$Startup$cmdline$http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d : 0x%x&ErrorInfo=%s$setup.exe$x$L$x$L
API String ID: 806320983-785457622
Opcode ID: f911378714b98eb501fe2daf1a73aab02b1fd9a9328f24a92b9a1d30b0a019b1
Instruction ID: 4c12b9727f417418e7039d86e8e8a316bedfbe428eff22572669592076455ac0
Opcode Fuzzy Hash: f911378714b98eb501fe2daf1a73aab02b1fd9a9328f24a92b9a1d30b0a019b1
Instruction Fuzzy Hash: B922C671A01258BEEB04F7A5C852BEDBBB8AF15704F5400DEE904671C2D7B81F48CB96

Function 0042707C Relevance: 37.3, APIs: 1, Strings: 20, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00427086

Part of subcall function 00403FB0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,004AB968,000000FF), ref: 00403FF3
Part of subcall function 00403FB0: SetLastError.KERNEL32(?,004C2254,00000000,?,?,?,?,?,004AB968,000000FF), ref: 00404068

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Part of subcall function 004268CB: __EH_prolog3_GS.LIBCMT ref: 004268D2

Part of subcall function 0040E537: __EH_prolog3_GS.LIBCMT ref: 0040E53E

Part of subcall function 00426F35: __EH_prolog3_GS.LIBCMT ref: 00426F3F

Strings

,)L, xrefs: 00427358
Checking setup prerequisite '%s', xrefs: 00427213
Prerequisite '%s' scheduled before feature selection, xrefs: 00427302
Features match for prerequisite '%s', xrefs: 00427452
,)L, xrefs: 004270EA
x$L, xrefs: 004277FF
Features do not match for prerequisite '%s', xrefs: 00427406
Marking prerequisite '%s' for install during ADMIN install, xrefs: 00427722
x$L, xrefs: 004271D7, 004271F6, 0042757E, 004275E9, 0042763B, 004271DD, 004275EF
($L, xrefs: 00427100, 00427106
x$L, xrefs: 00427832, 00427853, 004275B7, 00427625, 004275BD, 00427838
x$L, xrefs: 004274F4, 004274FA
..\..\Shared\Setup\SetupPrereqMgr.cpp, xrefs: 00427219, 00427308, 004273F1, 0042743D, 00427728, 004277D8
ISSetupPrerequisites, xrefs: 004274CF, 00427592
T"L, xrefs: 004276D6
Skipping prerequisite '%s' because it was installed before the reboot, xrefs: 004277D2
($L, xrefs: 004271EA
x$L, xrefs: 0042725F
,)L, xrefs: 004271CA
,)L, xrefs: 00427685

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_Last$FreeString
String ID: ($L$($L$,)L$,)L$,)L$,)L$..\..\Shared\Setup\SetupPrereqMgr.cpp$Checking setup prerequisite '%s'$Features do not match for prerequisite '%s'$Features match for prerequisite '%s'$ISSetupPrerequisites$Marking prerequisite '%s' for install during ADMIN install$Prerequisite '%s' scheduled before feature selection$Skipping prerequisite '%s' because it was installed before the reboot$T"L$x$L$x$L$x$L$x$L$x$L
API String ID: 529395258-1128752955
Opcode ID: c4138435c2879f9cd32c233d69d9c808204aca44a5052e8d5a3646355f8966d3
Instruction ID: fc2411fa36b7f55c372142dc8cbf8df5691a7afae8e532a25d8468d6b7945177
Opcode Fuzzy Hash: c4138435c2879f9cd32c233d69d9c808204aca44a5052e8d5a3646355f8966d3
Instruction Fuzzy Hash: 8A328D70A01228DEDB24EFA4CC54BDDB7B9AF58304F5041EEE049B3281DB795A98CF65

Function 0041B2F9 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 261
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0041B303
_memmove.LIBCMT ref: 0041B32E

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp), ref: 0041B363
__setjmp3.LIBCMT ref: 0041B384
wsprintfW.USER32 ref: 0041B430

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

_memset.LIBCMT ref: 0041B565
VariantInit.OLEAUT32(?), ref: 0041B57A
_memset.LIBCMT ref: 0041B5AC
VariantInit.OLEAUT32(?), ref: 0041B5BB
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 0041B5D2
VariantClear.OLEAUT32(?), ref: 0041B655
VariantClear.OLEAUT32(?), ref: 0041B65E
_memmove.LIBCMT ref: 0041B692

Part of subcall function 0040A206: __EH_prolog3_GS.LIBCMT ref: 0040A210

Part of subcall function 00445DB8: __EH_prolog3.LIBCMT ref: 00445DBF

Strings

-sel_lang%04x, xrefs: 0041B42A
-internet, xrefs: 0041B4CD, 0041B4D9
setup.cpp, xrefs: 0041B33F
x$L, xrefs: 0041B49B, 0041B4A1
x$L, xrefs: 0041B3F8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLastString$Variant$Free$ClearH_prolog3_Init_memmove_memset$AllocChangeH_prolog3Type__setjmp3_longjmplstrcpywsprintf
String ID: -internet$ -sel_lang%04x$setup.cpp$x$L$x$L
API String ID: 2911063413-1516063923
Opcode ID: 9be0faf8e53ce37496d8e5edc1941ce37ae61d38f6acb4d19677b75ba01f7cb7
Instruction ID: 5b2bf93af48ccca5e56422e242a890ac66f7e44a6b34e9d78f36ceb81ad35b7c
Opcode Fuzzy Hash: 9be0faf8e53ce37496d8e5edc1941ce37ae61d38f6acb4d19677b75ba01f7cb7
Instruction Fuzzy Hash: EFB16F71901218AFDB14EB64CC59FDE77B8AF14304F1040EEB949A7292DB785B88CF65

Function 00494EF0 Relevance: 30.2, APIs: 16, Strings: 1, Instructions: 500
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00494A50: GetLastError.KERNEL32(?,00494F5A,F14A3287), ref: 00494A60
Part of subcall function 00494A50: SetLastError.KERNEL32(?), ref: 00494A90
Part of subcall function 00494A50: GetLastError.KERNEL32 ref: 00494AA4
Part of subcall function 00494A50: SetLastError.KERNEL32(?), ref: 00494AD4

GetLastError.KERNEL32(F14A3287), ref: 00494F75
SetLastError.KERNEL32(004C2480), ref: 00494FC0
GetDlgItem.USER32(?,?), ref: 00494FCC
GetDlgItemTextW.USER32(?,?,00000000,0000030C), ref: 00495065
GetWindowDC.USER32(00000000,0000000C), ref: 00495148
GetDeviceCaps.GDI32(00000000), ref: 0049514F
SetWindowTextW.USER32(?,004C2254), ref: 0049537D
GetWindowRect.USER32(?,?), ref: 00495391
ScreenToClient.USER32(?,?), ref: 004953C9
ScreenToClient.USER32(?,?), ref: 004953D3

Part of subcall function 004857A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,?,?,?,004AA621,000000FF,?,00489525,?,?,00000001), ref: 004857F4
Part of subcall function 004857A0: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,004AA621,000000FF,?,00489525,?,?,00000001), ref: 0048582D

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Part of subcall function 004999D0: GetDC.USER32(?), ref: 004999D9
Part of subcall function 004999D0: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004999EA
Part of subcall function 004999D0: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004999F1
Part of subcall function 004999D0: ReleaseDC.USER32(?,00000000), ref: 004999F9

ShowWindow.USER32(?,00000000,00000004,?,?,?,?,?,00000000), ref: 004954B4
GetWindowLongW.USER32(?,000000F0), ref: 00495520
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00495534
GetWindowLongW.USER32(?,000000EC), ref: 0049553E
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0049554F
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027), ref: 0049555E

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

Part of subcall function 00497040: InvalidateRect.USER32(00000001,00000000,00000001,?,004955CB,?,00004000,00000000,?,?,?,?,00000000), ref: 0049705C

Part of subcall function 00497130: ShowWindow.USER32(00000001,00000005,?,?,?,0049538C,00000000), ref: 00497156
Part of subcall function 00497130: InvalidateRect.USER32(00000001,00000000,00000001,?,0049538C,00000000), ref: 00497168

Strings

P$L, xrefs: 0049503D

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$Window$Long$CapsDeviceRect$ClientFreeInvalidateItemScreenShowStringText$H_prolog3Release
String ID: P$L
API String ID: 2224088311-494869439
Opcode ID: f6a9905f772b190bd5fbcfd347fec8ad2b07fe271623cdd05237516d472768cc
Instruction ID: 4c2968301aab9ff1a71c0645bd30b6c22647da45fa052042b795de8d715e5bb9
Opcode Fuzzy Hash: f6a9905f772b190bd5fbcfd347fec8ad2b07fe271623cdd05237516d472768cc
Instruction Fuzzy Hash: FE129F70D002289FDF25DF65CC51BEEBBB5AF49304F5041AAE50AA7281DB789E84CF54

Function 0041CB40 Relevance: 26.6, APIs: 5, Strings: 10, Instructions: 369
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0041CB4A
_memmove.LIBCMT ref: 0041CC30
lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001), ref: 0041CC6A
__setjmp3.LIBCMT ref: 0041CC8B

Part of subcall function 0040DF24: __EH_prolog3_GS.LIBCMT ref: 0040DF2E

Part of subcall function 00419DCB: __EH_prolog3_GS.LIBCMT ref: 00419DD2

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

_memmove.LIBCMT ref: 0041D063

Strings

Success, xrefs: 0041CF1B
setup.cpp, xrefs: 0041CC41
ISSetupDLLOp, xrefs: 0041CBFC, 0041CF57, 0041D01B
Result=%sError=0x%08lxHeaderPathFile=%sUser=%sPassword=%sProxyUser=%sProxyPassword=%s, xrefs: 0041CFE4
OpenCABBegin, xrefs: 0041CBDE
HeaderPathFile=%sUser=%sPassword=%sProxyUser=%sProxyPassword=%s, xrefs: 0041CBC5
x$L, xrefs: 0041CD01
Result=%sHeaderPathFile=%sUser=%sPassword=%sProxyUser=%sProxyPassword=%s, xrefs: 0041CF20
OpenCABEnd, xrefs: 0041CF39, 0041CFFD
Failure, xrefs: 0041CFDF

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: String$H_prolog3_$ErrorFreeLast_memmove$Alloc__setjmp3_longjmplstrcpy
String ID: Failure$HeaderPathFile=%sUser=%sPassword=%sProxyUser=%sProxyPassword=%s$ISSetupDLLOp$OpenCABBegin$OpenCABEnd$Result=%sError=0x%08lxHeaderPathFile=%sUser=%sPassword=%sProxyUser=%sProxyPassword=%s$Result=%sHeaderPathFile=%sUser=%sPassword=%sProxyUser=%sProxyPassword=%s$Success$setup.cpp$x$L
API String ID: 4289572177-2396563956
Opcode ID: db43f7a537eab132ede5627c5557b86870e787b4deee5f4dbffef95e43ea30ae
Instruction ID: 1e650034ec0660c7e071cd926afd62a612174563a786a4906b1857fe962ce2ec
Opcode Fuzzy Hash: db43f7a537eab132ede5627c5557b86870e787b4deee5f4dbffef95e43ea30ae
Instruction Fuzzy Hash: 59F140709012189FDB14DF64C999BDAB7B9AF45304F1000EEF50AA7292DB78AF84CF55

Function 00418B6C Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 229
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00418B76
_memmove.LIBCMT ref: 00418B9B

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,?,?,00000000), ref: 00418BD0
__setjmp3.LIBCMT ref: 00418BF1
_memmove.LIBCMT ref: 00418E5A

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00417B68: __EH_prolog3.LIBCMT ref: 00417B6F

Strings

x$L, xrefs: 00418C7A
Success, xrefs: 00418DF9
Result=%sError=0x%08lxCopied=%ldSourceFile=%sTargetFile=%s, xrefs: 00418D8F
CopyDisk1FileToTempBegin, xrefs: 00418C36
setup.cpp, xrefs: 00418BAC
ISSetupDLLOp, xrefs: 00418C53, 00418DC4, 00418E33
SourceFile=%sTargetFile=%s, xrefs: 00418C1B
CopyDisk1FileToTempEnd, xrefs: 00418DA7, 00418E16
Result=%sCopied=%ldSourceFile=%sTargetFile=%s, xrefs: 00418DFE
Failure, xrefs: 00418D8A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeH_prolog3String_memmove$H_prolog3___setjmp3lstrcpy
String ID: CopyDisk1FileToTempBegin$CopyDisk1FileToTempEnd$Failure$ISSetupDLLOp$Result=%sError=0x%08lxCopied=%ldSourceFile=%sTargetFile=%s$Result=%sCopied=%ldSourceFile=%sTargetFile=%s$SourceFile=%sTargetFile=%s$Success$setup.cpp$x$L
API String ID: 720208508-4293196980
Opcode ID: a7d45844fd4c7cef8335c806a57da6bb44fce0ec1ae2790475e7d638928f31fe
Instruction ID: e21d65f2f368b583cf1c6f8210351bef037dc570a18d1d5476066217d1743dc9
Opcode Fuzzy Hash: a7d45844fd4c7cef8335c806a57da6bb44fce0ec1ae2790475e7d638928f31fe
Instruction Fuzzy Hash: F091B4B1900218EBDB10EF55CC46BDE77B8AF15704F5041AFFD09A7141DB789A48CBA6

Function 00498C60 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32(?,?), ref: 00498C8C
MulDiv.KERNEL32(?,?,000186A0), ref: 00498CB2
MulDiv.KERNEL32(?,?,000186A0), ref: 00498CC8
MulDiv.KERNEL32(?,?,000186A0), ref: 00498E64
MulDiv.KERNEL32(?,?,000186A0), ref: 00498E74
GdipCreateFromHDC.GDIPLUS($mI,00000000,?,?,?,?,49564068,?,49564068,?,?,?,?,00496D24,?), ref: 00498EE8
GdipSetInterpolationMode.GDIPLUS(00000000,00000007,$mI,00000000,?,?,?,?,49564068,?,49564068,?,?,?,?,00496D24), ref: 00498EF6
GdipDrawImageRectI.GDIPLUS(?,00000000,?,004961BC,?,?,00000000,00000007,$mI,00000000,?,?,?,?,49564068,?), ref: 00498F13
GdipDeleteGraphics.GDIPLUS(?,?,00000000,?,004961BC,?,?,00000000,00000007,$mI,00000000,?,?,?,?,49564068), ref: 00498F19

Strings

$mI, xrefs: 00498EDE

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Gdip$Rect$ClientCreateDeleteDrawFromGraphicsImageInterpolationMode
String ID: $mI
API String ID: 2842912273-525786096
Opcode ID: 3376863ea6de6a812ac9062d22c4b5b8773f21692af3ca7a83de3d74edbc91b3
Instruction ID: b638af417172fd60af6a86351405979bb364208603e65c17ce1c02fcc04bc9b0
Opcode Fuzzy Hash: 3376863ea6de6a812ac9062d22c4b5b8773f21692af3ca7a83de3d74edbc91b3
Instruction Fuzzy Hash: 3FA1F4719002199FDF04CFA9C984AEEBFF5BF48300F14816AE905B7255DB79AD41CBA8

Function 0041C027 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 294
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0041C031
_memmove.LIBCMT ref: 0041C05C

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,?,?,0000028C), ref: 0041C091
__setjmp3.LIBCMT ref: 0041C0B2

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

Part of subcall function 00418520: __EH_prolog3_GS.LIBCMT ref: 0041852A
Part of subcall function 00418520: _memmove.LIBCMT ref: 0041855B
Part of subcall function 00418520: lstrcpyW.KERNEL32(?,-00000004,setup.cpp), ref: 00418590
Part of subcall function 00418520: __setjmp3.LIBCMT ref: 004185B1

Part of subcall function 00419B6E: __EH_prolog3_GS.LIBCMT ref: 00419B78
Part of subcall function 00419B6E: _memset.LIBCMT ref: 00419BC7
Part of subcall function 00419B6E: _memmove.LIBCMT ref: 00419BDF
Part of subcall function 00419B6E: lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001), ref: 00419C14
Part of subcall function 00419B6E: __setjmp3.LIBCMT ref: 00419C35
Part of subcall function 00419B6E: _wcschr.LIBCMT ref: 00419C50
Part of subcall function 00419B6E: VariantClear.OLEAUT32(?), ref: 00419CB3
Part of subcall function 00419B6E: _memmove.LIBCMT ref: 00419D91

Part of subcall function 0041F407: __EH_prolog3_GS.LIBCMT ref: 0041F411

GetDlgItem.USER32(?,00000009), ref: 0041C2D0
KiUserCallbackDispatcher.NTDLL(00000000), ref: 0041C2D9
GetDlgItem.USER32(?,00000002), ref: 0041C2E5
EnableWindow.USER32(00000000), ref: 0041C2E8
_memmove.LIBCMT ref: 0041C37D

Strings

<Support>, xrefs: 0041C1AD
setup.cpp, xrefs: 0041C06D
<Support>\Engine\Log, xrefs: 0041C214

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _memmove$ErrorH_prolog3_Last$__setjmp3lstrcpy$FreeItemString$CallbackClearDispatcherEnableUserVariantWindow_longjmp_memset_wcschr
String ID: <Support>$<Support>\Engine\Log$setup.cpp
API String ID: 3266484166-2693976720
Opcode ID: 3d90f2a052ef25351395cdc6d7a7833073024e385deadb6bc8300413a770c60d
Instruction ID: 4c1eb843f2d77881d58fb927745135f1c41294f846ada375940f7b9ce799e351
Opcode Fuzzy Hash: 3d90f2a052ef25351395cdc6d7a7833073024e385deadb6bc8300413a770c60d
Instruction Fuzzy Hash: 68A1A270640214AFDB54EFB4CC89FAE77A9AF48314F1045ADB54AEF2C2CE789944CB64

Function 0042043A Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 330
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,?,x$L,00000000), ref: 00420441

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

__setjmp3.LIBCMT ref: 00420462

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

Part of subcall function 00415FFA: __EH_prolog3.LIBCMT ref: 00416001

Part of subcall function 0045BD01: std::exception::exception.LIBCMT ref: 0045BD35
Part of subcall function 0045BD01: __CxxThrowException@8.LIBCMT ref: 0045BD4A

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0041D1C4: __EH_prolog3_GS.LIBCMT ref: 0041D1CE

_memmove.LIBCMT ref: 00420F69

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00418B6C: __EH_prolog3_GS.LIBCMT ref: 00418B76
Part of subcall function 00418B6C: _memmove.LIBCMT ref: 00418B9B
Part of subcall function 00418B6C: lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,?,?,00000000), ref: 00418BD0
Part of subcall function 00418B6C: __setjmp3.LIBCMT ref: 00418BF1

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

Sleep.KERNELBASE(?), ref: 00420556

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00443B60: __EH_prolog3_GS.LIBCMT ref: 00443B6A
Part of subcall function 00443B60: GetTempPathW.KERNEL32(00000104,00000000,?,00000104), ref: 00443BAD

Part of subcall function 00421B9B: __EH_prolog3.LIBCMT ref: 00421BA2

Part of subcall function 00417BDF: __EH_prolog3.LIBCMT ref: 00417BE6

Strings

x$L, xrefs: 004206B2, 004206B8
x$L, xrefs: 0042072A, 00420730
setup.ini, xrefs: 00420675, 004206ED
x$L, xrefs: 004204F6
x$L, xrefs: 00420A47
x$L, xrefs: 004207E1
T"L, xrefs: 004205A6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3$FreeH_prolog3_String$__setjmp3_memmovelstrcpy$Exception@8PathSleepTempThrow_longjmp_mallocstd::exception::exception
String ID: T"L$setup.ini$x$L$x$L$x$L$x$L$x$L
API String ID: 88630433-307473992
Opcode ID: 370dbc5cd7ce32de95d557133dea263f7f1271f2a6c2227a47d2a4360db62f1e
Instruction ID: eedf0a5705cefcea18538c8a8f68f6481e69e663c9240c7ea22fb50e3001bada
Opcode Fuzzy Hash: 370dbc5cd7ce32de95d557133dea263f7f1271f2a6c2227a47d2a4360db62f1e
Instruction Fuzzy Hash: F6D107B0A00214DFDB15EB74C945BEDBBF8AF08304F14409EF509A7292DBB89B48CB59

Function 00409334 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 179sleepfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040933B
DeleteFileW.KERNELBASE(00000005), ref: 00409425
Sleep.KERNELBASE(00000064), ref: 00409439
RemoveDirectoryW.KERNELBASE(?), ref: 00409523
Sleep.KERNEL32(00000064), ref: 00409537

Strings

DeleterDeleteFolder, xrefs: 004094AA
ISSetupDLLOp, xrefs: 004093C8, 004094C3
DeleterDeleteFile, xrefs: 004093AF
x$L, xrefs: 0040947D
File=%s, xrefs: 0040937A
Folder=%s, xrefs: 00409475

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Sleep$DeleteDirectoryFileH_prolog3_Remove
String ID: DeleterDeleteFile$DeleterDeleteFolder$File=%s$Folder=%s$ISSetupDLLOp$x$L
API String ID: 3597207528-2830519553
Opcode ID: 85c995950e38ca86cd1ca10aefaf7875dd4f5d4432637b5fc4fb0a384e1c5446
Instruction ID: 6e654eaf39eb605b0143a1dc24f1961f179affdcdb7920af66975d4d03ba9b3f
Opcode Fuzzy Hash: 85c995950e38ca86cd1ca10aefaf7875dd4f5d4432637b5fc4fb0a384e1c5446
Instruction Fuzzy Hash: B761FC71E04204EFEF04EFA5C945BADBB75AB01704F54402EE9117B1C2C7B89D4AC7AA

Function 00495C70 Relevance: 18.3, APIs: 12, Instructions: 276COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000001), ref: 00495CC1
DestroyWindow.USER32(00000001,?,?,00000000,004AB4DB,000000FF,?,00495377,?,?,00000002,?,?,00000000,00000001), ref: 00495CCE
IsWindow.USER32(?), ref: 00495CF0
CreateWindowExW.USER32(00000020,00000000,40000000,00000000,00000000,00000000,00000000,?,00000000,?), ref: 00495D62
IsWindow.USER32(00000000), ref: 00495D6C
GetWindow.USER32(?,00000003), ref: 00495D90
SetWindowPos.USER32(00000000,?,00000000,00000000,00000000,00000000,00000003), ref: 00495DB3
MulDiv.KERNEL32(00000000,00000000,00000064), ref: 00495ECA
MulDiv.KERNEL32(00000000,00000000,?), ref: 00495F16
MulDiv.KERNEL32(00000000,00000000,?), ref: 00495F39
MoveWindow.USER32(00000000,?,?,00000000,?,00000000,00000000,00000000,?,?,00000000), ref: 00495F88
ShowWindow.USER32(00000000,00000000), ref: 00495F93

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window$CreateDestroyMoveShow
String ID:
API String ID: 3486018820-0
Opcode ID: d77496c4f38ca2ca3b2b78326e2417a42d9fd5cbc69733cec7ec1d29a1a62e3b
Instruction ID: 70455e87845ba3434f907378c216a3188fac9b03cad2c475fee734dc50eb4013
Opcode Fuzzy Hash: d77496c4f38ca2ca3b2b78326e2417a42d9fd5cbc69733cec7ec1d29a1a62e3b
Instruction Fuzzy Hash: 29B16E71A00604AFDF11DF65C885BAABFB5EF48314F24816AFD05AB395D739D801CBA8

Function 00437CCF Relevance: 18.2, APIs: 12, Instructions: 231COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00437CD6

Part of subcall function 00437B89: __EH_prolog3_GS.LIBCMT ref: 00437B93
Part of subcall function 00437B89: SendDlgItemMessageW.USER32(?,00000034,00000031,00000000,00000000), ref: 00437BDF
Part of subcall function 00437B89: GetObjectW.GDI32(00000000,0000005C,?), ref: 00437BEF
Part of subcall function 00437B89: lstrcpyW.KERNEL32(?,?), ref: 00437C1B
Part of subcall function 00437B89: CreateFontIndirectW.GDI32(?), ref: 00437C28
Part of subcall function 00437B89: SendDlgItemMessageW.USER32(?,00000034,00000030,?,00000001), ref: 00437C5E
Part of subcall function 00437B89: SetDlgItemTextW.USER32(?,0000000C,-00000004), ref: 00437C93
Part of subcall function 00437B89: GetDlgItem.USER32(?,0000000C), ref: 00437CA6
Part of subcall function 00437B89: KiUserCallbackDispatcher.NTDLL(00000000,?), ref: 00437CB8

SetDlgItemTextW.USER32(?,000003F0,-00000004), ref: 00437D56
SetDlgItemTextW.USER32(000000FF,00000001,-00000004), ref: 00437D9A
SetDlgItemTextW.USER32(000000FF,00000009,-00000004), ref: 00437DD2
SetDlgItemTextW.USER32(000000FF,00000034,-00000004), ref: 00437E0A
SetDlgItemTextW.USER32(000000FF,00000033,-00000004), ref: 00437E42

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

GetDlgItem.USER32(000000FF,00000009), ref: 00437E59
KiUserCallbackDispatcher.NTDLL(00000000), ref: 00437E62
GetDlgItem.USER32(000000FF,00000002), ref: 00437E6B
KiUserCallbackDispatcher.NTDLL(00000000), ref: 00437E6E

Part of subcall function 0040D135: __EH_prolog3_GS.LIBCMT ref: 0040D13F

SetDlgItemTextW.USER32(000000FF,00000135,-00000004), ref: 00437EBC
SetDlgItemTextW.USER32(000000FF,00000133,-00000004), ref: 00437EF8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Item$Text$CallbackDispatcherH_prolog3_User$ErrorFreeLastMessageSendString$CreateFontIndirectObjectlstrcpy
String ID:
API String ID: 3736395388-0
Opcode ID: 133148b7c70d9f1d9fc2d98db35188da56571e87e8cb54f60142d35ddb1674ef
Instruction ID: 71f87952f88b4f9588d01d2db10271c0e18a31b028cec3ba3a553a98079a0329
Opcode Fuzzy Hash: 133148b7c70d9f1d9fc2d98db35188da56571e87e8cb54f60142d35ddb1674ef
Instruction Fuzzy Hash: DA911871A00114DFDB04EFA4CD95E59BBB5FF49714B1480AAE90AAF2A2DB34ED04CF54

Function 02FA0465 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 166memorywindowCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,AD10001F,00001000,00000040,02FA1018), ref: 02FA04E6
wsprintfA.USER32 ref: 02FA056F
wsprintfA.USER32 ref: 02FA058E
MessageBoxA.USER32(00000000,Application corrupt.,Application error,00000010), ref: 02FA05A6
VirtualFree.KERNELBASE(?,00000000,00008000,ED815D00,SWVU), ref: 02FA0601

Strings

The ordinal %d could not be located in the DLL %s., xrefs: 02FA0567
SWVU, xrefs: 02FA04F2, 02FA0506, 02FA050C, 02FA0512, 02FA052F, 02FA05E2
Application corrupt., xrefs: 02FA05A3
The procedure %s could not be located in the DLL %s., xrefs: 02FA0586
Application error, xrefs: 02FA05A2

Memory Dump Source

Source File: 00000002.00000002.2434642107.0000000002FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2fa0000_LocalPlayback.jbxd

Similarity

API ID: Virtualwsprintf$AllocFreeMessage
String ID: Application corrupt.$Application error$SWVU$The ordinal %d could not be located in the DLL %s.$The procedure %s could not be located in the DLL %s.
API String ID: 1346430377-1115488593
Opcode ID: 22ef1fd551dc6c3b2919d3b5adb39fa6bb9bc7ff25bb61fa3d5ac6dc1591761b
Instruction ID: 0e9d4671178c9e583879f42bf47f4767f882615b2b634561d6c8717470e78aa9
Opcode Fuzzy Hash: 22ef1fd551dc6c3b2919d3b5adb39fa6bb9bc7ff25bb61fa3d5ac6dc1591761b
Instruction Fuzzy Hash: 7B418BB26017569FDB389F64DC54BEB73A9AF49381F00012DEE0697244DF70A914CA90

Function 00418520 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 260stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041852A
_memmove.LIBCMT ref: 0041855B

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp), ref: 00418590
__setjmp3.LIBCMT ref: 004185B1

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

SysFreeString.OLEAUT32(?), ref: 00418763
_memmove.LIBCMT ref: 004188B8

Strings

setup.cpp, xrefs: 0041856C
SUPPORTDIR, xrefs: 0041871E
x$L, xrefs: 004186A2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: String$ErrorLast$Free$_memmove$AllocH_prolog3___setjmp3_longjmplstrcpy
String ID: SUPPORTDIR$setup.cpp$x$L
API String ID: 4158757861-1951754081
Opcode ID: 3f7b08dea0cd20b2d5a926c8dac412645ca3c728e663993036471fa96647451a
Instruction ID: 27d0880690181cbae3e75593f33f73ab5c28411cdb382f37bbdd498e90e59d7b
Opcode Fuzzy Hash: 3f7b08dea0cd20b2d5a926c8dac412645ca3c728e663993036471fa96647451a
Instruction Fuzzy Hash: 10B16A70A002189FCB14DFA5CD85BDDB7B8AF49304F1440EEE509AB281DB78AE85CF55

Function 00443B60 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 219fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,_is,00000000,00000000,?,00000104), ref: 00443CCB
GetTempPathW.KERNEL32(00000104,00000000,?,00000104), ref: 00443BAD

Part of subcall function 00409574: __EH_prolog3_GS.LIBCMT ref: 0040957B
Part of subcall function 00409574: GetLastError.KERNEL32(00000038,0040DCC8,004480DB,?,004AEF80), ref: 00409582
Part of subcall function 00409574: SetLastError.KERNEL32(00000000), ref: 004095D6

__EH_prolog3_GS.LIBCMT ref: 00443B6A

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

DeleteFileW.KERNEL32(?), ref: 00443CF0

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00445DB8: __EH_prolog3.LIBCMT ref: 00445DBF

Strings

x$L, xrefs: 00443C56
T"L, xrefs: 00443D23, 00443D64
x$L, xrefs: 00443E7A, 00443C49
.tmp, xrefs: 00443D1E
_is, xrefs: 00443CC5

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FileH_prolog3H_prolog3_StringTemp$AllocDeleteNamePath
String ID: .tmp$T"L$_is$x$L$x$L
API String ID: 1310056418-1835873192
Opcode ID: d369eb608bc918f6fc081732f56f6013bf4dd029a764597e20ca3623053f22cc
Instruction ID: 833f9a1a541f15dad907032c71266c50fb585a5318968c4c2685a56bdb55f4be
Opcode Fuzzy Hash: d369eb608bc918f6fc081732f56f6013bf4dd029a764597e20ca3623053f22cc
Instruction Fuzzy Hash: D891AD70900208EEDB05EFA1CD51BDDB7B8AF14708F5040AEE54977192EBB85B49CB6A

Function 00426F35 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00426F3F

Part of subcall function 00403FB0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,004AB968,000000FF), ref: 00403FF3
Part of subcall function 00403FB0: SetLastError.KERNEL32(?,004C2254,00000000,?,?,?,?,?,004AB968,000000FF), ref: 00404068

Part of subcall function 004158C6: __EH_prolog3_GS.LIBCMT ref: 004158CD
Part of subcall function 004158C6: __ltow_s.LIBCMT ref: 00415905
Part of subcall function 004158C6: SetLastError.KERNEL32(00000000,?,00000000,00000001), ref: 00415934

Part of subcall function 0040E10B: __EH_prolog3_GS.LIBCMT ref: 0040E112

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Strings

ISSetupPrerequisites, xrefs: 00426F84
PreReq, xrefs: 00426FBA
($L, xrefs: 00426FD3, 00426FD6
,)L, xrefs: 00426F93
,)L, xrefs: 00426F6B
($L, xrefs: 00426FCE, 00426FD1
($L, xrefs: 00426FA4, 00426FEC
x$L, xrefs: 00426FB4, 00426FE1, 00426FBF

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$FreeString$__ltow_s
String ID: ($L$($L$($L$,)L$,)L$ISSetupPrerequisites$PreReq$x$L
API String ID: 3540359163-3455357133
Opcode ID: 515562ddc03635793d003dae8777af3ffcf4b926fb0726a5f4cc95baefd66a34
Instruction ID: 23c89d779ce068e4e89d41d3d02ace008b52752b5c8579a9afa3aecba4902cfe
Opcode Fuzzy Hash: 515562ddc03635793d003dae8777af3ffcf4b926fb0726a5f4cc95baefd66a34
Instruction Fuzzy Hash: 25215B74A10219EADB14EB91CC46FEDB778BF50308F5440AEF50577182DBF82A48CB69

Function 00440C28 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00440C2F
GetModuleHandleW.KERNEL32(kernel32.dll,CreateDirectoryW,00000000,004417C4), ref: 00440C4C
GetProcAddress.KERNEL32(00000000), ref: 00440C4F
CreateDirectoryW.KERNELBASE(004C2418,00000001), ref: 00440C66
GetModuleHandleW.KERNEL32(kernel32.dll,CreateDirectoryA), ref: 00440C74
GetProcAddress.KERNEL32(00000000), ref: 00440C77

Strings

CreateDirectoryW, xrefs: 00440C3D
CreateDirectoryA, xrefs: 00440C6A
kernel32.dll, xrefs: 00440C44, 00440C6F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc$CreateDirectoryH_prolog3
String ID: CreateDirectoryA$CreateDirectoryW$kernel32.dll
API String ID: 662308948-2917578371
Opcode ID: 2b9eafaaed50f75673a574383d646cc2a7271a5dbfc5029f3bf643a2a884a312
Instruction ID: 30be10df2a2a17bef37c00c90a8dbd2362a844a583c77c3d9be97c5e02d8af70
Opcode Fuzzy Hash: 2b9eafaaed50f75673a574383d646cc2a7271a5dbfc5029f3bf643a2a884a312
Instruction Fuzzy Hash: 86F0C230600305ABDF14AFB5CC99EDE3B64EF94B41B50412ABD0697141CBBCDA45C7AD

Function 00442895 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044289C
GetModuleHandleW.KERNEL32(kernel32.dll,GetFileAttributesW,00000000,00440FDA,?,?,?,?,?,?,?,?,?,?,?,004097FA), ref: 004428B6
GetProcAddress.KERNEL32(00000000), ref: 004428B9
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,004097FA), ref: 004428CF
GetModuleHandleW.KERNEL32(kernel32.dll,GetFileAttributesA,?,?,?,?,?,?,?,?,?,?,?,004097FA), ref: 004428DD
GetProcAddress.KERNEL32(00000000), ref: 004428E0

Strings

GetFileAttributesA, xrefs: 004428D3
GetFileAttributesW, xrefs: 004428A7
kernel32.dll, xrefs: 004428AE, 004428D8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc$AttributesFileH_prolog3
String ID: GetFileAttributesA$GetFileAttributesW$kernel32.dll
API String ID: 3512441749-1399581607
Opcode ID: 94ea25b43a5a1738c58a9484c86328c86eec96e7da37430c2db8191c0c626bcd
Instruction ID: c3a55c7c3dc604c7fa4a4a9b5cbed64bb300b6e344a85f2e6c85056feb2d120d
Opcode Fuzzy Hash: 94ea25b43a5a1738c58a9484c86328c86eec96e7da37430c2db8191c0c626bcd
Instruction Fuzzy Hash: B3F0CD30600304A7CB10BFB58C19ACE3B64AF90B81B52422AF81697190DFBCDA45CBAD

Function 00420A76 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 274COMMON

Download Yara Rule

APIs

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00421A83: __EH_prolog3.LIBCMT ref: 00421A8A

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 004090B1: __EH_prolog3_GS.LIBCMT ref: 004090B8

Part of subcall function 00418B6C: __EH_prolog3_GS.LIBCMT ref: 00418B76
Part of subcall function 00418B6C: _memmove.LIBCMT ref: 00418B9B
Part of subcall function 00418B6C: lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,?,?,00000000), ref: 00418BD0
Part of subcall function 00418B6C: __setjmp3.LIBCMT ref: 00418BF1

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

Part of subcall function 0041C6CC: LoadLibraryW.KERNELBASE(-00000004), ref: 0041C6FF

_memmove.LIBCMT ref: 00420F69

Strings

x$L, xrefs: 00420BCB
ISSetup.dll, xrefs: 00420A8F, 00420A94, 00420B1F, 00420B24, 00420BC4
(, xrefs: 00420D36
x$L, xrefs: 00420B68, 00420B6E
x$L, xrefs: 00420A9B
+, xrefs: 00420E21
ISSetup.dll, xrefs: 00420C91, 00420C96, 00420CAB

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$FreeH_prolog3String_memmove$LibraryLoad__setjmp3_longjmplstrcpy
String ID: ($+$ISSetup.dll$ISSetup.dll$x$L$x$L$x$L
API String ID: 3868212671-1014054209
Opcode ID: 7a84faf14098ba08cb115adf7cea7aa374700ac9499826f8e8ca2b7235f906cb
Instruction ID: 1166e4fdb418232106e0cefe55c710eb31a1024856114c3002f0b557c0094fa1
Opcode Fuzzy Hash: 7a84faf14098ba08cb115adf7cea7aa374700ac9499826f8e8ca2b7235f906cb
Instruction Fuzzy Hash: C2B19270A001589FDB15EBA4C955BEDB7B9AF58304F0040EEE50AA3292DB785F48CF69

Function 021A04B9 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 151memorywindowCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,021A04A7), ref: 021A053A
wsprintfA.USER32(?,?,?,?), ref: 021A05E2
MessageBoxA.USER32(00000000,?,?,00000010), ref: 021A05FA
ExitProcess.KERNEL32(00000000), ref: 021A0602
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 021A0655

Strings

SWVU, xrefs: 021A0546, 021A055A, 021A0560, 021A0566, 021A0583, 021A0636
Application error, xrefs: 021A05F6
The procedure %s could not be located in the DLL %s., xrefs: 021A05DA

Memory Dump Source

Source File: 00000002.00000002.2433062040.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21a0000_LocalPlayback.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: a271772efd77f06a8368999d3bae3bc7c82b62b734d4ef5725e48f6317a0e488
Instruction ID: 07c6f4d3aef3bffa54e2dd9594a3d8d167858d07b1b504568dd7d0b06210f24a
Opcode Fuzzy Hash: a271772efd77f06a8368999d3bae3bc7c82b62b734d4ef5725e48f6317a0e488
Instruction Fuzzy Hash: 92411E3A6417569FDB38DF24CCA4BEF73A5EF49341F040129EE06A7648DB70AA14CB90

Function 021A0500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 137memorywindowCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,021A04A7), ref: 021A053A
wsprintfA.USER32(?,?,?,?), ref: 021A05E2
MessageBoxA.USER32(00000000,?,?,00000010), ref: 021A05FA
ExitProcess.KERNEL32(00000000), ref: 021A0602
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 021A0655

Strings

SWVU, xrefs: 021A0546, 021A055A, 021A0560, 021A0566, 021A0583, 021A0636
Application error, xrefs: 021A05F6
The procedure %s could not be located in the DLL %s., xrefs: 021A05DA

Memory Dump Source

Source File: 00000002.00000002.2433062040.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21a0000_LocalPlayback.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: 667105c0974d4bc0589c83399c7795be495e0b2321cdd994295189acea90bd0c
Instruction ID: 0debca9ba9f7ab9cc873d066724ff2a2eed5294d957102f926779e10c109b05a
Opcode Fuzzy Hash: 667105c0974d4bc0589c83399c7795be495e0b2321cdd994295189acea90bd0c
Instruction Fuzzy Hash: 5831A97A68238AAFDB38DF20CC64BEF3369AF49355F000129ED4692244DB70A910CB54

Function 02FA0420 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 129memorywindowCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,AD10001F,00001000,00000040,02FA1018), ref: 02FA04E6
wsprintfA.USER32 ref: 02FA056F
wsprintfA.USER32 ref: 02FA058E
MessageBoxA.USER32(00000000,Application corrupt.,Application error,00000010), ref: 02FA05A6
VirtualFree.KERNELBASE(?,00000000,00008000,ED815D00,SWVU), ref: 02FA0601

Strings

SWVU, xrefs: 02FA04F2, 02FA0506, 02FA050C, 02FA0512, 02FA052F, 02FA05E2
Application corrupt., xrefs: 02FA05A3
The procedure %s could not be located in the DLL %s., xrefs: 02FA0586
Application error, xrefs: 02FA05A2

Memory Dump Source

Source File: 00000002.00000002.2434642107.0000000002FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2fa0000_LocalPlayback.jbxd

Similarity

API ID: Virtualwsprintf$AllocFreeMessage
String ID: Application corrupt.$Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 1346430377-1641038318
Opcode ID: 2100d5aa29f804061757fa6e901f240bba92db13dad565a1cea9ee404602774a
Instruction ID: 6dd81969329138bcb57a7ac88e7c893889213842a191f85c106cb32f7f8cc3c3
Opcode Fuzzy Hash: 2100d5aa29f804061757fa6e901f240bba92db13dad565a1cea9ee404602774a
Instruction Fuzzy Hash: C3317CB16023869FDB39EF60DC60BEA7769AF46381F00011DEE0296284DF70A911CB65

Function 00438753 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

GetPropW.USER32(?,This), ref: 00438762
GetWindowLongW.USER32(?,000000F4), ref: 004387A4
GetSysColor.USER32(00000005), ref: 004387C5
SetBkColor.GDI32(?,00000000), ref: 004387CF
SetPropW.USER32(?,This,?), ref: 00438841
RemovePropW.USER32(?,This), ref: 00438866
DefWindowProcW.USER32(?,?,?,?), ref: 00438878

Strings

This, xrefs: 0043875C, 00438838, 00438860

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Prop$ColorWindow$LongProcRemove
String ID: This
API String ID: 1744480154-1591487769
Opcode ID: 69d13554acb8ad9c014cd46475c0cac7f205d0ec8511e9a85fdbd2b8cae65c4d
Instruction ID: 1061c4875d93f5152ee9021c47eebcfc1033e4987a476b9c32c32d3dbe44bf7c
Opcode Fuzzy Hash: 69d13554acb8ad9c014cd46475c0cac7f205d0ec8511e9a85fdbd2b8cae65c4d
Instruction Fuzzy Hash: 7A315D35600600ABCB2C6F699C48A6ABBB9FF5D751F50141EF543C76A1CF28EC018A59

Function 00438AD1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetPropW.USER32(?,This), ref: 00438AE1
EnableMenuItem.USER32(?,0000F030,00000003), ref: 00438B1B
EnableMenuItem.USER32(?,0000F000,00000003), ref: 00438B27
IsWindow.USER32(?), ref: 00438B50
SendMessageW.USER32(?,00000111,00000002,00000000), ref: 00438B6C
SetPropW.USER32(?,This,?), ref: 00438B7F
RemovePropW.USER32(?,This), ref: 00438B90

Strings

This, xrefs: 00438ADA, 00438ADF, 00438B7B, 00438B8E

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Prop$EnableItemMenu$MessageRemoveSendWindow
String ID: This
API String ID: 2617454859-1591487769
Opcode ID: 0801e4399b51e9d344d8596fe1d0fe9d52105834f9557a1fd2422110f9ffed8e
Instruction ID: de06d8e172cf78d113cb21d8c5b2c555505dbf1206fb7bf63769a9def03afb71
Opcode Fuzzy Hash: 0801e4399b51e9d344d8596fe1d0fe9d52105834f9557a1fd2422110f9ffed8e
Instruction Fuzzy Hash: 4D21A27160030ABBDB205F24DC49FABFBA8EF4D754F44442AF642AB2A1DF74AD019758

Function 00440CA1 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 51libraryloaderfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileW,?,00000000,?,00423EEB,?,?,?,?,?,?,?,?,00000000,004411B3), ref: 00440CB7
GetProcAddress.KERNEL32(00000000), ref: 00440CBA
CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,?,00423EEB,?,?,?,?,?), ref: 00440CE5
GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileA,?,00000000,?,00423EEB,?,?,?,?,?,?,?,?,00000000,004411B3), ref: 00440CEF
GetProcAddress.KERNEL32(00000000), ref: 00440CF2

Strings

CreateFileA, xrefs: 00440CE9
kernel32.dll, xrefs: 00440CB1, 00440CB6, 00440CEE
CreateFileW, xrefs: 00440CAC

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc$CreateFile
String ID: CreateFileA$CreateFileW$kernel32.dll
API String ID: 2362759813-3217398002
Opcode ID: a9ab97f4c088b2956ce3945d34d8f1a28bd8979e600688ec6587ca947c1cb7fd
Instruction ID: 6c8c4c24e015213f1fb16b5a287b4fae0f1dc822ed889af60b667329fc2653aa
Opcode Fuzzy Hash: a9ab97f4c088b2956ce3945d34d8f1a28bd8979e600688ec6587ca947c1cb7fd
Instruction Fuzzy Hash: 1C016972800209BBDF015FE0DC84DEE3F2AFF08355B14011AFA2656161CA3AD830EBA8

Function 00437B89 Relevance: 13.6, APIs: 9, Instructions: 102windowstringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00437B93
SendDlgItemMessageW.USER32(?,00000034,00000031,00000000,00000000), ref: 00437BDF
GetObjectW.GDI32(00000000,0000005C,?), ref: 00437BEF
lstrcpyW.KERNEL32(?,?), ref: 00437C1B
CreateFontIndirectW.GDI32(?), ref: 00437C28
SendDlgItemMessageW.USER32(?,00000034,00000030,?,00000001), ref: 00437C5E
SetDlgItemTextW.USER32(?,0000000C,-00000004), ref: 00437C93
GetDlgItem.USER32(?,0000000C), ref: 00437CA6
KiUserCallbackDispatcher.NTDLL(00000000,?), ref: 00437CB8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Item$MessageSend$CallbackCreateDispatcherFontH_prolog3_IndirectObjectTextUserlstrcpy
String ID:
API String ID: 3214481252-0
Opcode ID: 7b33a54aa8a1b358d1223aad0cb83082d22e0e09133a51a54157c1de56fc4fbf
Instruction ID: 9c3a0029321aa50590740cbfb8839f99292f581c2ca71ccd4b3c909c8d79cdba
Opcode Fuzzy Hash: 7b33a54aa8a1b358d1223aad0cb83082d22e0e09133a51a54157c1de56fc4fbf
Instruction Fuzzy Hash: 67412E71900604EFDB24EBA4CD89E9ABBB8FF09309F00446EF656D75A2DB74A905CF14

Function 0040D135 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040D13F

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040B0F8: __EH_prolog3_GS.LIBCMT ref: 0040B0FF

Part of subcall function 0040A206: __EH_prolog3_GS.LIBCMT ref: 0040A210

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 0044AC24: __EH_prolog3.LIBCMT ref: 0044AC2B

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0044C877: __EH_prolog3_GS.LIBCMT ref: 0044C881

Part of subcall function 004090B1: __EH_prolog3_GS.LIBCMT ref: 004090B8

Strings

.ini, xrefs: 0040D1CE
0x%04x, xrefs: 0040D17D
x$L, xrefs: 0040D17A, 0040D182
x$L, xrefs: 0040D26B
x$L, xrefs: 0040D1A0
%ld, xrefs: 0040D1BF

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_Last$FreeH_prolog3String
String ID: %ld$.ini$0x%04x$x$L$x$L$x$L
API String ID: 80789219-711114805
Opcode ID: 5ae0a826b6d4c2271dfde23b4164b78bd51b162012b0011ccf71fb927f1235cc
Instruction ID: e1aabe10186407c04888144ecca78e977736ce5425062351c2664ca447838458
Opcode Fuzzy Hash: 5ae0a826b6d4c2271dfde23b4164b78bd51b162012b0011ccf71fb927f1235cc
Instruction Fuzzy Hash: F77193B18002189ADB14EBA5CD45BDDBBB8AF55344F1440EEE409B3182D7B85B48CBA9

Function 004215C5 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00447BB4: __EH_prolog3_GS.LIBCMT ref: 00447BBB
Part of subcall function 00447BB4: RegQueryValueExW.KERNELBASE(?,?,00000000,00000008,00000000,004C2418,0000005C,0041A47F,?,-80000001,?,?), ref: 00447C30

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

#8.MSI(00000000,00000001,($L,00000001,?), ref: 004217BC

Part of subcall function 0040A206: __EH_prolog3_GS.LIBCMT ref: 0040A210

Strings

x$L, xrefs: 0042168C, 004217E2, 00421692
,)L, xrefs: 0042177B
LogFile, xrefs: 004215F8
x$L, xrefs: 004217F8
($L, xrefs: 004217C1
($L, xrefs: 00421796, 00421799

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_$ErrorFreeLastString$QueryValue
String ID: ($L$($L$,)L$LogFile$x$L$x$L
API String ID: 1888970602-1145101666
Opcode ID: 43dee67c2bc67d5683880ec45cfca1c9ceb403456e7f995a9104a9e46f0f9fda
Instruction ID: a61e9c1e1550f51e809f44e1b20bafffc03d3c532b36c2dd2d28ff856b05918b
Opcode Fuzzy Hash: 43dee67c2bc67d5683880ec45cfca1c9ceb403456e7f995a9104a9e46f0f9fda
Instruction Fuzzy Hash: 19516171A10268DADB15EBA5CC95BEDB7B8AF54304F4000EEE40973282DB785F88CF65

Function 0040CC7B Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040CC85

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040B0F8: __EH_prolog3_GS.LIBCMT ref: 0040B0FF

Part of subcall function 0040A206: __EH_prolog3_GS.LIBCMT ref: 0040A210

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00444538: __EH_prolog3_GS.LIBCMT ref: 00444542

Strings

.ini, xrefs: 0040CCCB
MS Sans Serif, xrefs: 0040CD56
0x%04x, xrefs: 0040CCBD
x$L, xrefs: 0040CCA2
FontName, xrefs: 0040CD74
Properties, xrefs: 0040CD9A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$FreeString$H_prolog3
String ID: .ini$0x%04x$FontName$MS Sans Serif$Properties$x$L
API String ID: 1949661404-671832323
Opcode ID: 997d4544f9f8d7ef817a4d1cad21392589ab3b171f25fe18587f62e06d226b2e
Instruction ID: 1d9b78c3b6ae180934bb82b6156cdb2aa6218ca4c30e6a2486854675da1b29ff
Opcode Fuzzy Hash: 997d4544f9f8d7ef817a4d1cad21392589ab3b171f25fe18587f62e06d226b2e
Instruction Fuzzy Hash: 2A41A571D00218AADB14F7A5CC52BDDB7B8AF59744F4040AFF409B7182DBB81B48CBA6

Function 00425646 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0041B88A: __EH_prolog3_GS.LIBCMT ref: 0041B894
Part of subcall function 0041B88A: _memset.LIBCMT ref: 0041B8C3
Part of subcall function 0041B88A: _memset.LIBCMT ref: 0041B8E0
Part of subcall function 0041B88A: _memset.LIBCMT ref: 0041B8FA
Part of subcall function 0041B88A: _memset.LIBCMT ref: 0041B914
Part of subcall function 0041B88A: _memset.LIBCMT ref: 0041B92E
Part of subcall function 0041B88A: _memset.LIBCMT ref: 0041B948
Part of subcall function 0041B88A: InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 0041B959

#17.COMCTL32 ref: 0042564B

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000104), ref: 00425698

Part of subcall function 00409574: __EH_prolog3_GS.LIBCMT ref: 0040957B
Part of subcall function 00409574: GetLastError.KERNEL32(00000038,0040DCC8,004480DB,?,004AEF80), ref: 00409582
Part of subcall function 00409574: SetLastError.KERNEL32(00000000), ref: 004095D6

Part of subcall function 0043A720: __EH_prolog3_GS.LIBCMT ref: 0043A72A
Part of subcall function 0043A720: GetCurrentProcessId.KERNEL32(bin,00000000), ref: 0043A877

Part of subcall function 0040DF24: __EH_prolog3_GS.LIBCMT ref: 0040DF2E

Part of subcall function 00416FA7: __EH_prolog3.LIBCMT ref: 00416FAE
Part of subcall function 00416FA7: GetProcAddress.KERNEL32(?,RemoveEngineTypelib), ref: 0041707A

Part of subcall function 00409334: __EH_prolog3_GS.LIBCMT ref: 0040933B
Part of subcall function 00409334: DeleteFileW.KERNELBASE(00000005), ref: 00409425
Part of subcall function 00409334: Sleep.KERNELBASE(00000064), ref: 00409439

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

CoUninitialize.COMBASE ref: 00425789

Strings

EXE=%s, xrefs: 004256CA
EXEProcessBegin, xrefs: 004256DD
ISSetupInit, xrefs: 004256F5
x$L, xrefs: 0042567C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast_memset$H_prolog3_$String$FileFree$AddressAllocCurrentDeleteDescriptorH_prolog3InitializeModuleNameProcProcessSecuritySleepUninitialize
String ID: EXE=%s$EXEProcessBegin$ISSetupInit$x$L
API String ID: 2285022132-1555487937
Opcode ID: df6633ec9942e759994403b9866e762d71efa80d5e91c43e054907883cad7f0a
Instruction ID: 5e0388457cc18c2cbf51423a28c515a963b86515c5d36c4336905f37dfaed120
Opcode Fuzzy Hash: df6633ec9942e759994403b9866e762d71efa80d5e91c43e054907883cad7f0a
Instruction Fuzzy Hash: 5A3152B1A00104ABDB04FBA1DD56FED77799F45708F4000AEF606A61D2DF745A48CB6A

Function 00496140 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 0049615A
CreateSolidBrush.GDI32(?), ref: 0049616C
GetClientRect.USER32(?,?), ref: 0049617E
FillRect.USER32(?,?,00000000), ref: 0049618C
EnumChildWindows.USER32(?,h@VI,?), ref: 004961C8
EndPaint.USER32(?,?), ref: 004961D5

Strings

h@VI, xrefs: 004961C0

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: PaintRect$BeginBrushChildClientCreateEnumFillSolidWindows
String ID: h@VI
API String ID: 2395695982-1286442710
Opcode ID: c0f56de12637077d768f89e2218052bc50f69511eecae682e5ef0f93ee9ab398
Instruction ID: 3f88752057cc96ae715b18c17a7063ca6f54c104d13d1a482173797bbca26555
Opcode Fuzzy Hash: c0f56de12637077d768f89e2218052bc50f69511eecae682e5ef0f93ee9ab398
Instruction Fuzzy Hash: AC114F72A01409BF9B10DFA5DD45CAABBBDFF097007118236F806D2560DB34EE19DBA5

Function 004490FD Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,GetNativeSystemInfo,?,00444C6E,?), ref: 0044910A
GetProcAddress.KERNEL32(00000000), ref: 00449111
GetSystemInfo.KERNEL32(nLD,?,00444C6E,?), ref: 0044911E
GetNativeSystemInfo.KERNELBASE(nLD,?,00444C6E,?), ref: 00449126

Strings

nLD, xrefs: 00449117
GetNativeSystemInfo, xrefs: 00449100
kernel32, xrefs: 00449105

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32$nLD
API String ID: 3433367815-3378542857
Opcode ID: cdd1a64c60181141030e180afb1cd8e4eb07e16113e5f7609ac7469dd39a4d37
Instruction ID: 0e016607789c631524a8612ae79ae972a6d591fee2c5dcba26ba4da4d3464e10
Opcode Fuzzy Hash: cdd1a64c60181141030e180afb1cd8e4eb07e16113e5f7609ac7469dd39a4d37
Instruction Fuzzy Hash: 57D0C971940309AB9E002BE5BC0DAEE7F6CEA95A6A3000422F90E80850DB6D8450976A

Function 0041BC17 Relevance: 12.2, APIs: 8, Instructions: 229stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,000000E4,?,?), ref: 0041BC1E

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

__setjmp3.LIBCMT ref: 0041BC3F
_memmove.LIBCMT ref: 0041BE7A

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

Part of subcall function 00436C3F: __EH_prolog3_GS.LIBCMT ref: 00436C46

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

GetDlgItem.USER32(?,00000009), ref: 0041BCC5
KiUserCallbackDispatcher.NTDLL(00000000), ref: 0041BCCE
GetDlgItem.USER32(?,00000002), ref: 0041BCDA
EnableWindow.USER32(00000000), ref: 0041BCDD
GetTickCount.KERNEL32 ref: 0041BCDF

Part of subcall function 0041463E: GetDlgItem.USER32(?,0000012D), ref: 00414668
Part of subcall function 0041463E: SendMessageW.USER32(00000000), ref: 0041466F

Part of subcall function 0041C3F9: __EH_prolog3_GS.LIBCMT ref: 0041C400
Part of subcall function 0041C3F9: GetPrivateProfileIntW.KERNEL32(Startup,AllUsers,00000000,-00000004), ref: 0041C442

Part of subcall function 00436F38: IsWindow.USER32 ref: 00436F3D

Part of subcall function 0043601F: ShowWindow.USER32(?,00000000), ref: 0043602A

Part of subcall function 0041425D: __EH_prolog3.LIBCMT ref: 00414264
Part of subcall function 0041425D: IsWindow.USER32(?), ref: 00414283
Part of subcall function 0041425D: IsWindowVisible.USER32(?), ref: 00414290
Part of subcall function 0041425D: DestroyWindow.USER32(?), ref: 00414309

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window$Item$ErrorFreeH_prolog3_LastString$CallbackCountDestroyDispatcherEnableH_prolog3MessagePrivateProfileSendShowTickUserVisible__setjmp3_longjmp_malloc_memmovelstrcpy
String ID:
API String ID: 3785434896-0
Opcode ID: 3b7648ee3075621ef722513effa00dd08bf49c21de62ae4d0d4f6eef48b6cc18
Instruction ID: aa56115ff2bbcb4848bcdfbf7b085f4e992c61cae9b5cb179dc923e35aa1931e
Opcode Fuzzy Hash: 3b7648ee3075621ef722513effa00dd08bf49c21de62ae4d0d4f6eef48b6cc18
Instruction Fuzzy Hash: 7A71C2707403146BEB14BB328DA2FED26565F85718F00547EB60BAB2C3DE7C8E894769

Function 0041AB49 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 285COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041AB53

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

Part of subcall function 00424C8F: __EH_prolog3_GS.LIBCMT ref: 00424C99
Part of subcall function 00424C8F: FindFirstFileW.KERNELBASE(?,?), ref: 00424D1F

Part of subcall function 00409574: __EH_prolog3_GS.LIBCMT ref: 0040957B
Part of subcall function 00409574: GetLastError.KERNEL32(00000038,0040DCC8,004480DB,?,004AEF80), ref: 00409582
Part of subcall function 00409574: SetLastError.KERNEL32(00000000), ref: 004095D6

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00440F5B: __EH_prolog3_GS.LIBCMT ref: 00440F65

Strings

setup.exe, xrefs: 0041AEF4
Disk1, xrefs: 0041ADF1
-package, xrefs: 0041ADCD, 0041ADD2, 0041ADE0
x$L, xrefs: 0041AE61
x$L, xrefs: 0041ADF9

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_String$Free$AllocFileFindFirstH_prolog3
String ID: -package$Disk1$setup.exe$x$L$x$L
API String ID: 1930916927-1556615526
Opcode ID: 12678fae6f5c2d49120235d39ae59169bbb5d2e8a9cabf20ee502498242baf40
Instruction ID: 70a433201773a0c3cbd8a234ad06c359f542edcc746643b5f34dbf5a02f217b8
Opcode Fuzzy Hash: 12678fae6f5c2d49120235d39ae59169bbb5d2e8a9cabf20ee502498242baf40
Instruction Fuzzy Hash: EAC1AF70900218DFCB14EBA9C855BDDBBB4AF59304F1040EEE44AB3292DB785B49CF66

Function 004197C9 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 218COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004197D3

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00440F5B: __EH_prolog3_GS.LIBCMT ref: 00440F65

Strings

x$L, xrefs: 0041984D
setup.bmp, xrefs: 00419852, 004199B5
setupdir\%04x, xrefs: 00419820
setup.gif, xrefs: 0041990A, 00419A3C
x$L, xrefs: 004197F3

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$FreeH_prolog3String
String ID: setup.bmp$setup.gif$setupdir\%04x$x$L$x$L
API String ID: 888054269-176077047
Opcode ID: 320a876d64123cb240d67640e532765db179036dbe3d25907038a49db36c06c4
Instruction ID: a65990c60b186ec392da824ecff1523b0aad64cda9d5fa5ac55908cb38615755
Opcode Fuzzy Hash: 320a876d64123cb240d67640e532765db179036dbe3d25907038a49db36c06c4
Instruction Fuzzy Hash: 23919271910218DADB15EBA4CC51FDEB7B8BF18304F1401AFE54973182EBB45B49CB69

Function 00419E27 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 128fileCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00419E54

Part of subcall function 0041A8CF: CompareStringA.KERNELBASE(00000400,00000001,?,00000008,?,000000FF,?,00000000,?,?,00419E70,.debug,?), ref: 0041A8F7

GetSystemInfo.KERNELBASE(?), ref: 00419F08
MapViewOfFile.KERNELBASE(?,00000004,00000000,?,?,?), ref: 00419F2A

Strings

.rdata, xrefs: 00419E95
.text, xrefs: 00419EA8
.debug, xrefs: 00419E63

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CompareFileInfoQueryStringSystemViewVirtual
String ID: .debug$.rdata$.text
API String ID: 2597005349-733372908
Opcode ID: 37e3778c0922121b90d553cbbca7a890784bb744667964cc22ae3ce093477843
Instruction ID: 29beaf71a31fa256cabd0f6d43033cd2a2eb8a88310baff38952a8aeeb73b45c
Opcode Fuzzy Hash: 37e3778c0922121b90d553cbbca7a890784bb744667964cc22ae3ce093477843
Instruction Fuzzy Hash: 7B416D76A00309AFDB14DF94D894ADEB7B6FF88710B25812AE914D7340DB34ED91CB54

Function 0042228D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00422297
_memmove.LIBCMT ref: 004222B1

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,?,?,0000028C), ref: 004222E7
__setjmp3.LIBCMT ref: 00422308
_memmove.LIBCMT ref: 00422414

Strings

setup.cpp, xrefs: 004222C4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString_memmove$H_prolog3___setjmp3lstrcpy
String ID: setup.cpp
API String ID: 3036740637-2020632666
Opcode ID: 4b392e102d8e51c8acd37a3025fde6e161e98a795456e3c0acddfb83fcd84262
Instruction ID: cf270af0f1503dd86368d3aaf7e0d83238be362bd0ab4e2347f582b548cc42f4
Opcode Fuzzy Hash: 4b392e102d8e51c8acd37a3025fde6e161e98a795456e3c0acddfb83fcd84262
Instruction Fuzzy Hash: 26417270A00214EFDB50DFA1CD85F9A77B4BF45308F5440ADE509EB242DBB8AE89CB55

Function 0043688E Relevance: 10.6, APIs: 7, Instructions: 96windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004368A1
IsDialogMessageW.USER32(?,?), ref: 004368B8
TranslateMessage.USER32(?), ref: 004368C6
DispatchMessageW.USER32(?), ref: 004368D0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00436937
GetDlgItem.USER32(?,0000012D), ref: 00436967
SendMessageW.USER32(00000000,?,?,?), ref: 0043696E

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslateUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3948106488-0
Opcode ID: b71da695eea2bdb49b0e9eb49aa66ea15b3d28222df9e45080ae5cc6d7e3fadf
Instruction ID: e94a2e477b92a3fdafc25e2196c68fb8884c81bafec7444c5f84faa3a4d0236a
Opcode Fuzzy Hash: b71da695eea2bdb49b0e9eb49aa66ea15b3d28222df9e45080ae5cc6d7e3fadf
Instruction Fuzzy Hash: 0431A2B1A04206BFEB089F75DC49FA6BBADBF08714F10C12AF519C6291C778E814CB54

Function 0040CE0A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040CE14

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040B0F8: __EH_prolog3_GS.LIBCMT ref: 0040B0FF

Part of subcall function 0040A206: __EH_prolog3_GS.LIBCMT ref: 0040A210

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0044443D: __EH_prolog3_GS.LIBCMT ref: 00444447

Strings

.ini, xrefs: 0040CE51
0x%04x, xrefs: 0040CE43
x$L, xrefs: 0040CE40, 0040CE48
FontSize, xrefs: 0040CEDC
Properties, xrefs: 0040CEFA

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$FreeString$H_prolog3
String ID: .ini$0x%04x$FontSize$Properties$x$L
API String ID: 1949661404-2419324705
Opcode ID: 2718b8a6d85813ef4861b85dee11896731d11553a1c8d0678b0f3ecc5afe752f
Instruction ID: a3e339d6bf6ff3ae74f4f85c0c6c3616c2c03cbc6d82ce3ae90c40573472a82e
Opcode Fuzzy Hash: 2718b8a6d85813ef4861b85dee11896731d11553a1c8d0678b0f3ecc5afe752f
Instruction Fuzzy Hash: C0319371D00218AADB04F7A5CC42BED7778AF25748F0440AFF54573182EBB81B48CBA9

Function 004018F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00401914
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 0040192B
RegOpenKeyExW.KERNELBASE(?,?,00000000,?,00000000), ref: 00401964
RegCloseKey.KERNELBASE(00000000), ref: 00401977

Strings

Advapi32.dll, xrefs: 0040190F
RegOpenKeyTransactedW, xrefs: 00401925

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 3c2ed1920e99bc1483868682a02d7527fb160167ee0fdef96845b96a9ecd152f
Instruction ID: d809ea3027b1f306f98ab480c8832cf1951fceacb419359d491384aa3e5ae246
Opcode Fuzzy Hash: 3c2ed1920e99bc1483868682a02d7527fb160167ee0fdef96845b96a9ecd152f
Instruction Fuzzy Hash: C41181B1600205EBEF208F55CC54F677BA9EB85700F14403AF906B72A0D7B8D940DB29

Function 0041A920 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041A92A
_memmove.LIBCMT ref: 0041A944

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp), ref: 0041A97A
__setjmp3.LIBCMT ref: 0041A99B
_memmove.LIBCMT ref: 0041A9F0

Strings

setup.cpp, xrefs: 0041A957

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString_memmove$H_prolog3___setjmp3lstrcpy
String ID: setup.cpp
API String ID: 3036740637-2020632666
Opcode ID: d93aae61c25044c1201ded90aa3bf65f333a4adbab2625d06d5ad72b3d4c8a56
Instruction ID: e57aed387a736e3e4647923f8403d4b8517ef7d843d70c6620e0da17ad952d15
Opcode Fuzzy Hash: d93aae61c25044c1201ded90aa3bf65f333a4adbab2625d06d5ad72b3d4c8a56
Instruction Fuzzy Hash: 8A21A7B1A00209ABDB14DF91CD45FAE7378FF44705F00406EF945E7242DB7CAA498BA6

Function 00421408 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00421412
_memmove.LIBCMT ref: 0042142C

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,?,?,0000028C), ref: 00421462
__setjmp3.LIBCMT ref: 00421483
_memmove.LIBCMT ref: 004214D1

Strings

setup.cpp, xrefs: 0042143F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString_memmove$H_prolog3___setjmp3lstrcpy
String ID: setup.cpp
API String ID: 3036740637-2020632666
Opcode ID: c4ab562b656211f5cb293742f22f26efa1b7833de415b122acf8bd192310098f
Instruction ID: f22780b75e26f560afd6824df39a020350144d6e30bd2776fc1dad1b957efb1e
Opcode Fuzzy Hash: c4ab562b656211f5cb293742f22f26efa1b7833de415b122acf8bd192310098f
Instruction Fuzzy Hash: 6D21D771A001089BDB10EB91CD41F9E73B8AF44305F04406EF509E7292DB78AA088B65

Function 004389AE Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 004389D6
GetLastError.KERNEL32(?,00438955,?), ref: 004389E7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLastWindow
String ID:
API String ID: 3412209079-0
Opcode ID: 9a6f22457f7522abddc0d0e4a061c3e480a07dbe2481afb9b334d80b66d925c9
Instruction ID: 21f5205b74e7cae0ef2a885da8ebe06b54f85fc11985cf45db42e6fc5e2dd71a
Opcode Fuzzy Hash: 9a6f22457f7522abddc0d0e4a061c3e480a07dbe2481afb9b334d80b66d925c9
Instruction Fuzzy Hash: E6113C743002019FDB30AB29C848F2ABBE5AF59750F15856EF446DB670DF75EC409B49

Function 004208A1 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(00000000,00000000,-00000004), ref: 00420973
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00420998

Part of subcall function 00418A2C: __EH_prolog3_GS.LIBCMT ref: 00418A33
Part of subcall function 00418A2C: GetDriveTypeW.KERNELBASE(-00000004,?,?,?,00000000), ref: 00418A6A

Strings

Another instance of this setup is already running. Please wait for the other instance to finish and then try again., xrefs: 004209D0
x$L, xrefs: 00420A47

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CreateDriveH_prolog3_MutexObjectSingleTypeWait
String ID: Another instance of this setup is already running. Please wait for the other instance to finish and then try again.$x$L
API String ID: 2424727780-706081348
Opcode ID: 437fadecb57690f5228384c01fb8a8fc2eed2a1e1aabce4c06a69efcdfa4e5b8
Instruction ID: dbad69506a2231041a4a006695367ea003b51906ac651ab91300a2f597af355f
Opcode Fuzzy Hash: 437fadecb57690f5228384c01fb8a8fc2eed2a1e1aabce4c06a69efcdfa4e5b8
Instruction Fuzzy Hash: A351E7B0A001189FDB14EB64C955BAD77B9AF48344F0000EEF54AA7293DB789E48CF59

Function 0042181D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 133COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00421827

Part of subcall function 00447649: __EH_prolog3_GS.LIBCMT ref: 00447650
Part of subcall function 00447649: RegEnumKeyW.ADVAPI32(?,00000000,00000000,00000105), ref: 004476DC

Strings

ProductGuid, xrefs: 004218C0
x$L, xrefs: 00421887, 0042194E, 0042196D, 0042188A, 00421951
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0042185C, 004218D6
x$L, xrefs: 004218FC

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_$Enum
String ID: ProductGuid$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$x$L$x$L
API String ID: 1600297748-1121499816
Opcode ID: 0e0068a8ae5e5923d0c18d5e13d4de53f8a9451c898b735d2cbd7f4e4f59f169
Instruction ID: a00bcbff3c1c81b79e6af585fb1c77d80211fb568f26969b14791ac25a1d26a8
Opcode Fuzzy Hash: 0e0068a8ae5e5923d0c18d5e13d4de53f8a9451c898b735d2cbd7f4e4f59f169
Instruction Fuzzy Hash: BE411B71A00255AEEB14EBB5C856BDEB778BF12304F54009FE444A3192DB785B88CBA6

Function 00440F5B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00440F65
GetLastError.KERNEL32 ref: 00440FFA
GetLastError.KERNEL32 ref: 004410B9
__CxxThrowException@8.LIBCMT ref: 00441129

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0044113E: __EH_prolog3_catch_GS.LIBCMT ref: 00441148
Part of subcall function 0044113E: __CxxThrowException@8.LIBCMT ref: 00441207

Strings

, xrefs: 004410E2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$Exception@8Throw$H_prolog3H_prolog3_H_prolog3_catch_
String ID:
API String ID: 3135901474-3916222277
Opcode ID: c2246864ea34a6c8f246f15a6da91f1a8a21ffc0e80f898628eaa04756fb9e6b
Instruction ID: 963468b6f627b65aff2d86c86c529501732b621a59bfee45532925eae80d34c3
Opcode Fuzzy Hash: c2246864ea34a6c8f246f15a6da91f1a8a21ffc0e80f898628eaa04756fb9e6b
Instruction Fuzzy Hash: 88513B708012189AEF24EB64C885BDD7B746F15348F4401AFFD49271E2DBBC4A8DCB99

Function 00409E2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00409E32
_strlen.LIBCMT ref: 00409E62
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181,?,004C20A8), ref: 00409E7E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00409EB0

Strings

x$L, xrefs: 00409F46, 00409F5E, 00409F14, 00409F29

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ByteCharMultiWide$H_prolog3__strlen
String ID: x$L
API String ID: 708778256-723586279
Opcode ID: 4323810a31fb3c071f53b2649a10521a6c368675660e04d7892bf452d4d57310
Instruction ID: 22e552e6a5965a253ada8930edf7abae436bd0d297f1bb5ca923289028808c9c
Opcode Fuzzy Hash: 4323810a31fb3c071f53b2649a10521a6c368675660e04d7892bf452d4d57310
Instruction Fuzzy Hash: 48319371900114ABDB10EEA9CC91AEE7678AF48354F10012EF905E72C3DB789D05CBA9

Function 00423F76 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00423F7D

Part of subcall function 00423166: CloseHandle.KERNELBASE(000000FF,?,00417393,00000004,004178C7), ref: 0042317E

Part of subcall function 00422F77: SysFreeString.OLEAUT32(?), ref: 00422F8E

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000008,https://,00000000,00000000,00000007,http://,00000000,?), ref: 00423FD7

Strings

toys::file_lite, xrefs: 00424007
https://, xrefs: 00423FB0
http://, xrefs: 00423F9B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CloseCreateFileFreeH_prolog3HandleString
String ID: http://$https://$toys::file_lite
API String ID: 2776890527-1216559337
Opcode ID: 1970784b9fe0db8f7e99cbfdd66a6aff8a79a63dc1f754c0d593c37d49331b26
Instruction ID: 115a075d795035b9567d7bf24fdbda00f72b1bebb9f01eea793208d14a67e0e3
Opcode Fuzzy Hash: 1970784b9fe0db8f7e99cbfdd66a6aff8a79a63dc1f754c0d593c37d49331b26
Instruction Fuzzy Hash: BF11E770740304BAEB10AF619C82FAE3668DB10749F50402FB9156B1D1EA7C9E44C618

Function 00424043 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57sleepfileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042404A

Part of subcall function 00423166: CloseHandle.KERNELBASE(000000FF,?,00417393,00000004,004178C7), ref: 0042317E

Part of subcall function 00422F77: SysFreeString.OLEAUT32(?), ref: 00422F8E

Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 004240A7
CreateFileW.KERNELBASE(?,40000000,00000001,00000000,?,00000080,00000000,?,00000000,00000008,https://,00000000,00000000,00000007,http://,00000000), ref: 004240CF

Strings

https://, xrefs: 0042407F
http://, xrefs: 0042406A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CloseCreateFileFreeH_prolog3HandleSleepString
String ID: http://$https://
API String ID: 3362797072-1916535328
Opcode ID: ff12f276bf140ce8a9384981d6e5dca7764908fdf9e8e899a4c77d8ed88d9637
Instruction ID: 5b856ec279eafa0dbaa22d61b6872888fb85fd88eb7c7345f0546122081cf096
Opcode Fuzzy Hash: ff12f276bf140ce8a9384981d6e5dca7764908fdf9e8e899a4c77d8ed88d9637
Instruction Fuzzy Hash: 0611E770340315FFDB20AF60DC41FEE3668EF00749F40851BB626661D1DBB89A85C758

Function 00438751 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetPropW.USER32(?,This), ref: 00438762
GetWindowLongW.USER32(?,000000F4), ref: 004387A4
GetSysColor.USER32(00000005), ref: 004387C5
SetBkColor.GDI32(?,00000000), ref: 004387CF
SetPropW.USER32(?,This,?), ref: 00438841
RemovePropW.USER32(?,This), ref: 00438866
DefWindowProcW.USER32(?,?,?,?), ref: 00438878

Strings

This, xrefs: 0043875C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Prop$ColorWindow$LongProcRemove
String ID: This
API String ID: 1744480154-1591487769
Opcode ID: c4f3ae8f7d71142bf1a0955926dc12e4929648b97c5768b900a402550a3722db
Instruction ID: 9051d0914fdfaf4faf7958792106ffb9103e3eccbf1f8dac69d6451faa5a5366
Opcode Fuzzy Hash: c4f3ae8f7d71142bf1a0955926dc12e4929648b97c5768b900a402550a3722db
Instruction Fuzzy Hash: 3401A735501305ABCB2C6E25DC48A67FB29EB5D355F60252FF502D26E1CE28EC41851C

Function 0045BD01 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0045BD19

Part of subcall function 0045D24B: __FF_MSGBANNER.LIBCMT ref: 0045D262
Part of subcall function 0045D24B: __NMSG_WRITE.LIBCMT ref: 0045D269
Part of subcall function 0045D24B: RtlAllocateHeap.NTDLL(007C0000,00000000,00000001,00000000,?,00000000,?,00469A0C,00000008,00000008,00000008,?,?,00462EB6,00000018,004D0708), ref: 0045D28E

std::exception::exception.LIBCMT ref: 0045BD35
__CxxThrowException@8.LIBCMT ref: 0045BD4A

Part of subcall function 0045A275: RaiseException.KERNEL32(?,?,00459DDB,00000000,?,?,?,?,00459DDB,00000000,004D043C,?), ref: 0045A2C6

Strings

jK, xrefs: 0045BD3F, 0045BD2B
jK, xrefs: 0045BD43

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: jK$jK
API String ID: 3074076210-3733566359
Opcode ID: 11a33f894cfea4c30d49c07cf9186b834f4ad657c7ec9f8f5cc2dbfd74101e15
Instruction ID: ff19c72b6f3f0c92a44214d313891bac2aa33bad2cc9a8a8bf3644c7b56ba58b
Opcode Fuzzy Hash: 11a33f894cfea4c30d49c07cf9186b834f4ad657c7ec9f8f5cc2dbfd74101e15
Instruction Fuzzy Hash: 19F0A43140020EBBCF01AF95DC02AEE7B79EF05345F10405AFD04A5152EB7AD66897D9

Function 00408FDF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00408FE6
GetLastError.KERNEL32(00000004,00409224,00000000,?,00439787,00000000,00000000,?,00409F4E,?,00000000,?,00000001,00000048,00409E02,x$L), ref: 00409008
SetLastError.KERNEL32(?,00000000,?,00439787,?,00409F4E,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000), ref: 00409044

Strings

h$L, xrefs: 00408FFC
T"L, xrefs: 0040901C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3
String ID: T"L$h$L
API String ID: 3502553090-2055687491
Opcode ID: 3cde4112283731c41efb688c9d981245870c4874ede33d6c33f4695ae281cab6
Instruction ID: 39d6d6a3d33b3cd4ea688baafbe1299afffc96a2aad1659f25a7bff7281e0214
Opcode Fuzzy Hash: 3cde4112283731c41efb688c9d981245870c4874ede33d6c33f4695ae281cab6
Instruction Fuzzy Hash: FD0124B9900616EFCB01CF15C944A99BBF0FF48714B00812AF8099BA21C7B4EA64DFC8

Function 00408F6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00408F74
GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

Strings

T"L, xrefs: 00408FA7
h$L, xrefs: 00408F8A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3
String ID: T"L$h$L
API String ID: 3502553090-2055687491
Opcode ID: 41991d6398cc9efe1e04c47e94ced2bdfc84c3edd379f1885c7b7b4bc3578889
Instruction ID: 1b283f0fb1bd38af898ab30e110cfd069b9a6fb87087c469322872efe4ea9b2b
Opcode Fuzzy Hash: 41991d6398cc9efe1e04c47e94ced2bdfc84c3edd379f1885c7b7b4bc3578889
Instruction Fuzzy Hash: 730146B4900612EFCB00CF54C944959BBF0FF18710B00812AF8089BA11C7B4E965CFC8

Function 0043760D Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00437614

Part of subcall function 0040D5F8: __EH_prolog3_GS.LIBCMT ref: 0040D602

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

IsWindow.USER32 ref: 00437665
GetLastError.KERNEL32(?,004C2418,00000000,?,00000000), ref: 00437681

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeH_prolog3_String$Window
String ID:
API String ID: 678173169-0
Opcode ID: c3a48415594f9529fc68ae6b3b9f8bc536774dc54304e6308c379684c973fa01
Instruction ID: dbe687658f3ae00eeb4bfcb9eeb8eb490fea7c72d3b3f72d35c0d504190234c3
Opcode Fuzzy Hash: c3a48415594f9529fc68ae6b3b9f8bc536774dc54304e6308c379684c973fa01
Instruction Fuzzy Hash: B4118FB0A04600DFDB25EB65C91AA6D77A9BF09368F50442EF482D71A1DF38DD05CB4D

Function 0044C877 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044C881

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0044C410: __EH_prolog3_GS.LIBCMT ref: 0044C417

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Strings

x$L, xrefs: 0044C9F5, 0044C9F8
], xrefs: 0044C9B1
x$L, xrefs: 0044C905

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$H_prolog3
String ID: ]$x$L$x$L
API String ID: 532146472-1033985947
Opcode ID: a5ec671335e3b6f45e964f7621ebc89d5db18b07651b630fbf8e01d7022075f9
Instruction ID: 7c45a9df5ce21a91dbc55a1e1f94d547cc1a61662a16117705b2739e7fd3109d
Opcode Fuzzy Hash: a5ec671335e3b6f45e964f7621ebc89d5db18b07651b630fbf8e01d7022075f9
Instruction Fuzzy Hash: 56A19E71801118EFDB11EBA5C891BDEB7B8AF15304F5440AFE449B3282EB74AB48CF65

Function 0041A371 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041A37B

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00447BB4: __EH_prolog3_GS.LIBCMT ref: 00447BBB
Part of subcall function 00447BB4: RegQueryValueExW.KERNELBASE(?,?,00000000,00000008,00000000,004C2418,0000005C,0041A47F,?,-80000001,?,?), ref: 00447C30

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 00415D52: __EH_prolog3.LIBCMT ref: 00415D59

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

Part of subcall function 0041A703: __EH_prolog3_GS.LIBCMT ref: 0041A70D
Part of subcall function 0041A703: SysStringLen.OLEAUT32(?), ref: 0041A80D
Part of subcall function 0041A703: SysFreeString.OLEAUT32(?), ref: 0041A818

Strings

x$L, xrefs: 0041A39B
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0041A42D
UninstallString, xrefs: 0041A417

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$String$H_prolog3_$FreeH_prolog3$AllocQueryValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$UninstallString$x$L
API String ID: 582199494-391319954
Opcode ID: 960c996103ba328d558d096d2467e7297299dda6f1d01f0d323a855d990e6617
Instruction ID: 5e944476362f840331ea672b6e7edd22fb21261c19f530edcedb8f22e0cdf01b
Opcode Fuzzy Hash: 960c996103ba328d558d096d2467e7297299dda6f1d01f0d323a855d990e6617
Instruction Fuzzy Hash: 68718E71900218EEDB25EBA1CC91BEDB7B8AF15304F1440EEE44963192DBB85F88CF65

Function 004416CF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004416D6

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

GetLastError.KERNEL32 ref: 004417CB

Strings

\, xrefs: 00441736
x$L, xrefs: 0044177A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3_
String ID: \$x$L
API String ID: 2549205776-3237034059
Opcode ID: 07dd2193b42661d9d5e88339f9321eb1e49e2fe408b28e4e533a43a6f1b71b77
Instruction ID: db17d43efd6568f04fbd8218940044e047c62216783c8458e032877faa3323e8
Opcode Fuzzy Hash: 07dd2193b42661d9d5e88339f9321eb1e49e2fe408b28e4e533a43a6f1b71b77
Instruction Fuzzy Hash: 7841D675800218DFEB14FFF5C881AEDBB78AF14358F10012FE81567292EB78554ACBA9

Function 00447BB4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00447BBB

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 004018F0: GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00401914
Part of subcall function 004018F0: RegCloseKey.KERNELBASE(00000000), ref: 00401977

RegQueryValueExW.KERNELBASE(?,?,00000000,00000008,00000000,004C2418,0000005C,0041A47F,?,-80000001,?,?), ref: 00447C30

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

Part of subcall function 0043E66C: RegQueryValueExW.ADVAPI32(?,004C2418,00000000,?,?,?,?,?,00000000,?,00447C74,00000000,?,004C2418,?,004C2418), ref: 0043E68D

Part of subcall function 00409574: __EH_prolog3_GS.LIBCMT ref: 0040957B
Part of subcall function 00409574: GetLastError.KERNEL32(00000038,0040DCC8,004480DB,?,004AEF80), ref: 00409582
Part of subcall function 00409574: SetLastError.KERNEL32(00000000), ref: 004095D6

Strings

x$L, xrefs: 00447CC1
x$L, xrefs: 00447C43

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_QueryStringValue$AllocCloseHandleModule
String ID: x$L$x$L
API String ID: 3053678408-3102039750
Opcode ID: 663985e5ed15b9febffe327af721e2565f4b39932adae9d21efb71c173937f49
Instruction ID: 5b48733a4eff4593c80f9d7f20f503a399f8d08c0c2f54303da8eec1336f2910
Opcode Fuzzy Hash: 663985e5ed15b9febffe327af721e2565f4b39932adae9d21efb71c173937f49
Instruction Fuzzy Hash: 7B314871800259DFDF05EF95C9919DEBBB8FF14348F40402EE90167291DB74AE09CBA4

Function 004146D3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004146DD
CreateDialogIndirectParamW.USER32(?,00000000,?,?,?), ref: 004147DE

Strings

MS Sans Serif, xrefs: 00414735
x$L, xrefs: 004147A2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CreateDialogH_prolog3_IndirectParam
String ID: MS Sans Serif$x$L
API String ID: 2249790658-3827839863
Opcode ID: 2e52344b66d3c868f404233d7d479598eac1e205e528797dcf26a15fabc71d48
Instruction ID: 6fa5a847ab002c5c7bbcf46bdbddeba9841be53d8229e530f250d93d036e2994
Opcode Fuzzy Hash: 2e52344b66d3c868f404233d7d479598eac1e205e528797dcf26a15fabc71d48
Instruction Fuzzy Hash: 4A316D70800229DFDF10EFA4C841BEDBBB4BF05308F1000AEE855B3282DB385A54DBA4

Function 0041C790 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041C797

Part of subcall function 00415BF4: __EH_prolog3.LIBCMT ref: 00415BFB
Part of subcall function 00415BF4: GetLastError.KERNEL32(00000004,00451B56,00000001,00000004,00452606,00000000,004C2418,?,00430D5C,($L), ref: 00415C23
Part of subcall function 00415BF4: SetLastError.KERNEL32(00000008,?,00430D5C,($L), ref: 00415C48

SysStringLen.OLEAUT32(?), ref: 0041C7BB

Part of subcall function 00416DE7: GetLastError.KERNEL32 ref: 00416DFE
Part of subcall function 00416DE7: SysFreeString.OLEAUT32(?), ref: 00416E0B
Part of subcall function 00416DE7: SetLastError.KERNEL32(?), ref: 00416E25
Part of subcall function 00416DE7: GetLastError.KERNEL32 ref: 00416E34
Part of subcall function 00416DE7: SysFreeString.OLEAUT32(?), ref: 00416E51
Part of subcall function 00416DE7: SetLastError.KERNEL32(?), ref: 00416E61

Part of subcall function 0042399F: SysStringLen.OLEAUT32(?), ref: 004239B1

CreateDirectoryW.KERNELBASE(?,00000000,?,00000000,00000001,00000000,?,00000001,00000001), ref: 0041C7FB

Strings

\, xrefs: 0041C813

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$String$FreeH_prolog3$CreateDirectory
String ID: \
API String ID: 3191628259-2967466578
Opcode ID: 708d5dd2a54f9f24966614d15bb5c889bcb619ed300da059fe36219c81c4114f
Instruction ID: e19ef506378ef5fef5529f671d9badc20e44781941f7b17083f9b60dd2f41d48
Opcode Fuzzy Hash: 708d5dd2a54f9f24966614d15bb5c889bcb619ed300da059fe36219c81c4114f
Instruction Fuzzy Hash: 7C1142B1900109AFCB00EFE4C885DEEBB78EF18309F40851BF51267191DB789589CF69

Function 00401BE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004018F0: GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00401914
Part of subcall function 004018F0: RegCloseKey.KERNELBASE(00000000), ref: 00401977

RegQueryValueExW.ADVAPI32(00000000,DoVerboseLogging,00000000,?,?,?), ref: 00401C3D
RegCloseKey.ADVAPI32(00000000), ref: 00401C5D

Strings

DoVerboseLogging, xrefs: 00401C29
SOFTWARE\InstallShield\22.0\Professional, xrefs: 00401BED

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Close$HandleModuleQueryValue
String ID: DoVerboseLogging$SOFTWARE\InstallShield\22.0\Professional
API String ID: 2971604672-398011643
Opcode ID: 02a6bc8b86ed849f35a119819eb7dc1e860b5fc337ee8693c7a4b3c7d757b230
Instruction ID: 6dbe65afc27484276ff81125c1e5155bf750777fb0c1884b80c8869b847d47ac
Opcode Fuzzy Hash: 02a6bc8b86ed849f35a119819eb7dc1e860b5fc337ee8693c7a4b3c7d757b230
Instruction Fuzzy Hash: 0C017575D85219EAEB10DF90D945BEFBBB8AB00705F100166E505B2181D3B556488BD9

Function 00408E82 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00408E89
GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Strings

h$L, xrefs: 00408E9F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3
String ID: h$L
API String ID: 3502553090-923250583
Opcode ID: 85b75ef872500ba0afe75f7d06acf00ba5ea4e17049d2e4bb3307737f456c07d
Instruction ID: dc8ab0d2dea8ff48c24d3a53c80809b0f5e393024766e2048ab8d11fc8ce9c10
Opcode Fuzzy Hash: 85b75ef872500ba0afe75f7d06acf00ba5ea4e17049d2e4bb3307737f456c07d
Instruction Fuzzy Hash: AF014BB5900612EBC700DF19CA44955BBF0FF18714B04812BA809DBB51CBB4E915CFC9

Function 0041425D Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00414264
IsWindow.USER32(?), ref: 00414283
IsWindowVisible.USER32(?), ref: 00414290
DestroyWindow.USER32(?), ref: 00414309

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window$DestroyH_prolog3Visible
String ID:
API String ID: 447219068-0
Opcode ID: 6d02d24e178a0d28e704dc36e01667a0acef0859f19c1e9f322ac278357d0c62
Instruction ID: 70189d7c1be0e3dbd8842a1796a936c97121ee332600acde1b2bb810fe2f7e0e
Opcode Fuzzy Hash: 6d02d24e178a0d28e704dc36e01667a0acef0859f19c1e9f322ac278357d0c62
Instruction Fuzzy Hash: 98311C70B0030AEFDB04DFA5C888AAFBBB8BF89304B14846DE855DB251D779D941CB64

Function 00424922 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042492C
__CxxThrowException@8.LIBCMT ref: 00424990
SetFilePointer.KERNELBASE(?,?,?,?,00000108,00423C7D,00000000,00000000,00000000,00000000,00000000,00000010,00423EFD), ref: 0042499C
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004249EF

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0041693E: __EH_prolog3.LIBCMT ref: 00416945

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3$Exception@8FileH_prolog3_PointerThrow
String ID:
API String ID: 2919269545-0
Opcode ID: 9ab62d29881e8b232417da892e782e6b9cbbfc708276541d0413f5b2ad760d30
Instruction ID: 32170a0515c60f2c1d6299bbbb7b6c8763967b83281597155a8392daf0c2a0bb
Opcode Fuzzy Hash: 9ab62d29881e8b232417da892e782e6b9cbbfc708276541d0413f5b2ad760d30
Instruction Fuzzy Hash: 153160B5900119EBCB10DFA1DC85FEEBB78BB18314F00426FE916A7181DB749A48CF99

Function 004230C7 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004230D1
InterlockedDecrement.KERNEL32(00000000), ref: 004230E1
CloseHandle.KERNELBASE(000000FF), ref: 00423109
__CxxThrowException@8.LIBCMT ref: 0042314F

Part of subcall function 0042318E: InterlockedDecrement.KERNEL32(004D8A58), ref: 004231B3

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: DecrementInterlocked$CloseException@8H_prolog3_HandleThrow
String ID:
API String ID: 104201321-0
Opcode ID: 2c37466431c2af8191a84910e666b704a04410be1b1b04a2b88592bd71e2943c
Instruction ID: b5f4ac4455d5125a9b8b227986a56ff7ec4296bbcea274bd35fcc469a948294f
Opcode Fuzzy Hash: 2c37466431c2af8191a84910e666b704a04410be1b1b04a2b88592bd71e2943c
Instruction Fuzzy Hash: 2911E570600711DFDB20AF62D845BABB7B4BF0071AF40852EE556A19E1DB7CAA18CB48

Function 004145D8 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00414601
IsDialogMessageW.USER32(?,?), ref: 00414615
TranslateMessage.USER32(?), ref: 00414623
DispatchMessageW.USER32(?), ref: 0041462D

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 116d3009746e778ec6e067052d86ef56d0b7eabc485eae395a49faa252b73ba0
Instruction ID: 0d2dc630c1ad475a1843b4f6da7c8974f70232efad33f0374802094044f38c75
Opcode Fuzzy Hash: 116d3009746e778ec6e067052d86ef56d0b7eabc485eae395a49faa252b73ba0
Instruction Fuzzy Hash: 61F0C2B1D04245BBCB109BB69C08EFBBFBDAB86744B00402AA552D2251D678D482CB28

Function 00401B80 Relevance: 6.0, APIs: 4, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
SysFreeString.OLEAUT32(?), ref: 00401BAB
SysFreeString.OLEAUT32(?), ref: 00401BB6
SetLastError.KERNEL32(?), ref: 00401BD4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeLastString
String ID:
API String ID: 3822639702-0
Opcode ID: 190014a5b126da629fc190ad644ddcb535daabdca90a69b0deed560546f8e7d6
Instruction ID: 320b57a6e87ba0f0fef65b2a0f09a0adb1bc9a1e879b280412c58516d3996f94
Opcode Fuzzy Hash: 190014a5b126da629fc190ad644ddcb535daabdca90a69b0deed560546f8e7d6
Instruction Fuzzy Hash: 78F0F435800512EFCB009F29E948A40BBF1FF59329B15826AE80997A21DB71F9A4CFC5

Function 00416FA7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 150libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00416FAE
GetProcAddress.KERNEL32(?,RemoveEngineTypelib), ref: 0041707A

Strings

RemoveEngineTypelib, xrefs: 00417073

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressH_prolog3Proc
String ID: RemoveEngineTypelib
API String ID: 3325816569-1749684603
Opcode ID: 450443d442b27e39a8c2fae56f84e86329a5e5c46fa4d800979e12f3ae9da807
Instruction ID: b3e53b7be7877d472e033687883616ac428115e8a57cbe912e7f5b8ca809919e
Opcode Fuzzy Hash: 450443d442b27e39a8c2fae56f84e86329a5e5c46fa4d800979e12f3ae9da807
Instruction Fuzzy Hash: 7E512D742067019FD728EF35C498BABB7F0AF05305F14846DE8AB8B361CB39A944CB14

Function 00407B10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00407BD9

Strings

invalid string position, xrefs: 00407C0C, 00407C16
string too long, xrefs: 00407C20

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 49c71d871b5f0f168f78a54828abed4d8df5fee2a283c1e747d7411141fb4244
Instruction ID: 160ced02efe6b669dc93ed860dee935e668affa596cb2d8f2ef6a8fa74049f70
Opcode Fuzzy Hash: 49c71d871b5f0f168f78a54828abed4d8df5fee2a283c1e747d7411141fb4244
Instruction Fuzzy Hash: 0131CE327083049BC7209E2CE88182BF3BAFF917153104A3FE85197291DB79F81487AA

Function 00423E83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00423E8A

Part of subcall function 004230C7: __EH_prolog3_GS.LIBCMT ref: 004230D1
Part of subcall function 004230C7: InterlockedDecrement.KERNEL32(00000000), ref: 004230E1
Part of subcall function 004230C7: CloseHandle.KERNELBASE(000000FF), ref: 00423109
Part of subcall function 004230C7: __CxxThrowException@8.LIBCMT ref: 0042314F

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

Part of subcall function 0045BD01: std::exception::exception.LIBCMT ref: 0045BD35
Part of subcall function 0045BD01: __CxxThrowException@8.LIBCMT ref: 0045BD4A

GetLastError.KERNEL32(000000FF,00000000,80400100,?,00000000,004411B3,004AEF98,80000000,00000001,00000080,00000003,00000000,00000000,?,00000000,0000013C), ref: 00423F65

Strings

toys::file, xrefs: 00423F25

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Exception@8Throw$CloseDecrementErrorH_prolog3H_prolog3_HandleInterlockedLast_mallocstd::exception::exception
String ID: toys::file
API String ID: 2011250969-314977804
Opcode ID: e646ad9487fbf0dc1e71daf0ae4c7f52b32a8be97cc723616c4ed55826c8a6a8
Instruction ID: 0eff8b3820f582f5ec91fbc87e841621f81a06092d660698d99bd88d19dfd0f5
Opcode Fuzzy Hash: e646ad9487fbf0dc1e71daf0ae4c7f52b32a8be97cc723616c4ed55826c8a6a8
Instruction Fuzzy Hash: 7F210230700314AFDF14AF65A981A6A3BB5AF04309F50402FF5569B292DB3DDE098B19

Function 0041948E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00419495

Strings

x$L, xrefs: 004194E2, 004194EA
0x%04lx.ini, xrefs: 004194E5

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_
String ID: 0x%04lx.ini$x$L
API String ID: 2427045233-3474428882
Opcode ID: bdec76982b78b885bef83a4b614bc780d6d89019b7abbbbb66eda4b9404d4126
Instruction ID: 46530861cef0f94641e817f99d69e4206bd4763769252c4e3a0a292efad61745
Opcode Fuzzy Hash: bdec76982b78b885bef83a4b614bc780d6d89019b7abbbbb66eda4b9404d4126
Instruction Fuzzy Hash: D921F375900114DFCB04EFA5C856AEDBBB4BF18304F04405EF906A7292DB786E09CBE9

Function 00447649 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00447650

Part of subcall function 004018F0: GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00401914
Part of subcall function 004018F0: RegCloseKey.KERNELBASE(00000000), ref: 00401977

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

RegEnumKeyW.ADVAPI32(?,00000000,00000000,00000105), ref: 004476DC

Part of subcall function 00409574: __EH_prolog3_GS.LIBCMT ref: 0040957B
Part of subcall function 00409574: GetLastError.KERNEL32(00000038,0040DCC8,004480DB,?,004AEF80), ref: 00409582
Part of subcall function 00409574: SetLastError.KERNEL32(00000000), ref: 004095D6

Strings

x$L, xrefs: 004476B6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_String$AllocCloseEnumHandleModule
String ID: x$L
API String ID: 1559478826-723586279
Opcode ID: a0e8e6cc1a7a2e1c97009f53706c9d391b819b9889cd74b4eb797573b2bd00ce
Instruction ID: c0bea8fb3f0dcdf86ba622f07b6245e37e46a4cccafd52357915753bafdbad66
Opcode Fuzzy Hash: a0e8e6cc1a7a2e1c97009f53706c9d391b819b9889cd74b4eb797573b2bd00ce
Instruction Fuzzy Hash: 05217C70C00258DFDB01EF95C945BDDBBB4BF54348F50406EE401BB292DBB85A49CB99

Function 00433523 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043352D

Part of subcall function 00416471: __EH_prolog3.LIBCMT ref: 00416478

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00423E83: __EH_prolog3.LIBCMT ref: 00423E8A

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

x$L, xrefs: 00433538
x$L, xrefs: 00433556

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3$FreeString$H_prolog3_
String ID: x$L$x$L
API String ID: 1866482717-3102039750
Opcode ID: 4de447649305bcce6cadb9ad5ba30182d613bcc05633d5efc2e9058c255f4436
Instruction ID: 80ec664b1c551b8f94705cb67819d36b40f759c14e465c193d8692ee381d4d28
Opcode Fuzzy Hash: 4de447649305bcce6cadb9ad5ba30182d613bcc05633d5efc2e9058c255f4436
Instruction Fuzzy Hash: 34217135900258EBDB21DF51C851BDDB7B0AF14308F54819EFD8567282DB786F48CBA5

Function 0040E537 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040E53E

Strings

($L, xrefs: 0040E57F
,)L, xrefs: 0040E568

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_
String ID: ($L$,)L
API String ID: 2427045233-1160466256
Opcode ID: ca5e3ab5818cfcf3a99471dab04df7053e011b0d34455a4fb06b67ecd19318b5
Instruction ID: 392a37083068cd256060934b966e0548929fd2f934fe537188f639cc5389dcc1
Opcode Fuzzy Hash: ca5e3ab5818cfcf3a99471dab04df7053e011b0d34455a4fb06b67ecd19318b5
Instruction Fuzzy Hash: 41115E71910159AEDF11EBA1CC55BED7BB8BB00308F44442FE001B31D2DBB82A49CBA9

Function 00436E0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetSysColor.USER32(00000005), ref: 00436E2B
CreateSolidBrush.GDI32(00000000), ref: 00436E32

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Strings

x$L, xrefs: 00436E43

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$BrushColorCreateSolid
String ID: x$L
API String ID: 1391376083-723586279
Opcode ID: f65d8be0424af4b60ae6d7107703b3268da45e6b049f8689d0d96218fa161dfa
Instruction ID: e14454d43fd703315f8fecfe4ee7fe2e2841cb4cd9cb81b81068afc65b76aad8
Opcode Fuzzy Hash: f65d8be0424af4b60ae6d7107703b3268da45e6b049f8689d0d96218fa161dfa
Instruction Fuzzy Hash: B1018BB2600304AFD310DF59D880BDABBF8FB08325F10842EF25ACB651D7B5A545CBA4

Function 00440732 Relevance: 4.8, APIs: 3, Instructions: 291COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0044073C

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00445DB8: __EH_prolog3.LIBCMT ref: 00445DBF

GetLastError.KERNEL32 ref: 00440781

Part of subcall function 004484F8: __EH_prolog3.LIBCMT ref: 004484FF

Part of subcall function 00443E8A: __EH_prolog3_GS.LIBCMT ref: 00443E94
Part of subcall function 00443E8A: __CxxThrowException@8.LIBCMT ref: 00443EF6
Part of subcall function 00443E8A: GetFileTime.KERNEL32(?,004C2418,?,?,00000108,004408FC,?,?,?,004AEF98,80000000,00000001,00000080,00000003,00000000,00000000), ref: 00443F00

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3Last$Exception@8FileH_prolog3_H_prolog3_catch_ThrowTime
String ID:
API String ID: 2981398202-0
Opcode ID: a8c59660c858f013e625a86ec63408de7ce29c1e0dcee742d348ea231f43842d
Instruction ID: db0683c10f2e59c105e8868f5f4c08202c9c8bc5139867da876c03c56914026c
Opcode Fuzzy Hash: a8c59660c858f013e625a86ec63408de7ce29c1e0dcee742d348ea231f43842d
Instruction Fuzzy Hash: 8BB1E571800158AEEB10EB65CD41BEE7BB8AF10358F50419FF929622D2EB785F44CB69

Function 004081C0 Relevance: 4.6, APIs: 3, Instructions: 73memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 00408209
_memmove.LIBCMT ref: 00408231
SysFreeString.OLEAUT32(004D8420), ref: 00408241

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: String$AllocFree_memmove
String ID:
API String ID: 439004091-0
Opcode ID: d301264f7f8ff9656f44f867d7ac76c200d0a939465cd4bdd45438ceeb0af894
Instruction ID: 4653bcf97572727324da77d8a37abb10425da10aef01e49313f91b959620cda6
Opcode Fuzzy Hash: d301264f7f8ff9656f44f867d7ac76c200d0a939465cd4bdd45438ceeb0af894
Instruction Fuzzy Hash: 1C21E772A047049FC7248FA8D9C456AB7E9EF85310320463FE8D6C77A0DF70A805C765

Function 00415317 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00415321
__CxxThrowException@8.LIBCMT ref: 00415397
ReadFile.KERNELBASE(?,?,?,?,00000000,0000010C,00423C39,?,00000003,00000000,00000000,00000000,00000000,00000000,00000010,00423EFD), ref: 004153A9

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0041693E: __EH_prolog3.LIBCMT ref: 00416945

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3Last$Exception@8FileH_prolog3_ReadThrow
String ID:
API String ID: 2465803405-0
Opcode ID: 71706a4b041770a114c132f725b4f923e2f64b23a88afc9f8a6a71635c7d9aaa
Instruction ID: 412364a76a4e7f24362dc714037110c8436f762bd39cfadedbf21ae78f1021fa
Opcode Fuzzy Hash: 71706a4b041770a114c132f725b4f923e2f64b23a88afc9f8a6a71635c7d9aaa
Instruction Fuzzy Hash: 7E213CB590021CEBCB24DF95CC81EEFB7B8AF54304F00856FE916A3141DB749A89CBA4

Function 0042A133 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042A13D
__CxxThrowException@8.LIBCMT ref: 0042A1B3
ReadFile.KERNELBASE(?,?,?,?,00000000,0000010C,00433C9B,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042A1C5

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0041693E: __EH_prolog3.LIBCMT ref: 00416945

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3Last$Exception@8FileH_prolog3_ReadThrow
String ID:
API String ID: 2465803405-0
Opcode ID: ec744932d2e5f1d0ddda31ac7bc3ae675ca4e572abd93eb7ebcd86a5f26a0ec0
Instruction ID: 6d4801b38ea2778cce0b9a081fc96de9d1521bf0beb876d6a196355021c06eb7
Opcode Fuzzy Hash: ec744932d2e5f1d0ddda31ac7bc3ae675ca4e572abd93eb7ebcd86a5f26a0ec0
Instruction Fuzzy Hash: 23213EB5900218EBCB14DF95CC81EEFB77CBF54304F40855FE916A3241DB749A49CAA5

Function 00495A40 Relevance: 4.5, APIs: 3, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB,?), ref: 00495A60
GetWindowLongW.USER32(?,000000EB), ref: 00495A6B
DefWindowProcW.USER32(?,?,?,?), ref: 00495A9F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window$Long$Proc
String ID:
API String ID: 3468714886-0
Opcode ID: 3d567beec09413c5d8908983dc62e35af7f629cb63c2f7065610c156339bfdc3
Instruction ID: 66c7763e42f8a0b5552e89bac943ca35bdd779b44c22446e158ccc732f572b23
Opcode Fuzzy Hash: 3d567beec09413c5d8908983dc62e35af7f629cb63c2f7065610c156339bfdc3
Instruction Fuzzy Hash: 4D017172500129ABCB118F45EC84DABBFACFF89760F144626F90593250C335AC10DBA4

Function 0043D613 Relevance: 4.5, APIs: 3, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043D61D
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 0043D638

Part of subcall function 0040B6F4: __EH_prolog3.LIBCMT ref: 0040B6FB
Part of subcall function 0040B6F4: GetLastError.KERNEL32(00000004,00416579,00000008,00423143,004AD954,00000001,?,00000000), ref: 0040B714

__CxxThrowException@8.LIBCMT ref: 0043D659

Part of subcall function 0045A275: RaiseException.KERNEL32(?,?,00459DDB,00000000,?,?,?,?,00459DDB,00000000,004D043C,?), ref: 0045A2C6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: DirectoryErrorExceptionException@8H_prolog3H_prolog3_LastRaiseThrowWindows
String ID:
API String ID: 1535131608-0
Opcode ID: 8610a8f6d65bdd14c6189a1099fac399d4341677d2b98cdd03a4ffaf2819fac3
Instruction ID: 17bee4da3f32dcf9e594f862856bfe0205ba92dfa9bd69c4c451500902f7d7a4
Opcode Fuzzy Hash: 8610a8f6d65bdd14c6189a1099fac399d4341677d2b98cdd03a4ffaf2819fac3
Instruction Fuzzy Hash: 21112171A00218AECB20EB52CC89BDDB378EB14704F5005EFB549A7191DF786A85CF8D

Function 00499920 Relevance: 4.5, APIs: 3, Instructions: 39windowmemoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010,00000000,?,?,004994F3,00000000,00000000), ref: 00499927
GdipCreateBitmapFromStreamICM.GDIPLUS(00000000,00000000,00000010,00000000,?,?,004994F3), ref: 0049994C
GdipCreateBitmapFromStream.GDIPLUS(00000000,00000000,00000010,00000000,?,?,004994F3), ref: 00499961

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Gdip$BitmapCreateFromStream$Alloc
String ID:
API String ID: 924644634-0
Opcode ID: d17f5d7af2be45f0fd848955f2240215d7a6cc67e8768e0f26a30889da1c42cc
Instruction ID: 4312496e57b09a4d6b3dc46bfd9aff4e4a0468a012d0a42cf79bb76309ceccea
Opcode Fuzzy Hash: d17f5d7af2be45f0fd848955f2240215d7a6cc67e8768e0f26a30889da1c42cc
Instruction Fuzzy Hash: BCF04F71A05218ABCF20DF99E5416AABBE8DB04714F0085AFEC4CC7300E775AD50CBD5

Function 00439FC1 Relevance: 4.5, APIs: 3, Instructions: 39fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00439FCB
WriteFile.KERNELBASE(?,?,?,?,00000000,00000088,0048A006,?,00000000,004AEF98,40000000,00000001,00000080,00000002,00000000,00000000), ref: 00439FEF

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00416550: __EH_prolog3.LIBCMT ref: 00416557

__CxxThrowException@8.LIBCMT ref: 0043A034

Part of subcall function 0045A275: RaiseException.KERNEL32(?,?,00459DDB,00000000,?,?,?,?,00459DDB,00000000,004D043C,?), ref: 0045A2C6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3Last$ExceptionException@8FileH_prolog3_RaiseThrowWrite
String ID:
API String ID: 3362004152-0
Opcode ID: 5bb2872edd0db4e1886802f4d8a7dbc55861ba8c1ae5af9248a74e8d5f92ffa5
Instruction ID: 82a0559f9849c30c39de8e10315b1a637df18062751b76e3c91efdcd1f7c1014
Opcode Fuzzy Hash: 5bb2872edd0db4e1886802f4d8a7dbc55861ba8c1ae5af9248a74e8d5f92ffa5
Instruction Fuzzy Hash: 800128B5900118AFDB10DFA1CC81FAEB778FF14314F00826EB55AA6191DB74AE49CB98

Function 004386CE Relevance: 4.5, APIs: 3, Instructions: 38windowCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 004386EA
DispatchMessageW.USER32(?), ref: 004386F4
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00438705

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d3f23735209afddef1b2e39e3d9ef3e1d85101bcb302e68d4cc961365af5de4f
Instruction ID: e374d58f98a68875e499c604f7772023b80387223a946bc91353f0d189f1f390
Opcode Fuzzy Hash: d3f23735209afddef1b2e39e3d9ef3e1d85101bcb302e68d4cc961365af5de4f
Instruction Fuzzy Hash: 6FF0A7B1E043096FEB04ABF89C89EBB77ECDB0D754F000426F502C7181EA64D802476C

Function 00414360 Relevance: 4.5, APIs: 3, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041437B
GetTickCount.KERNEL32 ref: 00414388
Sleep.KERNELBASE(000003E8), ref: 00414397

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 2846a6b5f2bd28edf801f30f4a0fea09533792da269e56888e149bf7663f2fd5
Instruction ID: 0ceb6d20c71848ef94385bb32e7ef2760997e7f56e1f9961495b964192f0d894
Opcode Fuzzy Hash: 2846a6b5f2bd28edf801f30f4a0fea09533792da269e56888e149bf7663f2fd5
Instruction Fuzzy Hash: 7EF0F6716482589FC701572098487FD7FE45B46320F1481ABEC968B352CA7DC8C4875E

Function 004075B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0040766C

Strings

string too long, xrefs: 0040769F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _memmove
String ID: string too long
API String ID: 4104443479-2556327735
Opcode ID: 72e21c2e964c070faf17067fe33424c17b682d18b1f0fff299620f9fcbe84550
Instruction ID: e91ac76f477ead8a0a86d7026f60ae4da85a3d42beb4a0dd95d22cdf5b2bfad6
Opcode Fuzzy Hash: 72e21c2e964c070faf17067fe33424c17b682d18b1f0fff299620f9fcbe84550
Instruction Fuzzy Hash: C831C832718A049BC6349E5CE89086AF3E9FF91721320093FE447D7690DB36FC5587AA

Function 0040D5F8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040D602

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040CB96: __EH_prolog3_GS.LIBCMT ref: 0040CB9D

Strings

x$L, xrefs: 0040D696

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_Last
String ID: x$L
API String ID: 1018228973-723586279
Opcode ID: ae229c9bce7f49019c5fa403ad99112c8de921c9db6c8663a73c1d35c5fa20f1
Instruction ID: 5892da52d6cd3dfe1ac0a1f34603dd7aa7352cfdf509acf482a9ec7bd820dccf
Opcode Fuzzy Hash: ae229c9bce7f49019c5fa403ad99112c8de921c9db6c8663a73c1d35c5fa20f1
Instruction Fuzzy Hash: C2416E70D00218DADB14EBE5CC91BEDB7B8AF14348F1444AFE409B72C2DB785A49CB69

Function 0044C410 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044C417

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00433523: __EH_prolog3_GS.LIBCMT ref: 0043352D

Strings

x$L, xrefs: 0044C44A, 0044C44D

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$H_prolog3
String ID: x$L
API String ID: 532146472-723586279
Opcode ID: ce1a888a346eab03023a6592704a226442a0145e70c73b9cd0882a7031e46bb9
Instruction ID: 50a78904457f29d40e44f4de8dd8e5cae3c5e440dfee5232eaf51f9531db404c
Opcode Fuzzy Hash: ce1a888a346eab03023a6592704a226442a0145e70c73b9cd0882a7031e46bb9
Instruction Fuzzy Hash: 2E31B271900218ABDB14EFA5CC91EDEB778AF55348F14402EF911772C2DB786E09CBA9

Function 00444538 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00444542

Part of subcall function 0044AC24: __EH_prolog3.LIBCMT ref: 0044AC2B

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0044C877: __EH_prolog3_GS.LIBCMT ref: 0044C881

Strings

x$L, xrefs: 00444596

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3H_prolog3_Last
String ID: x$L
API String ID: 211087501-723586279
Opcode ID: 6c785f0356753e772a84c91202a9285128697da115078653eb58d41a926f69a6
Instruction ID: e57334c802573ee483c9a6cc19b7e8849cbc59440be322ee593b4f56dcee19ca
Opcode Fuzzy Hash: 6c785f0356753e772a84c91202a9285128697da115078653eb58d41a926f69a6
Instruction Fuzzy Hash: 593195B4800248DBDB10EF69C941BDDBBB4AF55348F50409EE81D77281DBB81B49CBBA

Function 0041896F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetProductSKU), ref: 0041898D

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00422922: __EH_prolog3_GS.LIBCMT ref: 00422929

Strings

GetProductSKU, xrefs: 00418982

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeLastString$AddressH_prolog3_Proc
String ID: GetProductSKU
API String ID: 3812291585-665147802
Opcode ID: 5da8aef887fe503ea04eee5bf4de78b0ccf49fc3717b5cea729611f58a79ffa7
Instruction ID: 00073c22baae4c9b3b649aef32d46c1817a3a60afe8aacf89c1c90a419eded8f
Opcode Fuzzy Hash: 5da8aef887fe503ea04eee5bf4de78b0ccf49fc3717b5cea729611f58a79ffa7
Instruction Fuzzy Hash: 7F11B776B00214AFCB14EFB5D8848FE77F9AF48250B44012FF406D3241DA789A84DB55

Function 0044443D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00444447

Part of subcall function 0044AC24: __EH_prolog3.LIBCMT ref: 0044AC2B

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0044C877: __EH_prolog3_GS.LIBCMT ref: 0044C881

Strings

x$L, xrefs: 0044448C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3H_prolog3_Last
String ID: x$L
API String ID: 211087501-723586279
Opcode ID: 7a58ebac173b2c128d449e9bd695a83d335b9c27de9b59c5cec02c75b70cdcd8
Instruction ID: 56a9dc175be8363d0e582901f6965cbc8cae2c6b70e4acc881eccb2511512311
Opcode Fuzzy Hash: 7a58ebac173b2c128d449e9bd695a83d335b9c27de9b59c5cec02c75b70cdcd8
Instruction Fuzzy Hash: 1A21A070801218EAEB00FF65C9527DDBB78AF11348F14009EE80D6B292DB785B49CBE6

Function 0044B654 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0044B65B

Strings

L, xrefs: 0044B690

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_catch
String ID: L
API String ID: 3886170330-2909332022
Opcode ID: 455aae1349e18eef470a2266b6b99196c36a22fe012f438846f9ae39901ea5cb
Instruction ID: 73135984c2a27dcb4f629d64b8593c638cf2cfd7146dbf9a6c85122b54a6401a
Opcode Fuzzy Hash: 455aae1349e18eef470a2266b6b99196c36a22fe012f438846f9ae39901ea5cb
Instruction Fuzzy Hash: CC1170B1901205DFDB14DF69C9426AEBBB1EF54350F20842FE5599B391CB38DA40CB99

Function 00422CC2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00422CC9

Strings

<K, xrefs: 00422CD0, 00422CFE, 00422CD5

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_catch
String ID: <K
API String ID: 3886170330-3385963892
Opcode ID: 1e66cd08ddcd4b7ed025b785f3f759e8aa35c1bb5e7f510bb45dcc4afee23ab9
Instruction ID: 7bd574062f6894f9baa01d940feab7c0802c0690990fdb70d4586f666b306bf0
Opcode Fuzzy Hash: 1e66cd08ddcd4b7ed025b785f3f759e8aa35c1bb5e7f510bb45dcc4afee23ab9
Instruction Fuzzy Hash: 14118E75A012059FDB18DF65C581BAEBBB1EF58354F20842FF84597342CB78AA40CF99

Function 0040CB96 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040CB9D

Part of subcall function 0040D135: __EH_prolog3_GS.LIBCMT ref: 0040D13F

Part of subcall function 0040CA6F: __EH_prolog3_catch_GS.LIBCMT ref: 0040CA76

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

x$L, xrefs: 0040CBBC, 0040CBD9, 0040CBBF

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeH_prolog3_LastString$H_prolog3_catch_
String ID: x$L
API String ID: 2236083837-723586279
Opcode ID: 51fbc0eccf6705b73c1a1c48df4b98047bc4f46daa82d8dbfbbcf56808a0f7b9
Instruction ID: b71b9d6e1800e922c28eb334c4e01096cee32600cc82e97848b73b9589ac414c
Opcode Fuzzy Hash: 51fbc0eccf6705b73c1a1c48df4b98047bc4f46daa82d8dbfbbcf56808a0f7b9
Instruction Fuzzy Hash: 9EF0DA76901218DBDF01EF95C881BDE7778EF08755F14401AF904BB241C738AE16CBA9

Function 00436D9F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00436DA6

Part of subcall function 00436E0B: GetSysColor.USER32(00000005), ref: 00436E2B
Part of subcall function 00436E0B: CreateSolidBrush.GDI32(00000000), ref: 00436E32

Strings

language, xrefs: 00436DD0

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: BrushColorCreateH_prolog3Solid
String ID: language
API String ID: 4081663723-3571151285
Opcode ID: 1a115d4d0930656a22908abf686764f2e4d37565708caf574eeda8cca9fbdc9a
Instruction ID: a76cc4643e617b4b8c5f4090ff9a713eb4c5540a71e90637459b7431b48d7716
Opcode Fuzzy Hash: 1a115d4d0930656a22908abf686764f2e4d37565708caf574eeda8cca9fbdc9a
Instruction Fuzzy Hash: 28E092B1B44700ABE724EB55C802BED66E49BA4B14F20846FF6444B1D2CBFC594483AD

Function 00415230 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00415237

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Strings

<K, xrefs: 0041523C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3Last
String ID: <K
API String ID: 685212868-3385963892
Opcode ID: a1aacf4e7b78768df69d43c9d81cb8ed0d34e8aa425f7f55f5c65b6197beafe2
Instruction ID: 37bdacf63b8aec3877ebfd7c0fc7b9070b3fad0990e9899c689f67a8d2379c00
Opcode Fuzzy Hash: a1aacf4e7b78768df69d43c9d81cb8ed0d34e8aa425f7f55f5c65b6197beafe2
Instruction Fuzzy Hash: 1FE017B8101304EBEF08AF91CA42BDD7660EF54719F24806FAE556A292C7FD4604DBAD

Function 00421F08 Relevance: 3.1, APIs: 2, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

Part of subcall function 0043760D: __EH_prolog3_GS.LIBCMT ref: 00437614
Part of subcall function 0043760D: IsWindow.USER32 ref: 00437665
Part of subcall function 0043760D: GetLastError.KERNEL32(?,004C2418,00000000,?,00000000), ref: 00437681

Sleep.KERNEL32(?), ref: 00421FD5
_memmove.LIBCMT ref: 0042202D

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_LastSleepWindow_longjmp_memmove
String ID:
API String ID: 2038866824-0
Opcode ID: edb7867d29871f9a8b3a8c75ecdad368476c5026d476321d79fc4cbb1e5454f9
Instruction ID: 122fe63bd1f05fca0440c7ab5ddea96f2c13e7867fff8d72a1279e8308071cbf
Opcode Fuzzy Hash: edb7867d29871f9a8b3a8c75ecdad368476c5026d476321d79fc4cbb1e5454f9
Instruction Fuzzy Hash: 9931C4707101109BCB55FB75D9A6E7D73AA6F98304F44404FF14A9B282CF6C4E458B5A

Function 00419631 Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978dbbcfe713860a58d7bd35421e759a39dec579a1cc6c727ecc7dd5439608fd
Instruction ID: 275fb9f05806e2159bf9e1309934bd11318f4ee6c5ca23063f1104b0ebae2f8e
Opcode Fuzzy Hash: 978dbbcfe713860a58d7bd35421e759a39dec579a1cc6c727ecc7dd5439608fd
Instruction Fuzzy Hash: 5311E33910431196CF202FA684215EAB3F89F92B84B04440FEA9357712C7B9AC81C7BE

Function 00418A2C Relevance: 3.0, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00418A33

Part of subcall function 0040A3F4: __EH_prolog3_GS.LIBCMT ref: 0040A3FB

GetDriveTypeW.KERNELBASE(-00000004,?,?,?,00000000), ref: 00418A6A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_$DriveType
String ID:
API String ID: 3859355100-0
Opcode ID: a47370b8b7eecdfc67c98ba8395a4131ab836315ee3b0cca8f3351578c9ac99d
Instruction ID: 73ec5882524eb0538738371afa8c9c4307bcaa25c67cfc8041a48b477c48ffa8
Opcode Fuzzy Hash: a47370b8b7eecdfc67c98ba8395a4131ab836315ee3b0cca8f3351578c9ac99d
Instruction Fuzzy Hash: 6601D631D00110CBCF18F7B8C4596EDB261AF45354F14002FE412A72A1DE3CAD86D65E

Function 00494B70 Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00494BC1
DestroyWindow.USER32(00000000,?,?,?,?,004AB348,000000FF), ref: 00494BCE

Part of subcall function 00494B40: DeleteObject.GDI32(?), ref: 00494B4A
Part of subcall function 00494B40: DeleteMetaFile.GDI32(00000000), ref: 00494B58

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: DeleteWindow$DestroyFileMetaObject
String ID:
API String ID: 1159293575-0
Opcode ID: 60431c1c546eb4ab7d95ce657979aeb4cbca1cca9a2c9d240947423912076b61
Instruction ID: 81d68ef5455b2b430f0226cc336fcd6765cc77d7304aa2c43d8fe2dbf89106d4
Opcode Fuzzy Hash: 60431c1c546eb4ab7d95ce657979aeb4cbca1cca9a2c9d240947423912076b61
Instruction Fuzzy Hash: AA0171B1904604AFDB219F05D841B6BBBE8EB85B14F00857FE85693750E779E810CB98

Function 004959C0 Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 004959E7
DefWindowProcW.USER32(?,0000000F,?,?,0000000F,?,?,?), ref: 00495A25

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: 02932bfdcbf8bd9a5e3440ee499dbfef774caf4fbd8457fc8cc5c35e1fb85a03
Instruction ID: 9ce70322b2b9e2782243a0ca765bcebd1961957321a6972a702c7d2b6271d81d
Opcode Fuzzy Hash: 02932bfdcbf8bd9a5e3440ee499dbfef774caf4fbd8457fc8cc5c35e1fb85a03
Instruction Fuzzy Hash: 3B016D7310010ABBDF214F88EC00BDABFA5FB49321F104437FA5996561D7B69870EB64

Function 004124FB Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B0), ref: 00412509
GetDlgItem.USER32(?,000000D0), ref: 0041252B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Item
String ID:
API String ID: 3207170592-0
Opcode ID: 71cedbc59656e06719e58782f0fe036c2521625093c0ad8005daca40ed69d518
Instruction ID: c5cb8092a00633fd9d043421c319f9a4bfbf5b8b1f32ac383a88ee74cd421632
Opcode Fuzzy Hash: 71cedbc59656e06719e58782f0fe036c2521625093c0ad8005daca40ed69d518
Instruction Fuzzy Hash: B0F0E972100101BBEB041B51DC06EAB3F1CEF09760F01802AFE0896150D775FC6097A8

Function 021A0E3C Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,?), ref: 021A0E67
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 021A0E80

Memory Dump Source

Source File: 00000002.00000002.2433062040.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21a0000_LocalPlayback.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 559bbdefaf15e456d605dae105da3aef4e62acee13071953ca7ff870281ea4d7
Instruction ID: 0db10f7f7f2d54f55655ab94cb51b4411e090399127f33dd5203920eb90523f5
Opcode Fuzzy Hash: 559bbdefaf15e456d605dae105da3aef4e62acee13071953ca7ff870281ea4d7
Instruction Fuzzy Hash: 15F08276200305AFDB18CF40C844FDE77B9EB44390F10457AEE42AB684C6B0FA148B50

Function 00497130 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000001,00000005,?,?,?,0049538C,00000000), ref: 00497156
InvalidateRect.USER32(00000001,00000000,00000001,?,0049538C,00000000), ref: 00497168

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: InvalidateRectShowWindow
String ID:
API String ID: 518433929-0
Opcode ID: 8189368ccb92ae6e8203c47edb7ce3286c39f4d498b76f4fcff963448d2f9be0
Instruction ID: ea7f7aa1bad523a3132c1aaf9087dc3324bb03b61798d082b37d08272c2f9ab4
Opcode Fuzzy Hash: 8189368ccb92ae6e8203c47edb7ce3286c39f4d498b76f4fcff963448d2f9be0
Instruction Fuzzy Hash: DBE092316507047BDB344F14DD46B97BEA9EF00FA0F02063EF806C2750D3A29C408288

Function 0041463E Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,0000012D), ref: 00414668
SendMessageW.USER32(00000000), ref: 0041466F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 183ad1b3c546db8b79f9ecff61ba1d823c68d7ea0a68b7b30dbbaf05417430b7
Instruction ID: 741dcc1524a899a0b8510aa786998abc38e92caf57386452fba44c4630e3b72f
Opcode Fuzzy Hash: 183ad1b3c546db8b79f9ecff61ba1d823c68d7ea0a68b7b30dbbaf05417430b7
Instruction Fuzzy Hash: 1AE0487160530067D2105AA5DC09F87BB9CDBC9751F00442AF746E3280C674B8008768

Function 004388FE Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00438906
SetWindowTextW.USER32(?,?), ref: 00438925

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window$Text
String ID:
API String ID: 848690642-0
Opcode ID: 1242532a6630bb7f020315b68d4ad5c0a45e74ccd4f6095e953d16bbefaa05e7
Instruction ID: c294523d5cd58dc03854b38be640f6e62343de549598373d0a2b6492eba401cd
Opcode Fuzzy Hash: 1242532a6630bb7f020315b68d4ad5c0a45e74ccd4f6095e953d16bbefaa05e7
Instruction Fuzzy Hash: 8BE04F70100208EFD7209F55E848EA2BBEDEF06351740503EF481C6120DB31EC10CB59

Function 0046954D Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00469553

Part of subcall function 0046951B: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,vIF,?,?,00469558,00000008,?,0045D278,000000FF,0000001E,00000000,?,00000000,?,00469A0C), ref: 0046952A
Part of subcall function 0046951B: GetProcAddress.KERNEL32(vIF,CorExitProcess), ref: 0046953C

ExitProcess.KERNEL32 ref: 0046955C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 98faa46b16891bcd36d67df8979278e1d74002c6e6067cdec7bc93db44c311b5
Instruction ID: 3d6015bd0dbc0e6985d2f256991384e73f035b2b18bf3da2a2a849689f1a0985
Opcode Fuzzy Hash: 98faa46b16891bcd36d67df8979278e1d74002c6e6067cdec7bc93db44c311b5
Instruction Fuzzy Hash: 9AB09231000108BBDB023F22DC0A8483F29EB01698B004025F80609136EBB6AE929A89

Function 00436C3F Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00436C46

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00436D9F: __EH_prolog3.LIBCMT ref: 00436DA6

Part of subcall function 00436EC6: __EH_prolog3.LIBCMT ref: 00436ECD

Part of subcall function 00436E78: __EH_prolog3.LIBCMT ref: 00436E7F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3$FreeString$H_prolog3_
String ID:
API String ID: 1866482717-0
Opcode ID: 3b0965d7bea4a683ceea38367a888ff1bfa7002abd4fb9a6955ae9423a7592da
Instruction ID: b220b5a3d57609504bb19b34f572255a4ba2e98e5c785551eb4ec246cdd4d220
Opcode Fuzzy Hash: 3b0965d7bea4a683ceea38367a888ff1bfa7002abd4fb9a6955ae9423a7592da
Instruction Fuzzy Hash: 5131B2F4500205EFD344DF64C580BDCFBB8BF19308F10816EE15997282DBB8A919CBA8

Function 00421E35 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0042202D

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

Part of subcall function 0043760D: __EH_prolog3_GS.LIBCMT ref: 00437614
Part of subcall function 0043760D: IsWindow.USER32 ref: 00437665
Part of subcall function 0043760D: GetLastError.KERNEL32(?,004C2418,00000000,?,00000000), ref: 00437681

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_LastWindow_longjmp_memmove
String ID:
API String ID: 4079449645-0
Opcode ID: d15bfc15b467bbf78d8005555179165a4a6db49386e72f4c815950ccc6fe02bb
Instruction ID: 54e5b29a8703047d93331c7a914afef89d1876ead1c456d9d1e7ce246372e19f
Opcode Fuzzy Hash: d15bfc15b467bbf78d8005555179165a4a6db49386e72f4c815950ccc6fe02bb
Instruction Fuzzy Hash: 542121B03101109FCA16FB75C966E7C77AA5F98314B04404FF28A8B382CF2C8E41C78A

Function 00423B7D Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00423B84

Part of subcall function 00424A9A: __EH_prolog3_GS.LIBCMT ref: 00424AA4
Part of subcall function 00424A9A: __CxxThrowException@8.LIBCMT ref: 00424B09
Part of subcall function 00424A9A: GetFileSize.KERNEL32(?,?,00000108,00423B96,00000000,00000010,00423EFD,?,?,?,?,?,?,00000000), ref: 00424B12
Part of subcall function 00424A9A: GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00424B1F

Part of subcall function 00424922: __EH_prolog3_GS.LIBCMT ref: 0042492C
Part of subcall function 00424922: __CxxThrowException@8.LIBCMT ref: 00424990
Part of subcall function 00424922: SetFilePointer.KERNELBASE(?,?,?,?,00000108,00423C7D,00000000,00000000,00000000,00000000,00000000,00000010,00423EFD), ref: 0042499C
Part of subcall function 00424922: GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004249EF

Part of subcall function 00415317: __EH_prolog3_GS.LIBCMT ref: 00415321
Part of subcall function 00415317: __CxxThrowException@8.LIBCMT ref: 00415397
Part of subcall function 00415317: ReadFile.KERNELBASE(?,?,?,?,00000000,0000010C,00423C39,?,00000003,00000000,00000000,00000000,00000000,00000000,00000010,00423EFD), ref: 004153A9

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Exception@8FileH_prolog3_Throw$ErrorLast$H_prolog3_catchPointerReadSize
String ID:
API String ID: 2159634448-0
Opcode ID: ee83bfbd2f47410b43365c700ab9ed9d82a4c8661e95902d378d05b60e5ff230
Instruction ID: 79b6915e8af06a2722153daee8015efa6e536dda75978f18344548ee4bc0cab2
Opcode Fuzzy Hash: ee83bfbd2f47410b43365c700ab9ed9d82a4c8661e95902d378d05b60e5ff230
Instruction Fuzzy Hash: 4C2139A0B047A99DDF30DF7A54456BFADB89B41329F90024FE1A2622D2C37C4F41539E

Function 0041C586 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041C590

Part of subcall function 00416471: __EH_prolog3.LIBCMT ref: 00416478

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00423E83: __EH_prolog3.LIBCMT ref: 00423E8A

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00424A9A: __EH_prolog3_GS.LIBCMT ref: 00424AA4
Part of subcall function 00424A9A: __CxxThrowException@8.LIBCMT ref: 00424B09
Part of subcall function 00424A9A: GetFileSize.KERNEL32(?,?,00000108,00423B96,00000000,00000010,00423EFD,?,?,?,?,?,?,00000000), ref: 00424B12
Part of subcall function 00424A9A: GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00424B1F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3$FreeH_prolog3_String$Exception@8FileSizeThrow
String ID:
API String ID: 3623232617-0
Opcode ID: 97cba5418062411dd96cba2e94b0951265d3053abb8ee65e2f196bfbdac14d60
Instruction ID: 6153ae5c723094e8a1ff5efdabd857ed958c099eaf61fa5945d362ea24f79d86
Opcode Fuzzy Hash: 97cba5418062411dd96cba2e94b0951265d3053abb8ee65e2f196bfbdac14d60
Instruction Fuzzy Hash: F8216F31900218DEEB14EBA4CC95BDDB3B4FF10348F5041AEE416A71D2DB78AA49CB59

Function 0041AA00 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041AA07

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: 067dd4cf2b3a5a51450a32be2d76b962f4100563202e412c10b7db95b17fb878
Instruction ID: d3c36b398ec384bbbd628edeaac1e3c8a7a3d0c4feda967a4d4401315b0f8375
Opcode Fuzzy Hash: 067dd4cf2b3a5a51450a32be2d76b962f4100563202e412c10b7db95b17fb878
Instruction Fuzzy Hash: 48216D719112049FEB04EB95C94ABEDB774EF45714F04405AE8016B2D2D774AA0ACB96

Function 0041D8B7 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041D8BE

Part of subcall function 0041E006: __EH_prolog3_GS.LIBCMT ref: 0041E010

Part of subcall function 0041D96E: __EH_prolog3_GS.LIBCMT ref: 0041D978

Part of subcall function 0040B175: __EH_prolog3_GS.LIBCMT ref: 0040B17C

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_$ErrorFreeLastString
String ID:
API String ID: 2278686355-0
Opcode ID: 0d14d3c8f9f8932d90f653f77a0b502f67e7d56038ce3d798c205385fd2d5f9a
Instruction ID: 9e833310d05d6c26e440e9fdec68ee2c6f8c39dc2163c8ff58ea1492bb3bb0ef
Opcode Fuzzy Hash: 0d14d3c8f9f8932d90f653f77a0b502f67e7d56038ce3d798c205385fd2d5f9a
Instruction Fuzzy Hash: 5611E771901204FACB05FBA68861ADD77B8AF25748F40402FF856A72D3DB7C6B09C799

Function 0044CD94 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044CD9B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: ca3299d8b7c2daca69b479aa22bae607c24ff3d911bfa21559a614d8a5f3b628
Instruction ID: 193c0cf6ae07c7780b5cdf5f610ccccfa7331e2e35641393e9be154b756e8e7a
Opcode Fuzzy Hash: ca3299d8b7c2daca69b479aa22bae607c24ff3d911bfa21559a614d8a5f3b628
Instruction Fuzzy Hash: 241108F2A01B00DBEB68EF05C5D15AEB7A1EF9470AF15442FE54A57741CB386940CB4D

Function 004019E0 Relevance: 1.6, APIs: 1, Instructions: 51registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?), ref: 00401A08

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c2fa7879411210a0aaeafa4382a43572cbaad1e153854e3fc874ed8f33ffb592
Instruction ID: 3c605c71c6bf40542a0857bb74465a32a96c3d074774da4f5e3c959172be46b5
Opcode Fuzzy Hash: c2fa7879411210a0aaeafa4382a43572cbaad1e153854e3fc874ed8f33ffb592
Instruction Fuzzy Hash: C3012172301219ABDB248F58D841BAB77A9EF95320F10843BFD15D77A0D375D861CBA4

Function 0041C6CC Relevance: 1.5, APIs: 1, Instructions: 40libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(-00000004), ref: 0041C6FF

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 03bf563eac0f97fccf959e65e2795470459f0d03d8437bda0769bad3798bed59
Instruction ID: ec24e689fcc94f140464248d664a3b4429190aa892e059b3f96cb4e45321b627
Opcode Fuzzy Hash: 03bf563eac0f97fccf959e65e2795470459f0d03d8437bda0769bad3798bed59
Instruction Fuzzy Hash: A5018B71A012049FC718EB78E84599AB3F8AF44708F01057FE407D7254EB74AA04CB14

Function 00433CB1 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00433CB8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 2faf42ef253eec12fed0076a776992d9358c3f5b96dacee0680b3265be058359
Instruction ID: 357087c334c45f14f41d4f64870b125d84e4b8035cffb649562b12d018976b9f
Opcode Fuzzy Hash: 2faf42ef253eec12fed0076a776992d9358c3f5b96dacee0680b3265be058359
Instruction Fuzzy Hash: C2F0F0B3A001245BCB14BF658C4187EA6A6AB98B01F04582FF81297253DE388F0087DD

Function 00496CD0 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00496CE4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: bde280162c9b456624faf6517eacbd2b79c46f4075e1f142c109cad043619ce9
Instruction ID: 2b8d9b91cd63b892409a494b977df8199271b35e1eddcc18bb9aabf95752587b
Opcode Fuzzy Hash: bde280162c9b456624faf6517eacbd2b79c46f4075e1f142c109cad043619ce9
Instruction Fuzzy Hash: 2BF06D72600218ABCF20AA69A804A977FECBB04354F00843BF95AC3601EA36E514C7A4

Function 0041A8CF Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000400,00000001,?,00000008,?,000000FF,?,00000000,?,?,00419E70,.debug,?), ref: 0041A8F7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 518259dae57f58b0c0956598b3d0d09374b0683937de38e5e6154715bba35ab4
Instruction ID: 0ec61d2f2218c9d5f95f38435b926530a915f3df106dddb3e453d252d68caa6c
Opcode Fuzzy Hash: 518259dae57f58b0c0956598b3d0d09374b0683937de38e5e6154715bba35ab4
Instruction Fuzzy Hash: CFF0A37134111577D7104B954C845D6F749EF01770F524622FA1CD2480D371ECD182D5

Function 02FA0DE8 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,?), ref: 02FA0E13

Memory Dump Source

Source File: 00000002.00000002.2434642107.0000000002FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2fa0000_LocalPlayback.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 559bbdefaf15e456d605dae105da3aef4e62acee13071953ca7ff870281ea4d7
Instruction ID: 0db10f7f7f2d54f55655ab94cb51b4411e090399127f33dd5203920eb90523f5
Opcode Fuzzy Hash: 559bbdefaf15e456d605dae105da3aef4e62acee13071953ca7ff870281ea4d7
Instruction Fuzzy Hash: 15F08276200305AFDB18CF40C844FDE77B9EB44390F10457AEE42AB684C6B0FA148B50

Function 004246C1 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 004246DD

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c2006d65e2110f162d14119c91e8f5f1169c4ac09daacce7168c1f4798efc058
Instruction ID: 8c0c9b204031a8c4bda8a97566184b787da4e0a3178e377d7f5c05e40e459e9c
Opcode Fuzzy Hash: c2006d65e2110f162d14119c91e8f5f1169c4ac09daacce7168c1f4798efc058
Instruction Fuzzy Hash: 1CF0A032200118FFCF009F40CD00E99BBA9EF06394F108165BD1966090C332DE12DB98

Function 00414F94 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00414F9B

Part of subcall function 00415230: __EH_prolog3.LIBCMT ref: 00415237

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch
String ID:
API String ID: 1882928916-0
Opcode ID: fecc79f254df4aae47e0e233b1d6ba8f3e1be77b86bd5a7fe594ea095d7cbd59
Instruction ID: f02b57b5fcc87fe4bf4072d90740ba98ec23bd4b7dafabd60244327a1cce91f6
Opcode Fuzzy Hash: fecc79f254df4aae47e0e233b1d6ba8f3e1be77b86bd5a7fe594ea095d7cbd59
Instruction Fuzzy Hash: 06E0463AA116599BDB00EF05C801ADF7731BF85719F55405AF8007B381C738AA56CBEA

Function 00445DB8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00445DBF

Part of subcall function 0040A206: __EH_prolog3_GS.LIBCMT ref: 0040A210

Part of subcall function 004416CF: __EH_prolog3_GS.LIBCMT ref: 004416D6
Part of subcall function 004416CF: GetLastError.KERNEL32 ref: 004417CB

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeH_prolog3_String$H_prolog3
String ID:
API String ID: 386487564-0
Opcode ID: 8c7b2949c25adfd6febc88452cfe2144dce6828661faca9a93e797e7aeeab533
Instruction ID: ad82337a1d8498c9fda9dab3d2770e581da9a9a6ae6aab90bc4bc22dda6bb405
Opcode Fuzzy Hash: 8c7b2949c25adfd6febc88452cfe2144dce6828661faca9a93e797e7aeeab533
Instruction Fuzzy Hash: B7D0C2A49501006ADB08BB26C8179AD37548B12354B40406FBC16472A2EA3C9A0C81EE

Function 00424A4A Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,000000FF,?), ref: 00424A65

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7480e03129df3fac912a9ff6fed4c03f29668b85ad33828d34cd4d2125ef7525
Instruction ID: db6458488ef57a30e883d92245e381ec6b2813a8f18763856d20f91cbd491ec6
Opcode Fuzzy Hash: 7480e03129df3fac912a9ff6fed4c03f29668b85ad33828d34cd4d2125ef7525
Instruction Fuzzy Hash: 7EE01A31100109FFCB00CF50D9059997F75EB46369F608199F4195A2A1C736EA12DB55

Function 00499980 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(004D9ACC,?,00000000), ref: 004999B6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: GdiplusStartup
String ID:
API String ID: 2503201367-0
Opcode ID: 2a327f9be5d65604b5ff15c4e089db689353334c3e8276dc23b8233cc7a6492a
Instruction ID: ea26eead8b7836a77eb7e2591b5877141336f56667d19392bdcc20109ac94571
Opcode Fuzzy Hash: 2a327f9be5d65604b5ff15c4e089db689353334c3e8276dc23b8233cc7a6492a
Instruction Fuzzy Hash: 7CE0E6B190525CAAEF00DB94D8157AD7FB8F700708F44459ED8545A381D7FA1D488796

Function 004143C8 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004143E3

Part of subcall function 00414360: GetTickCount.KERNEL32 ref: 0041437B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: 5cf437bda8aaeb52528c13c8388b17651a478ea91fff59105abeed7dda3aafad
Instruction ID: 326a5f9c1572425c32d823ae3865128991b2721b04a6149cc76d8c256de8869d
Opcode Fuzzy Hash: 5cf437bda8aaeb52528c13c8388b17651a478ea91fff59105abeed7dda3aafad
Instruction Fuzzy Hash: F7D01273A000315FC7459729E644899BBB8EF952107070267EC1AA76A0CA24AD05CBD0

Function 004255C5 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 004255D8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c2e13dcb8dabdec71ad626164c490c11f3133a7e6aa0b9d82655a73939fed18b
Instruction ID: 681b46218ae0bf92a9eae6c5415af3280e7488606c02b0a6fd3fb7334f15e881
Opcode Fuzzy Hash: c2e13dcb8dabdec71ad626164c490c11f3133a7e6aa0b9d82655a73939fed18b
Instruction Fuzzy Hash: F1D01736200108BBEB059B90CD06E997BA8EB09360F108264BA26850A0D772DE10DB50

Function 004018C0 Relevance: 1.5, APIs: 1, Instructions: 15registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(00000000,?,0040E7D6), ref: 004018CA

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: f799fea012a84edc50f36aa25b97e4ffd5365ad319830ffb826448f43c6a1ee4
Instruction ID: 1cdfec3ef674e3661f6546106f131251dc325d47cdf96da2ab72da1293bb1730
Opcode Fuzzy Hash: f799fea012a84edc50f36aa25b97e4ffd5365ad319830ffb826448f43c6a1ee4
Instruction Fuzzy Hash: AAD0C9B15097108BD7709F2CF9047837BE8AF04710F15896EE49AD7644D778DC818B94

Function 0043601F Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 0043602A

Part of subcall function 00435E56: DestroyWindow.USER32(00000000,?,0043603D), ref: 00435E62

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window$DestroyShow
String ID:
API String ID: 2729726617-0
Opcode ID: 7504b8c013119f4e1b726aeec646df10d0f761aedefc7ade8665ea2963c3e5b7
Instruction ID: fdd06615a915a7bfdf0783975b2dfdd26959bc4183f1c3a90812b96bb55fbc54
Opcode Fuzzy Hash: 7504b8c013119f4e1b726aeec646df10d0f761aedefc7ade8665ea2963c3e5b7
Instruction Fuzzy Hash: 83D0223150021437D3292708DC0BB9A7E498B05B50F00802BF10905A91CAA56C8083CC

Function 004195F1 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,00436FFE,?,?,00436F63), ref: 004195F6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 4306ec7187d2357b5e13697d8bf8a31138f9a0ab0ab8cdfe57863272825e2d9f
Instruction ID: bf5f633e5f98e60834b5f8e5dbcca3ba04ba7ca5700a2e126c5c761c944127af
Opcode Fuzzy Hash: 4306ec7187d2357b5e13697d8bf8a31138f9a0ab0ab8cdfe57863272825e2d9f
Instruction Fuzzy Hash: 55C08C32A28020ABEB602E29F8097F236D8EF02226F01847BE081C0118EAA04C824A84

Function 00423079 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,00000000,004410CC), ref: 0042308C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: f95fd22ccf31f664ff623ab11198e8f75ec58037075f950dfcaa5c18dde0e912
Instruction ID: ab1f11b23ac26503da2bdaa41f58fefe5ba589337fdb234d1ee5a5ea8e837844
Opcode Fuzzy Hash: f95fd22ccf31f664ff623ab11198e8f75ec58037075f950dfcaa5c18dde0e912
Instruction Fuzzy Hash: 58C012313011228AC6385E7CBC04542B7A46B41735324076EA4F0812F4D7258DC3C668

Function 0042302B Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?,004437B0,x$L,00000000,?,?,InstalledProductName,?,00000000,?,?), ref: 0042303E

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b3c698f9173e6c8734736cef93f0c14ac76c06397a7cf2397fc5a9c1994bee6c
Instruction ID: a60ed59b51d332d5b976632066922beb50b943bd1775175344db6dbae4260313
Opcode Fuzzy Hash: b3c698f9173e6c8734736cef93f0c14ac76c06397a7cf2397fc5a9c1994bee6c
Instruction Fuzzy Hash: 30C012317101218BD7304E14F80079172E45B00712F24146E908181154E7BDCFD0C654

Function 0041733D Relevance: 1.5, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00417344

Part of subcall function 004230C7: __EH_prolog3_GS.LIBCMT ref: 004230D1
Part of subcall function 004230C7: InterlockedDecrement.KERNEL32(00000000), ref: 004230E1
Part of subcall function 004230C7: CloseHandle.KERNELBASE(000000FF), ref: 00423109
Part of subcall function 004230C7: __CxxThrowException@8.LIBCMT ref: 0042314F

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeLastString$CloseDecrementException@8H_prolog3H_prolog3_HandleInterlockedThrow
String ID:
API String ID: 1651332858-0
Opcode ID: 0758daa2bfcf37c075d90abc0acc2e3149fef5dc9bec1b180f68a2869bf2cc60
Instruction ID: 7fe299c8558e17069acdbd8d68aa1afe9fc181a2a3ade186e560c4f2ba6fdcf0
Opcode Fuzzy Hash: 0758daa2bfcf37c075d90abc0acc2e3149fef5dc9bec1b180f68a2869bf2cc60
Instruction Fuzzy Hash: F7D0C7B45003108BC714BFD5D54175D72B0AF14716F50455FF54557192DBBC1508C69E

Function 00469967 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00469971

Part of subcall function 00469838: __lock.LIBCMT ref: 00469846
Part of subcall function 00469838: DecodePointer.KERNEL32(004D09F8,0000001C,0046974D,00000008,00000001,00000000,?,0046968E,000000FF,?,00462DF0,00000011,00000000,?,004649E4,0000000D), ref: 00469885
Part of subcall function 00469838: DecodePointer.KERNEL32(?,0046968E,000000FF,?,00462DF0,00000011,00000000,?,004649E4,0000000D), ref: 00469896
Part of subcall function 00469838: EncodePointer.KERNEL32(00000000,?,0046968E,000000FF,?,00462DF0,00000011,00000000,?,004649E4,0000000D), ref: 004698AF
Part of subcall function 00469838: DecodePointer.KERNEL32(-00000004,?,0046968E,000000FF,?,00462DF0,00000011,00000000,?,004649E4,0000000D), ref: 004698BF
Part of subcall function 00469838: EncodePointer.KERNEL32(00000000,?,0046968E,000000FF,?,00462DF0,00000011,00000000,?,004649E4,0000000D), ref: 004698C5
Part of subcall function 00469838: DecodePointer.KERNEL32(?,0046968E,000000FF,?,00462DF0,00000011,00000000,?,004649E4,0000000D), ref: 004698DB
Part of subcall function 00469838: DecodePointer.KERNEL32(?,0046968E,000000FF,?,00462DF0,00000011,00000000,?,004649E4,0000000D), ref: 004698E6
Part of subcall function 00469838: __initterm.LIBCMT ref: 0046990E
Part of subcall function 00469838: __initterm.LIBCMT ref: 0046991F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: c6f163fe78696c5efc1031c4b01f9c26d248b76a23488fea6940a195c8c4f54e
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: DAB012B158030C33DD103582EC03F453B0C8741B54F100021FA0C1D1E1B5E3796084CE

Function 00440AD0 Relevance: 1.3, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,?,00000000,00000000,?,00000000), ref: 00440BE4

Part of subcall function 00439FC1: __EH_prolog3_GS.LIBCMT ref: 00439FCB
Part of subcall function 00439FC1: WriteFile.KERNELBASE(?,?,?,?,00000000,00000088,0048A006,?,00000000,004AEF98,40000000,00000001,00000080,00000002,00000000,00000000), ref: 00439FEF
Part of subcall function 00439FC1: __CxxThrowException@8.LIBCMT ref: 0043A034

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorException@8FileH_prolog3_LastThrowWrite
String ID:
API String ID: 1173477686-0
Opcode ID: 6d650775f01a5b8f58256e246f7695d334ac5ce1c49cfe8779b3f608cf33a911
Instruction ID: 7df8c5537868503247552de17ac09a875e6b7df1b1944d055f9c3f2b447a0d59
Opcode Fuzzy Hash: 6d650775f01a5b8f58256e246f7695d334ac5ce1c49cfe8779b3f608cf33a911
Instruction Fuzzy Hash: C03123318001999AEF34DB64CC45BEE77B4AF40358F1042DBE929632C1EB385F84DE65

Function 00440AAC Relevance: 1.3, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,?,00000000,00000000,?,00000000), ref: 00440BE4

Part of subcall function 00448524: __EH_prolog3_GS.LIBCMT ref: 0044852E
Part of subcall function 00448524: SetFileTime.KERNEL32(?,004C2418,?,?,00000084,00440B77,?,?,?,00000000,?,00000000,00000000,?,00000000), ref: 00448544
Part of subcall function 00448524: __CxxThrowException@8.LIBCMT ref: 0044858A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorException@8FileH_prolog3_LastThrowTime
String ID:
API String ID: 771044839-0
Opcode ID: be4bad5c53a549a0115f2794aa7a5cad0b1af6a60364eb8026437903463c7096
Instruction ID: 5d5d84c4f98a1b625a6da30dfa70fd3ad9d3e32fc3ba5ec7715f02abd5fa0462
Opcode Fuzzy Hash: be4bad5c53a549a0115f2794aa7a5cad0b1af6a60364eb8026437903463c7096
Instruction Fuzzy Hash: 122101318000989FEF25DB60CC59BEE77B49F00358F1041DBE926631C2EB385F89DA65

Function 0041EFDC Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 0041EFE5

Part of subcall function 0041F059: __EH_prolog3_GS.LIBCMT ref: 0041F063
Part of subcall function 0041F059: _memset.LIBCMT ref: 0041F0A7
Part of subcall function 0041F059: LoadLibraryW.KERNEL32(?,?,?), ref: 0041F0CB
Part of subcall function 0041F059: GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExW), ref: 0041F0F8
Part of subcall function 0041F059: lstrcpyW.KERNEL32(?,00000000,?,?,?), ref: 0041F11F
Part of subcall function 0041F059: lstrcatW.KERNEL32(?,004AD878), ref: 0041F131
Part of subcall function 0041F059: GetDiskFreeSpaceExW.KERNELBASE(00000000,?,?), ref: 0041F190
Part of subcall function 0041F059: GetLastError.KERNEL32 ref: 0041F19C
Part of subcall function 0041F059: GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0041F201

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: DiskFreeSpace$AddressErrorH_prolog3_LastLibraryLoadProc_memsetlstrcatlstrcpylstrlen
String ID:
API String ID: 1247970913-0
Opcode ID: 02ba2fcc388fa1e75438bb1d62242ad3cb144abaf0f356cb1d43149a56c48e2e
Instruction ID: 5ffe88024c48201753914a7d09753c25d32d9e9bc1af4f0dd39d71094da7b10b
Opcode Fuzzy Hash: 02ba2fcc388fa1e75438bb1d62242ad3cb144abaf0f356cb1d43149a56c48e2e
Instruction Fuzzy Hash: 1E112AB5A0020AEFCF01CFA8C840ADA7BF9AF49354F104166EC21D7291E775D946CB90

Function 00440B7F Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 0041733D: __EH_prolog3.LIBCMT ref: 00417344

GetLastError.KERNEL32(?,?,00000000,?,00000000,00000000,?,00000000), ref: 00440BE4

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3
String ID:
API String ID: 746121330-0
Opcode ID: c5b09e3d853659004973ba65275d9bc30d025ce032d686ddd355f3baa6019f33
Instruction ID: 2bd61cf2befbc1f56f5ada846ab7a4f7f4745087a5a60316a991ffb65dffce95
Opcode Fuzzy Hash: c5b09e3d853659004973ba65275d9bc30d025ce032d686ddd355f3baa6019f33
Instruction Fuzzy Hash: FE01B1318000589EEF25AB70C85A7AC77B4AF04364F50459EE826631D2EA381B84DA65

Function 00423166 Relevance: 1.3, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,00417393,00000004,004178C7), ref: 0042317E

Part of subcall function 0042318E: InterlockedDecrement.KERNEL32(004D8A58), ref: 004231B3

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CloseDecrementHandleInterlocked
String ID:
API String ID: 2217748519-0
Opcode ID: ef7e2962b111da5972e17ac17b680d4ac666843c3097d5840075fee9dbb3bf7a
Instruction ID: c3f605a1b07291f0add71b4594925122251902d46c7462e2bf63461963a58654
Opcode Fuzzy Hash: ef7e2962b111da5972e17ac17b680d4ac666843c3097d5840075fee9dbb3bf7a
Instruction Fuzzy Hash: 05D01230601B109BD6345E15A50566277E45F05B36B44471E94FB419E087385811C608

Function 00405170 Relevance: 1.3, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00417486), ref: 00405183

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fce206eb609e2b2d80561706fd6c6e2faebf75c6594c81ca4bb65d23e215b390
Instruction ID: 2f9086f69c1ac430a9beca67ed33fc99160ab1a00c0e5d0f2c09351d2edf3a13
Opcode Fuzzy Hash: fce206eb609e2b2d80561706fd6c6e2faebf75c6594c81ca4bb65d23e215b390
Instruction Fuzzy Hash: 70C01230A055115EDB788F19A85077323D49F48300F14057E9C41D7380C674CC418B58

Function 004501A8 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000001,?,004500E5,00000001,00000000,?,?,00450002,00000001,00000001), ref: 004501AE

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b851a24113de4c9abeec6ff1d97faa720085ddb2866283ec73f42b889e715237
Instruction ID: 40cf7a7344efe0c1c12ca0a00fa63d26a7d6f001dc8eedc2f7a67a9be4636eda
Opcode Fuzzy Hash: b851a24113de4c9abeec6ff1d97faa720085ddb2866283ec73f42b889e715237
Instruction Fuzzy Hash: 45B0123800414CBFCF011F51EC044E8BF6CDA0A164F04C061FC5D05622C7329511DB95

Non-executed Functions

Function 00490400 Relevance: 174.7, APIs: 80, Strings: 19, Instructions: 1483stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00403FB0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,004AB968,000000FF), ref: 00403FF3
Part of subcall function 00403FB0: SetLastError.KERNEL32(?,004C2254,00000000,?,?,?,?,?,004AB968,000000FF), ref: 00404068

Part of subcall function 00490110: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000002,?,?,0048A101,?,00000000,00000103), ref: 00490136
Part of subcall function 00490110: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000,?,?), ref: 0049017E

GetPrivateProfileIntA.KERNEL32(?,BUTTONS,00000000,00000000), ref: 004904FA
_memset.LIBCMT ref: 0049052A
_memset.LIBCMT ref: 0049053B
_memset.LIBCMT ref: 00490555
_memset.LIBCMT ref: 0049056F
_memset.LIBCMT ref: 00490589
GetSysColor.USER32(00000008), ref: 00490599
GetSysColor.USER32(00000011), ref: 0049059D
GetLastError.KERNEL32 ref: 004905D5
SetLastError.KERNEL32(004C2480), ref: 00490622
GetLastError.KERNEL32 ref: 00490638
SetLastError.KERNEL32(004C2480), ref: 0049067F

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

lstrcpyA.KERNEL32(00000000,00000000,?,00000000,00000000,ALL,00000003,004B0A1C,00000000,00000001), ref: 004908A3
lstrcpyA.KERNEL32(00000000,00000000,00000000), ref: 004908D3

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

lstrcpyA.KERNEL32(00000000,BUTTON,00000000), ref: 004909BB
__itow.LIBCMT ref: 004909CC
lstrcatA.KERNEL32(00000000,00000000), ref: 004909DC
GetLastError.KERNEL32 ref: 004909F6
SetLastError.KERNEL32(,)L,004C2254,004C2252), ref: 00490A8A
GetPrivateProfileIntA.KERNEL32(?,?,00000000,00000000), ref: 00490B09
GetLastError.KERNEL32 ref: 00490B26
SysFreeString.OLEAUT32(?), ref: 00490B48
SysFreeString.OLEAUT32(?), ref: 00490B59

Part of subcall function 00485E80: GetLastError.KERNEL32(00000000,004924C7,?,?,?,?,?,?,?,?,?,F14A3287,?,000001A4,00000000), ref: 00485E91
Part of subcall function 00485E80: SetLastError.KERNEL32(53746547,?,?,?,?,?,?,?,?,?,F14A3287,?,000001A4,00000000), ref: 00485EC1
Part of subcall function 00485E80: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,F14A3287,?,000001A4,00000000), ref: 00485ED5
Part of subcall function 00485E80: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,F14A3287,?,000001A4,00000000), ref: 00485F05

SetLastError.KERNEL32(?), ref: 00490B88
lstrcpyA.KERNEL32(?,?), ref: 00490B99
lstrcatA.KERNEL32(?,004BC234), ref: 00490BA8
GetLastError.KERNEL32(?,00000104), ref: 00490BDE
SetLastError.KERNEL32(004C292C,004C2254,004C2252), ref: 00490C7A
GetPrivateProfileStringA.KERNEL32(00000000,?,004C20A8,00000000,00000104,?), ref: 00490D1A
GetLastError.KERNEL32 ref: 00490D31
SysFreeString.OLEAUT32(00000000), ref: 00490D53
SysFreeString.OLEAUT32(?), ref: 00490D64
SetLastError.KERNEL32(004C2428), ref: 00490D93
GetLastError.KERNEL32(?,?,00000000), ref: 00490E11
SysFreeString.OLEAUT32(00000000), ref: 00490E2D
SysFreeString.OLEAUT32(?), ref: 00490E3E
SetLastError.KERNEL32(004AD954), ref: 00490E6D
lstrcpyA.KERNEL32(?,?), ref: 00490E7E
lstrcatA.KERNEL32(?,DOWN), ref: 00490E8D
GetLastError.KERNEL32(?,00000104), ref: 00490EC3
SetLastError.KERNEL32(004C292C,004C2254,004C2252), ref: 00490F5A
GetPrivateProfileStringA.KERNEL32(00000000,?,004C20A8,00000000,00000104,?), ref: 00490FFA
GetLastError.KERNEL32 ref: 00491011
SysFreeString.OLEAUT32(00000000), ref: 00491033
SysFreeString.OLEAUT32(?), ref: 00491044
SetLastError.KERNEL32(004C2428), ref: 00491073
GetLastError.KERNEL32(?,?,00000000), ref: 004910ED
SysFreeString.OLEAUT32(00000000), ref: 00491109
SysFreeString.OLEAUT32(?), ref: 0049111A
SetLastError.KERNEL32(004AD954), ref: 0049114F
lstrcpyA.KERNEL32(?,?), ref: 00491164
lstrcatA.KERNEL32(?,POS), ref: 00491173
GetLastError.KERNEL32 ref: 0049118D
SetLastError.KERNEL32(004C292C,004C2254,004C2252), ref: 0049122A
GetPrivateProfileStringA.KERNEL32(00000000,?,004C20A8,?,000003E8,00000000), ref: 004912B1
GetLastError.KERNEL32 ref: 004912CC
SysFreeString.OLEAUT32(00000000), ref: 004912EE
SysFreeString.OLEAUT32(?), ref: 004912FF
SetLastError.KERNEL32(004C2428), ref: 0049132E
lstrcmpA.KERNEL32(?,004C20A8), ref: 00491352
lstrcpyA.KERNEL32(?,?), ref: 00491395
lstrcatA.KERNEL32(?,OPT), ref: 004913A4
GetPrivateProfileStringA.KERNEL32(00000000,?,004C20A8,?,000003E8,00000000), ref: 0049145D
lstrcmpA.KERNEL32(?,004C20A8), ref: 0049147E

Part of subcall function 004857A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,?,?,?,004AA621,000000FF,?,00489525,?,?,00000001), ref: 004857F4
Part of subcall function 004857A0: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,004AA621,000000FF,?,00489525,?,?,00000001), ref: 0048582D

Part of subcall function 0048F6D0: GetLastError.KERNEL32(004B064C,00000001,00000001,?,?,75C0E860,00000000,?,?,?,?,?,?,00000000,004AACF0,000000FF), ref: 0048F856
Part of subcall function 0048F6D0: SysFreeString.OLEAUT32(004AACF0), ref: 0048F872
Part of subcall function 0048F6D0: SysFreeString.OLEAUT32(00000000), ref: 0048F87D
Part of subcall function 0048F6D0: SetLastError.KERNEL32(75C0E860,?,?,?,75C0E860,00000000), ref: 0048F89D

lstrcpyA.KERNEL32(?,?,?,?,00000001), ref: 004914CD
lstrcatA.KERNEL32(?,TRNSPRNTCLR,?,?,?,?,?,?,?,?,?,?,?,00000078), ref: 004914DC
GetPrivateProfileStringA.KERNEL32(00000000,?,004C20A8,?,000003E8,00000000), ref: 00491595
lstrcmpA.KERNEL32(?,004C20A8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000078), ref: 004915B6
lstrcpyA.KERNEL32(?,?,?,?,00000001), ref: 00491605
lstrcatA.KERNEL32(?,TXTCLR,?,?,?,?,?,?,?,?,?,?,?,0000006C), ref: 00491614
GetPrivateProfileStringA.KERNEL32(00000000,?,004C20A8,?,000003E8,00000000), ref: 004916CD
lstrcmpA.KERNEL32(?,004C20A8,?,?,?,?,?,?,?,?,?,?,?,?,?,0000006C), ref: 004916EE
GetSysColor.USER32(00000008), ref: 00491708
lstrcpyA.KERNEL32(?,?,?,?,00000001), ref: 00491741
lstrcatA.KERNEL32(?,DISTXTCLR), ref: 00491750
GetPrivateProfileStringA.KERNEL32(00000000,?,004C20A8,?,000003E8,00000000), ref: 00491809
lstrcmpA.KERNEL32(?,004C20A8), ref: 0049182A
GetSysColor.USER32(00000011), ref: 00491844

Part of subcall function 00407F60: _memmove.LIBCMT ref: 00408015

wsprintfA.USER32 ref: 00491884
wsprintfA.USER32 ref: 004919DA

Part of subcall function 0045BD01: std::exception::exception.LIBCMT ref: 0045BD35
Part of subcall function 0045BD01: __CxxThrowException@8.LIBCMT ref: 0045BD4A

Part of subcall function 00485C00: _memset.LIBCMT ref: 00485C11
Part of subcall function 00485C00: _memset.LIBCMT ref: 00485C25

Strings

T"L, xrefs: 0049044A
DISTXTCLR, xrefs: 00491747
T"L, xrefs: 00490ED7
T"L, xrefs: 00490A06
T"L, xrefs: 00490BF2
TXTCLR, xrefs: 0049160B
T"L, xrefs: 004919F4
($L, xrefs: 004904E1
T"L, xrefs: 004911A1
DOWN, xrefs: 00490E84
P$L, xrefs: 0049078B, 00490791
P$L, xrefs: 00491B96
BUTTON, xrefs: 004909AF
POS, xrefs: 0049116A
,)L, xrefs: 00490A5C
OPT, xrefs: 0049139B
ALL, xrefs: 00490740, 00490762, 00490798, 004907F2
TRNSPRNTCLR, xrefs: 004914D3
BUTTONS, xrefs: 004904EF

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$String$Free$lstrcpy$PrivateProfile$lstrcat$_memset$lstrcmp$Color$ByteCharMultiWidewsprintf$Exception@8Throw__itow_malloc_memmovestd::exception::exception
String ID: ($L$,)L$ALL$BUTTON$BUTTONS$DISTXTCLR$DOWN$OPT$P$L$P$L$POS$T"L$T"L$T"L$T"L$T"L$T"L$TRNSPRNTCLR$TXTCLR
API String ID: 1098502464-1122356526
Opcode ID: e1d1010d61a25efe0bef0cb797f91e5cf8c4b17c4a5f6d5d3da621300857e94a
Instruction ID: 927226a4d1c1a0346f491065b209258ef8075af75fa730b6d5ff4a2d4cc2101d
Opcode Fuzzy Hash: e1d1010d61a25efe0bef0cb797f91e5cf8c4b17c4a5f6d5d3da621300857e94a
Instruction Fuzzy Hash: FCE26871E002299FDF60EF60DC45BADBBB9BB44304F0041EAE509A3291DB75AE94CF95

Function 0044E37D Relevance: 94.6, APIs: 27, Strings: 27, Instructions: 122libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wininet.dll,?,00416ABF,?,000000FF,000000FF,?,00423F61,000000FF,00000000,80400100,?,00000000,004411B3,004AEF98,80000000), ref: 0044E392
GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 0044E3B2
GetProcAddress.KERNEL32(InternetOpenUrlW), ref: 0044E3C4
GetProcAddress.KERNEL32(InternetConnectW), ref: 0044E3D6
GetProcAddress.KERNEL32(InternetCrackUrlW), ref: 0044E3E8
GetProcAddress.KERNEL32(InternetCreateUrlW), ref: 0044E3FA
GetProcAddress.KERNEL32(InternetGetLastResponseInfoW), ref: 0044E40C
GetProcAddress.KERNEL32(InternetSetOptionW), ref: 0044E41E
GetProcAddress.KERNEL32(HttpQueryInfoW), ref: 0044E430
GetProcAddress.KERNEL32(HttpOpenRequestW), ref: 0044E442
GetProcAddress.KERNEL32(HttpSendRequestW), ref: 0044E454
GetProcAddress.KERNEL32(HttpSendRequestExW), ref: 0044E466
GetProcAddress.KERNEL32(HttpEndRequestW), ref: 0044E478
GetProcAddress.KERNEL32(InternetQueryOptionW), ref: 0044E48A
GetProcAddress.KERNEL32(InternetCanonicalizeUrlW), ref: 0044E49C
GetProcAddress.KERNEL32(InternetGetCookieW), ref: 0044E4AE
GetProcAddress.KERNEL32(InternetSetCookieW), ref: 0044E4C0
GetProcAddress.KERNEL32(InternetFindNextFileW), ref: 0044E4D2
GetProcAddress.KERNEL32(FtpFindFirstFileA), ref: 0044E4E4
GetProcAddress.KERNEL32(InternetSetStatusCallbackW), ref: 0044E4F6
GetProcAddress.KERNEL32(InternetSetStatusCallback), ref: 0044E50C
GetProcAddress.KERNEL32(InternetCloseHandle), ref: 0044E51E
GetProcAddress.KERNEL32(InternetReadFile), ref: 0044E530
GetProcAddress.KERNEL32(InternetGetConnectedState), ref: 0044E542
GetProcAddress.KERNEL32(InternetAutodial), ref: 0044E554
GetProcAddress.KERNEL32(InternetErrorDlg), ref: 0044E566
GetProcAddress.KERNEL32(InternetQueryDataAvailable), ref: 0044E578

Strings

HttpSendRequestExW, xrefs: 0044E456
wininet.dll, xrefs: 0044E38D
HttpOpenRequestW, xrefs: 0044E432
HttpSendRequestW, xrefs: 0044E444
InternetQueryDataAvailable, xrefs: 0044E568
InternetOpenUrlW, xrefs: 0044E3B4
InternetFindNextFileW, xrefs: 0044E4C2
InternetErrorDlg, xrefs: 0044E556
HttpEndRequestW, xrefs: 0044E468
HttpQueryInfoW, xrefs: 0044E420
InternetSetCookieW, xrefs: 0044E4B0
InternetReadFile, xrefs: 0044E520
InternetCanonicalizeUrlW, xrefs: 0044E48C
InternetCrackUrlW, xrefs: 0044E3D8
InternetConnectW, xrefs: 0044E3C6
InternetQueryOptionW, xrefs: 0044E47A
InternetGetCookieW, xrefs: 0044E49E
FtpFindFirstFileA, xrefs: 0044E4D4
InternetCreateUrlW, xrefs: 0044E3EA
InternetGetConnectedState, xrefs: 0044E532
InternetOpenW, xrefs: 0044E3AC
InternetAutodial, xrefs: 0044E544
InternetGetLastResponseInfoW, xrefs: 0044E3FC
InternetSetStatusCallback, xrefs: 0044E501
InternetCloseHandle, xrefs: 0044E513
InternetSetStatusCallbackW, xrefs: 0044E4E6
InternetSetOptionW, xrefs: 0044E40E

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: FtpFindFirstFileA$HttpEndRequestW$HttpOpenRequestW$HttpQueryInfoW$HttpSendRequestExW$HttpSendRequestW$InternetAutodial$InternetCanonicalizeUrlW$InternetCloseHandle$InternetConnectW$InternetCrackUrlW$InternetCreateUrlW$InternetErrorDlg$InternetFindNextFileW$InternetGetConnectedState$InternetGetCookieW$InternetGetLastResponseInfoW$InternetOpenUrlW$InternetOpenW$InternetQueryDataAvailable$InternetQueryOptionW$InternetReadFile$InternetSetCookieW$InternetSetOptionW$InternetSetStatusCallback$InternetSetStatusCallbackW$wininet.dll
API String ID: 2238633743-1703109126
Opcode ID: c5b89067ad80a1af889bf719d0c3505af3c6c239247fe5428c526b3ccde68316
Instruction ID: 7763bfcdbef78f28928fce06390b365a60ac058372742c37a0330a633aec1850
Opcode Fuzzy Hash: c5b89067ad80a1af889bf719d0c3505af3c6c239247fe5428c526b3ccde68316
Instruction Fuzzy Hash: DA4126B0E53714BACB12AF72AC1AA7BBFA9E704758310447FA88492770DE798011DF5D

Function 00489BF0 Relevance: 84.9, APIs: 39, Strings: 9, Instructions: 884stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00489C68
SetLastError.KERNEL32(004AD95C), ref: 00489CB3
_memset.LIBCMT ref: 00489CFF
lstrcpyA.KERNEL32(?,NO DOUBT), ref: 00489D13
_memset.LIBCMT ref: 00489D2F
lstrcpyW.KERNEL32(?,?), ref: 00489D3F
lstrlenA.KERNEL32 ref: 00489D79
_memset.LIBCMT ref: 00489DB5
lstrcpyA.KERNEL32(?,?,?,00000000,00000103,?,?,?,00000000,?), ref: 00489DD1
lstrlenA.KERNEL32(?,?,?,?,00000000,?), ref: 00489DDE
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,00000000,?), ref: 00489DFB
_memmove.LIBCMT ref: 00489E1C
lstrcmpiA.KERNEL32(?,skin.ini), ref: 00489E3E
GetLastError.KERNEL32 ref: 00489F46
SetLastError.KERNEL32(004AEFA0,?,00000000,000000FF), ref: 00489FB6

Part of subcall function 00423E83: __EH_prolog3.LIBCMT ref: 00423E8A

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00439FC1: __EH_prolog3_GS.LIBCMT ref: 00439FCB
Part of subcall function 00439FC1: WriteFile.KERNELBASE(?,?,?,?,00000000,00000088,0048A006,?,00000000,004AEF98,40000000,00000001,00000080,00000002,00000000,00000000), ref: 00439FEF
Part of subcall function 00439FC1: __CxxThrowException@8.LIBCMT ref: 0043A034

_memmove.LIBCMT ref: 0048A08A
GetPrivateProfileIntA.KERNEL32(SKINS,VERSION,00000001,00000000), ref: 0048A10E
_memset.LIBCMT ref: 0048A167
lstrcpyA.KERNEL32(?,TEXTCOLOR,00000063,ALL,00000003,?,?,?,?,?,?,?,00000000,?), ref: 0048A17B
GetPrivateProfileStringA.KERNEL32(ALL,?,004C20A8,?,00000064,00000000), ref: 0048A1A4
GetSysColor.USER32(00000008), ref: 0048A1B2

Part of subcall function 00403FB0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,004AB968,000000FF), ref: 00403FF3
Part of subcall function 00403FB0: SetLastError.KERNEL32(?,004C2254,00000000,?,?,?,?,?,004AB968,000000FF), ref: 00404068

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

_memset.LIBCMT ref: 0048A27A
_memset.LIBCMT ref: 0048A28B

Part of subcall function 00490110: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000002,?,?,0048A101,?,00000000,00000103), ref: 00490136
Part of subcall function 00490110: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000,?,?), ref: 0049017E

GetPrivateProfileSectionNamesA.KERNEL32(?,00000C00,00000000), ref: 0048A2A8
lstrcpyA.KERNEL32(00000000,?), ref: 0048A2C8
lstrlenA.KERNEL32(?), ref: 0048A2CB

Part of subcall function 004857A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,?,?,?,004AA621,000000FF,?,00489525,?,?,00000001), ref: 004857F4
Part of subcall function 004857A0: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,004AA621,000000FF,?,00489525,?,?,00000001), ref: 0048582D

lstrcpyA.KERNEL32 ref: 0048A3A6
GetPrivateProfileStringA.KERNEL32(00000000,00000000,004C20A8,00000000,00000064,00000000), ref: 0048A3CA
GetSysColor.USER32(00000008), ref: 0048A3D8
GetLastError.KERNEL32(ALL-,00000000,00000004,00000000,?,00000001), ref: 0048A598
SysFreeString.OLEAUT32(?), ref: 0048A5BA
SysFreeString.OLEAUT32(?), ref: 0048A5CB
SetLastError.KERNEL32(?), ref: 0048A5FA

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyA.KERNEL32(00000000,?), ref: 0048A61E
lstrlenA.KERNEL32(?), ref: 0048A625
lstrcmpA.KERNEL32(SKINS,00000000,ALL,00000000,00000003,00000000,?,00000001), ref: 0048A670
lstrcpyA.KERNEL32 ref: 0048A716
GetPrivateProfileStringA.KERNEL32(00000000,00000000,004C20A8,00000000,00000064,00000000), ref: 0048A73E

Strings

NO DOUBT, xrefs: 00489D0D
ALL, xrefs: 0048A19F
ALL, xrefs: 0048A141, 0048A1E3, 0048A1F6, 0048A209, 0048A216, 0048A22B, 0048A64A
SKINS, xrefs: 0048A109, 0048A66B
VERSION, xrefs: 0048A104
TEXTCOLOR, xrefs: 0048A175, 0048A38C, 0048A6FC
GetThemeAppProperties, xrefs: 0048A8DD
skin.ini, xrefs: 00489E30
ALL-, xrefs: 0048A2F6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$String$Freelstrcpy$_memset$PrivateProfilelstrlen$ByteCharColorMultiWide_memmove$Exception@8FileH_prolog3H_prolog3_NamesSectionThrowWritelstrcmplstrcmpi
String ID: ALL$ALL$ALL-$GetThemeAppProperties$NO DOUBT$SKINS$TEXTCOLOR$VERSION$skin.ini
API String ID: 2276469943-3254620179
Opcode ID: 7aeef1bcaa4247b22e83cfa78fb6e639b76838c04647147f277d466f4fe40a10
Instruction ID: 48366e80d283997663a4959b02a1cecdfda28219ea6577cbb32c10be44dbb138
Opcode Fuzzy Hash: 7aeef1bcaa4247b22e83cfa78fb6e639b76838c04647147f277d466f4fe40a10
Instruction Fuzzy Hash: DF82A771900158EEEB10EBA1CD45BDDB7B8AF15304F0440EBE549E7182DBB85B98CF66

Function 0049D5C4 Relevance: 53.9, APIs: 35, Instructions: 1384COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0049D650
__whiteout.LIBCMT ref: 0049D6BF

Part of subcall function 0045D096: __getptd_noexit.LIBCMT ref: 0045D096

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Locale$UpdateUpdate::___getptd_noexit__whiteout
String ID:
API String ID: 4052982633-0
Opcode ID: 24e9c63a5e9074c061ca3e0c4e1ef8a61b650a843f7480391dea7ab94546e863
Instruction ID: bd513669fd124e98eeb80bee946b9ab5fa602407da3e514369ed0d76ff029fe1
Opcode Fuzzy Hash: 24e9c63a5e9074c061ca3e0c4e1ef8a61b650a843f7480391dea7ab94546e863
Instruction Fuzzy Hash: 19B2AE71D012698BDF35DB16CC88BAEBBB4AB04314F1441FBE449A7291DA385EC1CF18

Function 0049C169 Relevance: 53.8, APIs: 35, Instructions: 1338COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0049C1F5
__whiteout.LIBCMT ref: 0049C260

Part of subcall function 0045D096: __getptd_noexit.LIBCMT ref: 0045D096

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Locale$UpdateUpdate::___getptd_noexit__whiteout
String ID:
API String ID: 4052982633-0
Opcode ID: 27d027f2141ba72b7bf3b1df7f8cea2c36e622d5bdeb6a947a25f72014f55c66
Instruction ID: af83b6e773331156c54ba6018437cb880d6eda6fc1a69d3ccd17ef0420b88e4e
Opcode Fuzzy Hash: 27d027f2141ba72b7bf3b1df7f8cea2c36e622d5bdeb6a947a25f72014f55c66
Instruction Fuzzy Hash: 47B29C71D452698BDF359B15CCD8BAEBBB4AB44310F1441FBE449A7281DA389EC1CF48

Function 0046802F Relevance: 34.5, APIs: 18, Strings: 1, Instructions: 1277COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0046808A

Part of subcall function 0045D096: __getptd_noexit.LIBCMT ref: 0045D096

_memset.LIBCMT ref: 00468234

Strings

X, xrefs: 00468122

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Locale$UpdateUpdate::___getptd_noexit_memset
String ID: X
API String ID: 2502719891-3081909835
Opcode ID: 8f3910c5be9f97a3047fa22dcf757c430ed26a0e0da65e90c42adb093cb5e086
Instruction ID: 16641e803e6b19b84e80b991d27f93c0e2fc18c5ab84899fc5b53dca8771dc93
Opcode Fuzzy Hash: 8f3910c5be9f97a3047fa22dcf757c430ed26a0e0da65e90c42adb093cb5e086
Instruction Fuzzy Hash: 5EB26F71B007299ADB248B18CC447AAB3B5BB56314F2446DFD409E7690EB799EC1CF0B

Function 004785C3 Relevance: 30.5, APIs: 15, Strings: 2, Instructions: 773COMMON

Download Yara Rule

APIs

__cftof.LIBCMT ref: 0047879A
__aulldvrm.LIBCMT ref: 00478E14
_write_multi_char.LIBCMT ref: 00478F91
_write_string.LIBCMT ref: 00478FBA
_write_multi_char.LIBCMT ref: 00478FDC
__cftof.LIBCMT ref: 00479014
_write_string.LIBCMT ref: 00479045
_write_string.LIBCMT ref: 00479079
_write_multi_char.LIBCMT ref: 004790A5
_free.LIBCMT ref: 004790BC

Strings

g, xrefs: 00478AFE
, xrefs: 00478F51

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _write_multi_char_write_string$__cftof$__aulldvrm_free
String ID: $g
API String ID: 4283718489-3845294767
Opcode ID: dde16efa9ac0b51e80d2235e314f37e1a442f29b741dd8a13c6af7cfe7b90a39
Instruction ID: 24c1886e7ae9a1df44fb5c1963380b424f68bfff4e30f142fd99f30d4d99dda0
Opcode Fuzzy Hash: dde16efa9ac0b51e80d2235e314f37e1a442f29b741dd8a13c6af7cfe7b90a39
Instruction Fuzzy Hash: 27528F719842188AEB258A18CC487EAB7F5FB50314F29C0DFD58DA7291DF399D81CF89

Function 0045439B Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 245encryptionCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004543A5
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000,00000720), ref: 004543D7
GetLastError.KERNEL32 ref: 004543E1
CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 0045440C
GetLastError.KERNEL32 ref: 00454416

Strings

ISc(, xrefs: 0045448D

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CryptErrorLast$AcquireContextCreateH_prolog3_Hash
String ID: ISc(
API String ID: 4253850778-3536308444
Opcode ID: 9a924bbc29d79527f0722a5d516b37c81220a739f85d85ab7f69409a24a740c0
Instruction ID: 7f39d4406a34bd63d360ba4070beaf9b48168aa9a3ba0496f7a3b86336697c8a
Opcode Fuzzy Hash: 9a924bbc29d79527f0722a5d516b37c81220a739f85d85ab7f69409a24a740c0
Instruction Fuzzy Hash: E5A16470D04118EFDB20DB65DC80BDA77B4EB55349F0041DAEA09A7282DA7C5E88CF6A

Function 00475701 Relevance: 21.5, APIs: 14, Instructions: 537COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c10ca0d9039156769c1e23c520f3cb003886d7a4d28a6bafa1775733bf10c0
Instruction ID: ef9c7c33b191002cbe0f2971da5642181a8951c5b249c388eabb8893da977af6
Opcode Fuzzy Hash: a0c10ca0d9039156769c1e23c520f3cb003886d7a4d28a6bafa1775733bf10c0
Instruction Fuzzy Hash: A1326175B026188FCB24CF14DD806EAB7B5FB46314F0481EAE40AEBA85D7749E81CF56

Function 0045145E Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 125filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00451468

Part of subcall function 00450728: __EH_prolog3_GS.LIBCMT ref: 00450732
Part of subcall function 00450728: GetFileAttributesW.KERNEL32(00000000,00000084,0045147A,?,000002E0,0048A8CC,?,00000001), ref: 00450746
Part of subcall function 00450728: __CxxThrowException@8.LIBCMT ref: 0045078B

FindFirstFileW.KERNEL32(-00000004,?,0048A8CC,?,00000001), ref: 004514AE
lstrcmpW.KERNEL32(?,004ADC90), ref: 004514E5
lstrcmpW.KERNEL32(?,004B5100), ref: 004514FB
FindNextFileW.KERNEL32(00000000,?), ref: 00451561
RemoveDirectoryW.KERNEL32(?), ref: 00451589
__CxxThrowException@8.LIBCMT ref: 004515CF
DeleteFileW.KERNEL32(?,000002E0,0048A8CC,?,00000001), ref: 004515E0

Part of subcall function 0045042B: __EH_prolog3_GS.LIBCMT ref: 00450432

Strings

*.*, xrefs: 00451483

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: File$H_prolog3_$Exception@8FindThrowlstrcmp$AttributesDeleteDirectoryFirstNextRemove
String ID: *.*
API String ID: 1087441661-438819550
Opcode ID: 98fde6e921c8d1319cc1af667bb9aff2703fc900c3a885b74a747dc957b8058f
Instruction ID: 2f5e952aa387819ead6f85934c876493f94039b6a660d4eeaad9310dc7eb85b9
Opcode Fuzzy Hash: 98fde6e921c8d1319cc1af667bb9aff2703fc900c3a885b74a747dc957b8058f
Instruction Fuzzy Hash: 4F414075900218EFCF10EFA0C889BDE777CAF15305F44416AF906A2152EB789B49CBA9

Function 00469E2F Relevance: 15.2, APIs: 10, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetLocaleInfoA.LIBCMT ref: 00469E81

Part of subcall function 00479E97: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00479EA3
Part of subcall function 00479E97: __crtGetLocaleInfoA_stat.LIBCMT ref: 00479EB8

GetLastError.KERNEL32(?,?,?,00000000,00000000), ref: 00469E93
___crtGetLocaleInfoA.LIBCMT ref: 00469EB3
___crtGetLocaleInfoA.LIBCMT ref: 00469EF5
__calloc_crt.LIBCMT ref: 00469EC8

Part of subcall function 004699AC: __calloc_impl.LIBCMT ref: 004699BB
Part of subcall function 004699AC: Sleep.KERNEL32(00000000,?,00464954,00000001,000003BC), ref: 004699D2

__calloc_crt.LIBCMT ref: 00469F0A
_free.LIBCMT ref: 00469F22
_free.LIBCMT ref: 00469F60
__calloc_crt.LIBCMT ref: 00469F8A
_free.LIBCMT ref: 00469FB0

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Locale$Info$___crt__calloc_crt_free$A_statErrorLastSleepUpdateUpdate::___calloc_impl__crt
String ID:
API String ID: 1073277423-0
Opcode ID: 142010f86b8d6a3298526d768474f4900a62d51d91fbdc33238c990ecc540be4
Instruction ID: 67dedebe9bcf58bda81f17e73ec00df18c4c78a20d6fd20b6de1e673b8c243f7
Opcode Fuzzy Hash: 142010f86b8d6a3298526d768474f4900a62d51d91fbdc33238c990ecc540be4
Instruction Fuzzy Hash: F251CAB1904216AFEF289F658C41BAB7BBDEF14314F11409AF808D2241FB79CD54CB66

Function 00444E65 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108processCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00444E6F

Part of subcall function 0041502B: __EH_prolog3_GS.LIBCMT ref: 00415032

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000003B,00000000,?,00000001,00000284), ref: 00444ED2
GetLastError.KERNEL32(00000002,00000000,0000003B,00000000,?,00000001,00000284), ref: 00444EE8
Process32FirstW.KERNEL32 ref: 00444F07
Process32NextW.KERNEL32(00000000,?), ref: 00444F83

Strings

x$L, xrefs: 00444F39, 00444F3C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_Process32$CreateErrorFirstLastNextSnapshotToolhelp32
String ID: x$L
API String ID: 3102987474-723586279
Opcode ID: 28006bd9456784299685cfee98dedc6bc3269de409131c4ce81b34a91348ad69
Instruction ID: b4c611cc5bc9e0f66e46df82208260fde3148275cb725b76604c1c57bb105f52
Opcode Fuzzy Hash: 28006bd9456784299685cfee98dedc6bc3269de409131c4ce81b34a91348ad69
Instruction Fuzzy Hash: 8F418D75C051289AEF60EBA5CC49BDEFBB8AF94304F1041EBE409A3291DB745E84CF65

Function 0046E327 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 0046E33E
_wcscmp.LIBCMT ref: 0046E34F
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0046E5ED,?,00000000), ref: 0046E36B
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0046E5ED,?,00000000), ref: 0046E395

Strings

OCP, xrefs: 0046E349
ACP, xrefs: 0046E338

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: e5123206d9eb8ac16ff5504c8350a41144c0c74f01cb7df033be7834293a7e74
Instruction ID: d1dc77d1c3d4a36667a8898e6aa22d11f6b3bf6f6f71edb7a61a73c9207dac5e
Opcode Fuzzy Hash: e5123206d9eb8ac16ff5504c8350a41144c0c74f01cb7df033be7834293a7e74
Instruction Fuzzy Hash: 8201963A600215BADB109E56DC45FDB37D8AF01755B144027FD05DB660F728DAC1879F

Function 00454269 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81encryptionCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00454273
CertOpenSystemStoreW.CRYPT32(00000000,ROOT), ref: 0045429F
GetLastError.KERNEL32 ref: 004542C8
CertOpenSystemStoreW.CRYPT32(00000000,004B6714), ref: 004542DC

Strings

ROOT, xrefs: 00454298

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CertOpenStoreSystem$ErrorH_prolog3_Last
String ID: ROOT
API String ID: 318785938-543233263
Opcode ID: ca649379324e090faed1c74045fe596dce56e9bcf4f70e9a71df704048199049
Instruction ID: 9e0f64f7194c0cec27b9920d9de436e5db8e7ffd7c78a7a586fc17cb871cdd3e
Opcode Fuzzy Hash: ca649379324e090faed1c74045fe596dce56e9bcf4f70e9a71df704048199049
Instruction Fuzzy Hash: 2631A930B403289FDF249B618C55BAD7670AB4570AF1040DBED0AA73D3D6785E88CF5A

Function 0046E00C Relevance: 6.2, APIs: 4, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 00464914: __getptd_noexit.LIBCMT ref: 00464915
Part of subcall function 00464914: __amsg_exit.LIBCMT ref: 00464922

GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 0046E065
GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 0046E0B2
GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 0046E162

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: InfoLocale$__amsg_exit__getptd_noexit
String ID:
API String ID: 41668988-0
Opcode ID: 74b6871bb2595d09c76e53c6e0fce5db1b9a73d854c8c40bbc52c5006492f66d
Instruction ID: cf9369c7ba7adcc29ff4dfe3a31631742ee21156d6e872389beb5dc970a9b4e3
Opcode Fuzzy Hash: 74b6871bb2595d09c76e53c6e0fce5db1b9a73d854c8c40bbc52c5006492f66d
Instruction Fuzzy Hash: F151B1755102169FDB288F26CC82BA777E8EF02314F14417BF805C6292FB78D985EB5A

Function 0041237B Relevance: 4.6, APIs: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,00001004,?,00000014), ref: 004123AF
TranslateCharsetInfo.GDI32(00000000,?,00000002), ref: 004123CA
IsValidLocale.KERNEL32(?,00000001), ref: 004123F8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: InfoLocale$CharsetTranslateValid
String ID:
API String ID: 1865635962-0
Opcode ID: b8516fffa327c5aabb35b42339cc9b3daec75c8325cfa9e51de61dbcefc0ae5f
Instruction ID: 485033201c78f980ad45deaa6ea69eb877c9817881635f0c431a134e7dfab1ce
Opcode Fuzzy Hash: b8516fffa327c5aabb35b42339cc9b3daec75c8325cfa9e51de61dbcefc0ae5f
Instruction Fuzzy Hash: E611A134A00108ABC714DF78C845EFEB7A8EF08701B50446BFA52DB291EBB9D985C76C

Function 00464AFE Relevance: 3.1, APIs: 2, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00464B33
IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 00464BE8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: DebuggerPresent_memset
String ID:
API String ID: 2328436684-0
Opcode ID: 2f0ddae235b82e4df3e4609b678973f92c009248e64a0d5a64db4b7330b939a5
Instruction ID: 1fda0a2dc162e0dfc2a3a8e08835f1fe4f8f55d4a65c6b0411c3a104f11f9a79
Opcode Fuzzy Hash: 2f0ddae235b82e4df3e4609b678973f92c009248e64a0d5a64db4b7330b939a5
Instruction Fuzzy Hash: 7631B6758012189BCB61DF25D8897C9B7B4BF08314F5041EAE81CA7251E7749F858F4A

Function 0046DF0C Relevance: 3.0, APIs: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00464914: __getptd_noexit.LIBCMT ref: 00464915
Part of subcall function 00464914: __amsg_exit.LIBCMT ref: 00464922

_GetPrimaryLen.LIBCMT ref: 0046DF57
EnumSystemLocalesW.KERNEL32(0046E00C,00000001,000000A0,?,?,0046E596,00000000,?,?,?,?,?,00000055), ref: 0046DF67

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: EnumLocalesPrimarySystem__amsg_exit__getptd_noexit
String ID:
API String ID: 3487593440-0
Opcode ID: 71859d79801c82bfa2199e6aadb5975ddd2501b8fab16c69d8e352f930bd5db0
Instruction ID: 398a6cd1742bc748641b8e90f0ce0e1bdfacd38c55c51ed02c529cb6f62e781d
Opcode Fuzzy Hash: 71859d79801c82bfa2199e6aadb5975ddd2501b8fab16c69d8e352f930bd5db0
Instruction Fuzzy Hash: 5C01D432E54306AFEB349F34D409B66BBE0EF40755F20492AE44B961C1E7BDA458CB4A

Function 0046DF89 Relevance: 3.0, APIs: 2, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00464914: __getptd_noexit.LIBCMT ref: 00464915
Part of subcall function 00464914: __amsg_exit.LIBCMT ref: 00464922

_GetPrimaryLen.LIBCMT ref: 0046DFBB
EnumSystemLocalesW.KERNEL32(0046E1FF,00000001,?,?,0046E560,00461C47,?,?,00000055,?,?,00461C47,?,?,?), ref: 0046DFCE

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: EnumLocalesPrimarySystem__amsg_exit__getptd_noexit
String ID:
API String ID: 3487593440-0
Opcode ID: 0b41861d6f0c4c8c58f2f9cf7ad344f36f2597b349c05c3f32718004221161d9
Instruction ID: 3034c5ab3ed98259bfea6cc880e1f1507e46c787f65cf9c56d1d25d077314f4f
Opcode Fuzzy Hash: 0b41861d6f0c4c8c58f2f9cf7ad344f36f2597b349c05c3f32718004221161d9
Instruction Fuzzy Hash: 8EF0A771E54305AEDB206B35EC05FA27BD1DB02764F20441AF84A8A191EBB95840866A

Function 0044DAE2 Relevance: 1.9, Strings: 1, Instructions: 666COMMON

Download Yara Rule

Strings

D, xrefs: 0044DC9F, 0044DEA4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-193714618
Opcode ID: 1587f76eee156a72f137bbc8e268c6dec5550f244e0e837319d86861f5f388f4
Instruction ID: 2b98558aa49c61b9a2925a3d88da82a84b75e3ef2b92d68ab36264b929b83475
Opcode Fuzzy Hash: 1587f76eee156a72f137bbc8e268c6dec5550f244e0e837319d86861f5f388f4
Instruction Fuzzy Hash: 281278B7F9161447DB0CCA99CCA27EDB2E3AFD4214B0E913DA80AE3745EE7DD8054684

Function 0046E1FF Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 00464914: __getptd_noexit.LIBCMT ref: 00464915
Part of subcall function 00464914: __amsg_exit.LIBCMT ref: 00464922

GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 0046E258

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: InfoLocale__amsg_exit__getptd_noexit
String ID:
API String ID: 3113341244-0
Opcode ID: 6e2fd68277b540f467461b7e581f9340394173cb6563a38c1641ddf96892517a
Instruction ID: 37a469fcf782297bdb2171d2ebec69b0468976862a1da028482a095118349290
Opcode Fuzzy Hash: 6e2fd68277b540f467461b7e581f9340394173cb6563a38c1641ddf96892517a
Instruction Fuzzy Hash: 3921B075500206ABDB28DB26DC52BBB73EDEF05318F1041BBE901C6181F778D949DB5A

Function 0041A2E5 Relevance: 1.5, APIs: 1, Instructions: 35comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004B2668,00000000,00000001,004C2498,?), ref: 0041A310

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: a34c308c248e98a4348b075ce93877687444e2f0bcd5811c090e82676fadb171
Instruction ID: 973a9e275bd27f36b7451567df8b25fe926a1a347c0d8dfd39e540f35267ad5b
Opcode Fuzzy Hash: a34c308c248e98a4348b075ce93877687444e2f0bcd5811c090e82676fadb171
Instruction Fuzzy Hash: 21F02E71301221A783215B49DC84ED7FFA8EF59B60710012BFD089B301C3709C90C7EA

Function 004501B9 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0044FFF2,0045003A,00420494,?,?,?,?,?,?,x$L,00000000), ref: 004501B9

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 0deebe26600d8a5dad51e277f009db57666df8cf8c6c3fa7d136ead961da7d04
Instruction ID: bed437695ced65d24f83ecce579228fa289cf0678ef8d98c057fa76e71ed8f2c
Opcode Fuzzy Hash: 0deebe26600d8a5dad51e277f009db57666df8cf8c6c3fa7d136ead961da7d04
Instruction Fuzzy Hash: 16A022303E000303CF280E30882833C28C083AC202F20023CF80FCABE0EE2000000800

Function 0046A319 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(0045E05B,004D0620,00000014), ref: 0046A319

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3c7984e86b56bce74041c057595e076908a4cdbf87a5a4889fc20428367e6c9b
Instruction ID: 2dde1c063128b272f1d8c31eb88fdb6694489725b6a181e09833e01d77c04875
Opcode Fuzzy Hash: 3c7984e86b56bce74041c057595e076908a4cdbf87a5a4889fc20428367e6c9b
Instruction Fuzzy Hash: D9B002B57035024F57484B39AD5915A3AD5AB59115755407E7447C5960DF21C8609B04

Function 00402200 Relevance: 96.7, APIs: 44, Strings: 11, Instructions: 404timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0040225F
SetLastError.KERNEL32(,)L), ref: 004022A2

Part of subcall function 004040F0: SysStringLen.OLEAUT32(?), ref: 004040FE
Part of subcall function 004040F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00404118

GetDateFormatW.KERNEL32(00000800,00000000,00000000,M-d-yyyy,00000000,00000080,?,00000080), ref: 004022EA

Part of subcall function 00403CF0: GetLastError.KERNEL32(F14A3287,?,00000000,771ADFA0,?,?,?,?,?,?,?,?,00000000,004ABB08,000000FF,,)L), ref: 00403D2F
Part of subcall function 00403CF0: GetLastError.KERNEL32(?,00000000,000000FF), ref: 00403DC9
Part of subcall function 00403CF0: SysFreeString.OLEAUT32(?), ref: 00403DE3
Part of subcall function 00403CF0: SysFreeString.OLEAUT32(?), ref: 00403DF0
Part of subcall function 00403CF0: SetLastError.KERNEL32(?), ref: 00403E14
Part of subcall function 00403CF0: SetLastError.KERNEL32(?,?,00000000,771ADFA0,?,?,?,?,?,?,?,?,00000000,004ABB08,000000FF,,)L), ref: 00403E1A

GetLastError.KERNEL32 ref: 00402311
SetLastError.KERNEL32(,)L), ref: 00402345

Part of subcall function 004040F0: _wmemcpy_s.LIBCMT ref: 00404145

GetTimeFormatW.KERNEL32(00000800,00000000,00000000,hh':'mm':'ss tt,00000000,00000080,?,00000080), ref: 0040238A

Part of subcall function 00402CE0: GetLastError.KERNEL32(F14A3287,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402D30
Part of subcall function 00402CE0: SetLastError.KERNEL32(?,004C2254,00000000,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402DA8

Part of subcall function 00403080: GetLastError.KERNEL32 ref: 004030E5
Part of subcall function 00403080: SetLastError.KERNEL32(,)L,00000000,00000000,000000FF), ref: 0040314E
Part of subcall function 00403080: GetLastError.KERNEL32(?), ref: 004031A4
Part of subcall function 00403080: SysFreeString.OLEAUT32(?), ref: 004031BE
Part of subcall function 00403080: SysFreeString.OLEAUT32(?), ref: 004031CB
Part of subcall function 00403080: SetLastError.KERNEL32(?), ref: 004031EF

Part of subcall function 004034E0: GetLastError.KERNEL32 ref: 0040354B
Part of subcall function 004034E0: SetLastError.KERNEL32(,)L,00000000,00000000,000000FF), ref: 004035B4
Part of subcall function 004034E0: SysFreeString.OLEAUT32(?), ref: 004036A6

Part of subcall function 00403080: GetLastError.KERNEL32(00000000,?,00000000,?), ref: 00403290
Part of subcall function 00403080: SysFreeString.OLEAUT32(?), ref: 004032A8
Part of subcall function 00403080: SysFreeString.OLEAUT32(?), ref: 004032B5
Part of subcall function 00403080: SetLastError.KERNEL32(?), ref: 004032D9
Part of subcall function 00403080: GetLastError.KERNEL32(00000000,00000000,000000FF), ref: 00403334
Part of subcall function 00403080: SysFreeString.OLEAUT32(?), ref: 0040334C
Part of subcall function 00403080: SysFreeString.OLEAUT32(?), ref: 00403359

Part of subcall function 00402DE0: GetLastError.KERNEL32 ref: 00402E45
Part of subcall function 00402DE0: SetLastError.KERNEL32(,)L,00000000,00000000,000000FF), ref: 00402EA5
Part of subcall function 00402DE0: GetLastError.KERNEL32 ref: 00402ECE
Part of subcall function 00402DE0: SetLastError.KERNEL32(?,00000000,00000000,000000FF), ref: 00402F2E
Part of subcall function 00402DE0: GetLastError.KERNEL32 ref: 00402F4E

GetLastError.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,00000001,?,?,?,00000001), ref: 00402447
SysFreeString.OLEAUT32(?), ref: 0040246B
SysFreeString.OLEAUT32(?), ref: 0040247E
SetLastError.KERNEL32(?), ref: 004024B1
GetLastError.KERNEL32 ref: 004024C6
SysFreeString.OLEAUT32(?), ref: 004024E4
SysFreeString.OLEAUT32(?), ref: 004024F7
SetLastError.KERNEL32(?), ref: 0040252A
GetLastError.KERNEL32 ref: 0040253F
SysFreeString.OLEAUT32(?), ref: 0040255D
SysFreeString.OLEAUT32(?), ref: 00402570
SetLastError.KERNEL32(?), ref: 004025A3
GetLastError.KERNEL32 ref: 004025B8
SysFreeString.OLEAUT32(?), ref: 004025D6
SysFreeString.OLEAUT32(?), ref: 004025E9
SetLastError.KERNEL32(?), ref: 0040261C
GetLastError.KERNEL32 ref: 00402631
SysFreeString.OLEAUT32(?), ref: 0040264F
SysFreeString.OLEAUT32(?), ref: 00402662
SetLastError.KERNEL32(?), ref: 00402695
GetLastError.KERNEL32 ref: 004026AD
SetLastError.KERNEL32(,)L), ref: 00402700
GetLastError.KERNEL32 ref: 004027C5
SysFreeString.OLEAUT32(?), ref: 004027E3
SysFreeString.OLEAUT32(?), ref: 004027F6
SetLastError.KERNEL32(?), ref: 00402829
GetLastError.KERNEL32 ref: 0040283E
SysFreeString.OLEAUT32(?), ref: 0040285C
SysFreeString.OLEAUT32(?), ref: 0040286F
SetLastError.KERNEL32(?), ref: 004028A2
GetLastError.KERNEL32 ref: 004028B1
SysFreeString.OLEAUT32(?), ref: 004028C9
SysFreeString.OLEAUT32(?), ref: 004028D6
SetLastError.KERNEL32(?), ref: 004028FA
GetLastError.KERNEL32 ref: 0040290F
SysFreeString.OLEAUT32(?), ref: 00402927
SysFreeString.OLEAUT32(?), ref: 00402934

Part of subcall function 00403B50: __vwprintf_p.LIBCMT ref: 00403B7F
Part of subcall function 00403B50: vswprintf.LIBCMT ref: 00403BB1

SetLastError.KERNEL32(?), ref: 00402958

Strings

M-d-yyyy, xrefs: 004022DC
hh':'mm':'ss tt, xrefs: 0040237C
($L, xrefs: 00402301
%s[%s]: %s, xrefs: 00402788
,)L, xrefs: 0040232A
($L, xrefs: 00402750, 0040275C
%s[%s]: %s -- File: %s, Line: %d, xrefs: 00402757
($L, xrefs: 0040224C
,)L, xrefs: 00402281
($L, xrefs: 00402697
,)L, xrefs: 004026D9

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$String$Free$Format$AllocDateTime__vwprintf_p_wmemcpy_svswprintf
String ID: %s[%s]: %s$%s[%s]: %s -- File: %s, Line: %d$($L$($L$($L$($L$,)L$,)L$,)L$M-d-yyyy$hh':'mm':'ss tt
API String ID: 1002200784-225958576
Opcode ID: a7a86b2d61960ba9728afb7e3101ba9fcb875312b072f21fbe1f16b4d26837cc
Instruction ID: 020572c2937055d15f3adad5454558bb9a505392d0520d95dd522939bb82aafc
Opcode Fuzzy Hash: a7a86b2d61960ba9728afb7e3101ba9fcb875312b072f21fbe1f16b4d26837cc
Instruction Fuzzy Hash: 6B12E370508380DFD721DF69C848B9ABBE0BF99308F00892DE98C972A1DB75A914CF57

Function 004454E7 Relevance: 73.8, APIs: 1, Strings: 41, Instructions: 349COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004454EE

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00442762: __EH_prolog3.LIBCMT ref: 00442769
Part of subcall function 00442762: GetModuleHandleW.KERNEL32(Kernel32.dll,LocaleNameToLCID,0000000C), ref: 0044277D
Part of subcall function 00442762: GetProcAddress.KERNEL32(00000000), ref: 0044278A

Strings

chinese-traditional, xrefs: 00445528
spanish-modern, xrefs: 004458F0
russian, xrefs: 00445884
slovak, xrefs: 0044589F
german-swiss, xrefs: 0044570C
german, xrefs: 004456D6
norwegian, xrefs: 004457E4
english-nz, xrefs: 00445634
american, xrefs: 004455E3
portuguese-brazilian, xrefs: 00445869
norwegian-nynorsk, xrefs: 00445818
english-uk, xrefs: 004455C8
spanish, xrefs: 004458BA
dutch-belgian, xrefs: 00445594
french-belgian, xrefs: 00445685
turkish, xrefs: 00445926
spanish-mexican, xrefs: 004458D5
chinese-simplified, xrefs: 0044550D
icelandic, xrefs: 0044575D
korean, xrefs: 004457C9
english, xrefs: 004455AF
czech, xrefs: 00445543
finnish, xrefs: 0044564F
polish, xrefs: 00445833
hungarian, xrefs: 00445742
french, xrefs: 0044566A
french-swiss, xrefs: 004456A0
italian-swiss, xrefs: 00445793
german-austrian, xrefs: 004456F1
danish, xrefs: 0044555E
swedish, xrefs: 0044590B
australian, xrefs: 004455FE
french-canadian, xrefs: 004456BB
canadian, xrefs: 00445619
japanese, xrefs: 004457AE
dutch, xrefs: 00445579
italian, xrefs: 00445778
chinese, xrefs: 004454F7
greek, xrefs: 00445727
norwegian-bokmal, xrefs: 004457FD
portuguese, xrefs: 0044584E

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3$ErrorLast$AddressHandleModuleProc
String ID: american$australian$canadian$chinese$chinese-simplified$chinese-traditional$czech$danish$dutch$dutch-belgian$english$english-nz$english-uk$finnish$french$french-belgian$french-canadian$french-swiss$german$german-austrian$german-swiss$greek$hungarian$icelandic$italian$italian-swiss$japanese$korean$norwegian$norwegian-bokmal$norwegian-nynorsk$polish$portuguese$portuguese-brazilian$russian$slovak$spanish$spanish-mexican$spanish-modern$swedish$turkish
API String ID: 1796103132-895649913
Opcode ID: acbe9e79bc3377be6312c225eff9965e578ff3b3a3ce40ac755e004f8bdcdb88
Instruction ID: ff3edd945390d605f245774855709239da660aeafa6b395437aa5135e2cdb9a6
Opcode Fuzzy Hash: acbe9e79bc3377be6312c225eff9965e578ff3b3a3ce40ac755e004f8bdcdb88
Instruction Fuzzy Hash: 8CB14E64700A65A7FF10EA53E9517B922549B1031AFE08437BC47DA2D2EF7CCB07966C

Function 00491BE0 Relevance: 72.2, APIs: 34, Strings: 7, Instructions: 494stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00403FB0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,004AB968,000000FF), ref: 00403FF3
Part of subcall function 00403FB0: SetLastError.KERNEL32(?,004C2254,00000000,?,?,?,?,?,004AB968,000000FF), ref: 00404068

Part of subcall function 00490110: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000002,?,?,0048A101,?,00000000,00000103), ref: 00490136
Part of subcall function 00490110: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000,?,?), ref: 0049017E

GetPrivateProfileIntA.KERNEL32(?,RECTS,00000000,?), ref: 00491CD7
_memset.LIBCMT ref: 00491D07
_memset.LIBCMT ref: 00491D18
_memset.LIBCMT ref: 00491D32
lstrcpyA.KERNEL32(00000000,RECT), ref: 00491D72
__itow.LIBCMT ref: 00491D82
lstrcatA.KERNEL32(00000000,00000000), ref: 00491D92
GetLastError.KERNEL32 ref: 00491DAC
SetLastError.KERNEL32(,)L,004C2254,004C2252), ref: 00491E3A
GetPrivateProfileStringA.KERNEL32(?,?,004C20A8,?,000003E8,00000000), ref: 00491ECE
GetLastError.KERNEL32 ref: 00491EEC
SysFreeString.OLEAUT32(?), ref: 00491F0E
SysFreeString.OLEAUT32(?), ref: 00491F1F
SetLastError.KERNEL32(?), ref: 00491F54
GetSysColor.USER32(0000000F), ref: 00491F58
CreateSolidBrush.GDI32(?), ref: 00491F8E
lstrcpyA.KERNEL32(?,?), ref: 00491FA2
lstrcatA.KERNEL32(?,POS), ref: 00491FB1
GetLastError.KERNEL32 ref: 00491FCB
SetLastError.KERNEL32(004C292C,004C2254,004C2252), ref: 0049205A
GetPrivateProfileStringA.KERNEL32(00000000,?,004C20A8,?,000003E8,00000000), ref: 004920E7
GetLastError.KERNEL32 ref: 00492105
SysFreeString.OLEAUT32(00000000), ref: 00492127
SysFreeString.OLEAUT32(?), ref: 00492138
SetLastError.KERNEL32(004C2428), ref: 0049216D
lstrcpyA.KERNEL32(?,?,?,?,00000001), ref: 004921BB
lstrcatA.KERNEL32(?,AREA), ref: 004921CA
GetLastError.KERNEL32 ref: 004921E4
SetLastError.KERNEL32(004C292C,004C2254,00000000), ref: 0049226A
GetPrivateProfileStringA.KERNEL32(00000000,?,004C20A8,?,000003E8,00000000), ref: 004922F1
GetLastError.KERNEL32 ref: 0049230F
SysFreeString.OLEAUT32(00000000), ref: 00492331
SysFreeString.OLEAUT32(?), ref: 00492342
SetLastError.KERNEL32(004C2428), ref: 00492377

Strings

POS, xrefs: 00491FA8
T"L, xrefs: 00491C1C
RECTS, xrefs: 00491CCC
RECT, xrefs: 00491D66
AREA, xrefs: 004921C1
($L, xrefs: 00491CB9
,)L, xrefs: 00491E0C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$String$Free$PrivateProfile$_memsetlstrcatlstrcpy$ByteCharMultiWide$BrushColorCreateSolid__itow
String ID: ($L$,)L$AREA$POS$RECT$RECTS$T"L
API String ID: 792308993-627679165
Opcode ID: d0e87c1849fe5d562858837e8f015323e873ba6e91c91a939fcd21fb11620c02
Instruction ID: 42fcbb3a9eb08aae1d94cc373caf3583cfea2e7aa93bf8099695119c80c6001f
Opcode Fuzzy Hash: d0e87c1849fe5d562858837e8f015323e873ba6e91c91a939fcd21fb11620c02
Instruction Fuzzy Hash: 8F223DB5D012299FDF60DF54CD85B9DBBB8BB44308F0041EAEA09A7291DB749E84CF58

Function 00472356 Relevance: 72.1, APIs: 40, Strings: 1, Instructions: 363COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBCMT ref: 0047236F

Part of subcall function 0046F91A: DName::DName.LIBCMT ref: 0046F92B
Part of subcall function 0046F91A: DName::operator+.LIBCMT ref: 0046F932

Strings

g0G, xrefs: 0047263E, 00472562, 00472453, 004724A1

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: NameName::Name::operator+operator+
String ID: g0G
API String ID: 2937105810-2233984631
Opcode ID: 627ba229610e289929e27dc26c497b85bad3aef8bce757c3f162d18aeb90b74c
Instruction ID: f8cbbed9f7985e1dda1e19c78f2264019961c3dbad2fdaa009c4b268c7bf8872
Opcode Fuzzy Hash: 627ba229610e289929e27dc26c497b85bad3aef8bce757c3f162d18aeb90b74c
Instruction Fuzzy Hash: 09D183B1901209AFCB04DFA5D992AEE7BF4EF04304F10806FE545E7351EB789A49CB59

Function 004894D0 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 476stringwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004857A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,?,?,?,004AA621,000000FF,?,00489525,?,?,00000001), ref: 004857F4
Part of subcall function 004857A0: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,004AA621,000000FF,?,00489525,?,?,00000001), ref: 0048582D

wsprintfA.USER32 ref: 0048955A

Part of subcall function 00407F60: _memmove.LIBCMT ref: 00408015

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

GetLastError.KERNEL32 ref: 004895B2
SetLastError.KERNEL32(?,?,00000000,000000FF), ref: 00489600
lstrcpyA.KERNEL32(000000D0,?), ref: 00489649
lstrcpyA.KERNEL32(00000004,?), ref: 00489650
lstrcpyA.KERNEL32(00000068,?), ref: 00489660
MapDialogRect.USER32(?,?), ref: 0048969E
MulDiv.KERNEL32(?,000186A0,00000006), ref: 004896C9
MulDiv.KERNEL32(?,000186A0,0000000D), ref: 004896DE
MulDiv.KERNEL32(?,?,00000004), ref: 00489746
MulDiv.KERNEL32(?,?,00000008), ref: 00489772
GetClientRect.USER32(?,?), ref: 00489805
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00489816
CreateCompatibleDC.GDI32(00000000), ref: 00489822
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0048983B
SelectObject.GDI32(?,00000000), ref: 0048984E
MulDiv.KERNEL32(?,?,00000004), ref: 0048987E
MulDiv.KERNEL32(?,?,00000008), ref: 00489891
MulDiv.KERNEL32(?,?,00000004), ref: 004898A4
MulDiv.KERNEL32(?,?,00000008), ref: 004898B7
FillRect.USER32(?,?,?), ref: 004898CC
GetDlgItem.USER32(?,?), ref: 004899EF
DrawIcon.USER32(?,?,?,00000000), ref: 00489A06

Strings

DISPLAY, xrefs: 00489811
PROP_PSKIN, xrefs: 00489A7D
-%04x, xrefs: 00489545

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$CreateRectlstrcpy$CompatibleFreeString$BitmapClientDialogDrawFillIconItemObjectSelect_memmovewsprintf
String ID: -%04x$DISPLAY$PROP_PSKIN
API String ID: 4259255117-337460466
Opcode ID: f7c6b2f0b43d9726ebddd36e6ad144da45b56ebc8f010b3116434400e2312ee6
Instruction ID: 0f6ea68de4b59aaf670d530243970e2c18867ad90c35616639c5e4c3e0ff38c6
Opcode Fuzzy Hash: f7c6b2f0b43d9726ebddd36e6ad144da45b56ebc8f010b3116434400e2312ee6
Instruction Fuzzy Hash: FE229F71A00654EFDB21EF68C884FAABBF1BF09304F08859AE5499B3A1D735AC44CF55

Function 00488FB0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 395stringwindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00488FDF
GetClassNameW.USER32(?,?,00000064), ref: 00488FEE
lstrcmpiW.KERNEL32(Button,?), ref: 00489003
GetWindowLongW.USER32(?,000000F0), ref: 00489010
SetWindowLongW.USER32(?,000000F0,?), ref: 004890A6
GetWindowLongW.USER32(?,000000F4), ref: 004890AF
GetWindowRect.USER32(?,?), ref: 004891DB
MulDiv.KERNEL32(?,000186A0,000186A0), ref: 00489222
MulDiv.KERNEL32(?,?,000186A0), ref: 0048923F
MulDiv.KERNEL32(?,000186A0,?), ref: 00489269
MulDiv.KERNEL32(?,000186A0,?), ref: 004892A8
ScreenToClient.USER32(?,?), ref: 004892D4
MulDiv.KERNEL32(?,?,00000004), ref: 004892F6
MulDiv.KERNEL32(?,?,00000008), ref: 00489310
MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 0048932F
lstrcmpiW.KERNEL32(Static,?), ref: 00489343
GetWindowLongW.USER32(?,000000F0), ref: 00489356
GetWindowLongW.USER32(?,000000F0), ref: 00489367
GetWindowRect.USER32(?,?), ref: 00489379
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0048938A
SendMessageW.USER32(?,00000171,00000000,00000000), ref: 004893A6
GetWindowLongW.USER32(?,000000F4), ref: 004893C9
ShowWindow.USER32(?,00000000), ref: 004893FE
GetWindowTextW.USER32(?,?,0000000A), ref: 00489441
SetWindowLongW.USER32(?,000000FC,0048AE90), ref: 00489456
SetPropW.USER32(?,PROP_STAT_PSKIN,?), ref: 00489473
SetPropW.USER32(?,PROP_STAT_OLDPROC,00000000), ref: 0048947C

Strings

@, xrefs: 00489447
msctls_progress32, xrefs: 00489484
PROP_STAT_OLDPROC, xrefs: 00489476
Static, xrefs: 0048933E
PROP_STAT_PSKIN, xrefs: 0048946D
Button, xrefs: 00488FFE

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window$Long$PropRectlstrcmpi$ClassClientMessageMoveNamePointsScreenSendShowText_memset
String ID: @$Button$PROP_STAT_OLDPROC$PROP_STAT_PSKIN$Static$msctls_progress32
API String ID: 2481118448-847272177
Opcode ID: 4cc5aae4440dc6079d83ce7a67ee963d2ecff2eb4ec4fa8e2869f05bf43ea2c1
Instruction ID: dab72780a53c9a45a7b9482dd617420ffaec09d320faf5fa0e4c6ea27723c42a
Opcode Fuzzy Hash: 4cc5aae4440dc6079d83ce7a67ee963d2ecff2eb4ec4fa8e2869f05bf43ea2c1
Instruction Fuzzy Hash: 18F14A74A00604AFC714DF68CC84FAABBF5BB49304F14896AE95AD73A1DB39EC41CB54

Function 0040C3BD Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 473windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040C3C7
GetWindowLongW.USER32(?,000000EB), ref: 0040C42B
SetDlgItemTextW.USER32(?,000003F3,-00000004), ref: 0040C494
GetWindowRect.USER32(?,?), ref: 0040C4B5
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0040C4E6
LoadIconW.USER32(00000000,00007F01), ref: 0040C654
GetDlgItem.USER32(?,000003F9), ref: 0040C667
SendMessageW.USER32(00000000), ref: 0040C66E
SetWindowTextW.USER32(?,-00000004), ref: 0040C6A2
SetDlgItemTextW.USER32(?,000003F8,-00000004), ref: 0040C731
SetDlgItemTextW.USER32(?,000003F7,00000004), ref: 0040C7E9

Strings

x$L, xrefs: 0040C940
%s%ld : 0x%x%s%s, xrefs: 0040C9FC
open, xrefs: 0040C590
x$L, xrefs: 0040C58B
>>, xrefs: 0040C461, 0040C8E5
x$L, xrefs: 0040C77B
<<, xrefs: 0040C466, 0040C46E, 0040C8EA, 0040C8F2
x$L, xrefs: 0040C6BF
x$L, xrefs: 0040C50A
T"L, xrefs: 0040C5D0
%ld : 0x%x, xrefs: 0040C6E2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ItemTextWindow$H_prolog3_IconLoadLongMessageMoveRectSend
String ID: <<$ >>$%ld : 0x%x$%s%ld : 0x%x%s%s$T"L$open$x$L$x$L$x$L$x$L$x$L
API String ID: 4073716165-245975066
Opcode ID: 7c59d6ee3fc0580c16a094a7aeb1b5c3c4d9361fd7d6e9e6c51f195b4275ed57
Instruction ID: 7a164aa1521e3f2c8174ea89885734876083989dfb812f2c27832ffe2c272a45
Opcode Fuzzy Hash: 7c59d6ee3fc0580c16a094a7aeb1b5c3c4d9361fd7d6e9e6c51f195b4275ed57
Instruction Fuzzy Hash: CC127B71900218EFDB15DB64CC85FAE77B8BF09704F0441AEE50AB72A1DB78AA44CF59

Function 00405AE0 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 250COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00405B4B
SetLastError.KERNEL32(,)L,00000000,00000000,000000FF), ref: 00405BB4
GetLastError.KERNEL32 ref: 00405BD4
SetLastError.KERNEL32(,)L), ref: 00405C11
GetLastError.KERNEL32(?,000000FF,00000001), ref: 00405C8C
SysFreeString.OLEAUT32(?), ref: 00405CA6
SysFreeString.OLEAUT32(?), ref: 00405CB9
SetLastError.KERNEL32(?), ref: 00405CF2
GetLastError.KERNEL32(00000000,00000000,000000FF,?,?,000000FF,?,000000FF,00000001), ref: 00405D52
SysFreeString.OLEAUT32(?), ref: 00405D6C
SysFreeString.OLEAUT32(?), ref: 00405D7F
SetLastError.KERNEL32(?), ref: 00405DB8
GetLastError.KERNEL32(?,000000FF,00000001), ref: 00405DCB
SetLastError.KERNEL32(?,?,00000000,000000FF), ref: 00405E22
GetLastError.KERNEL32 ref: 00405E37
SysFreeString.OLEAUT32(?), ref: 00405E4B
SysFreeString.OLEAUT32(?), ref: 00405E58
SetLastError.KERNEL32(?), ref: 00405E7C
GetLastError.KERNEL32 ref: 00405E8F
SysFreeString.OLEAUT32(?), ref: 00405EA3
SysFreeString.OLEAUT32(?), ref: 00405EB0
SetLastError.KERNEL32(?), ref: 00405ED4

Strings

,)L, xrefs: 00405BB0
,)L, xrefs: 00405AE0
,)L, xrefs: 00405BF0
($L, xrefs: 00405BC1
,)L, xrefs: 00405DC4
,)L, xrefs: 00405B8B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: ($L$,)L$,)L$,)L$,)L$,)L
API String ID: 2425351278-597801925
Opcode ID: cf9fdd6ca3de3854101fee5193ae4b2aee58f8df416d966436aa541cdbc335f9
Instruction ID: 6103b4266222b50a4a60e97d3b8bed0ad8b3156f689ee4c26f69f2ba1b01b325
Opcode Fuzzy Hash: cf9fdd6ca3de3854101fee5193ae4b2aee58f8df416d966436aa541cdbc335f9
Instruction Fuzzy Hash: 9AB117715083809FD720DF28C844B5BBBE0FF89318F154A2EE499972A1DB79A849CF56

Function 0040971C Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 287threadinjectionprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000104), ref: 004097A8

Part of subcall function 00409574: __EH_prolog3_GS.LIBCMT ref: 0040957B
Part of subcall function 00409574: GetLastError.KERNEL32(00000038,0040DCC8,004480DB,?,004AEF80), ref: 00409582
Part of subcall function 00409574: SetLastError.KERNEL32(00000000), ref: 004095D6

Part of subcall function 0040A206: __EH_prolog3_GS.LIBCMT ref: 0040A210

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00440F5B: __EH_prolog3_GS.LIBCMT ref: 00440F65

GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00409884
SetCurrentDirectoryW.KERNEL32(?), ref: 004098B7
_memset.LIBCMT ref: 004098DD
_memset.LIBCMT ref: 004098F6
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000044,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040991C
_memset.LIBCMT ref: 0040993F
_wcsncpy.LIBCMT ref: 004099B2

Part of subcall function 00440F5B: GetLastError.KERNEL32 ref: 00440FFA
Part of subcall function 00440F5B: GetLastError.KERNEL32 ref: 004410B9
Part of subcall function 00440F5B: __CxxThrowException@8.LIBCMT ref: 00441129

_wcsncpy.LIBCMT ref: 004099DD
GetCurrentProcess.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004099FD
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00409A00
DuplicateHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00409A03
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00409A24
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00409A30
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00409A38
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00409A53
_memmove.LIBCMT ref: 00409AA1
GetThreadContext.KERNEL32 ref: 00409AC0
VirtualProtectEx.KERNEL32(?,?,00000C35,00000040,?), ref: 00409B02
WriteProcessMemory.KERNEL32(?,?,?,00000C35,00000000), ref: 00409B1D
FlushInstructionCache.KERNEL32(?,?,00000C35), ref: 00409B2F
SetThreadContext.KERNEL32(?,00010003), ref: 00409B42
ResumeThread.KERNEL32(?), ref: 00409B4E
CloseHandle.KERNEL32(?), ref: 00409B5A
CloseHandle.KERNEL32(?), ref: 00409B62

Strings

x$L, xrefs: 00409756
explorer.exe, xrefs: 004098C0

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$HandleProcess$Close$CurrentH_prolog3_Thread_memset$ContextDirectoryFileString_wcsncpy$AllocCacheCreateDuplicateException@8FlushH_prolog3InstructionMemoryModuleMoveNameProtectResumeSystemTerminateThrowVirtualWrite_memmove
String ID: explorer.exe$x$L
API String ID: 3542506763-1973577736
Opcode ID: 7bb5b4c27f2bc08f8507b512b255aa1c1621107c62e040eb83894a98a2626879
Instruction ID: f84a1c28ea7c46fe48e43bff41f8e67ec8ef673014d20e068f228e639e763c74
Opcode Fuzzy Hash: 7bb5b4c27f2bc08f8507b512b255aa1c1621107c62e040eb83894a98a2626879
Instruction Fuzzy Hash: 83C14E71D00218AFEF24DF55DC49BDABBB8EF09344F0041EAF909A62A1DB745A84CF95

Function 0042D8C3 Relevance: 47.5, APIs: 9, Strings: 18, Instructions: 240windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042D8CD
SendMessageW.USER32(?,0000000C,00000000,ISPREREQDIR), ref: 0042D981
SendMessageW.USER32(?,0000000C,00000000,?), ref: 0042D9A2
SendMessageW.USER32(?,00000111,00000008,00000000), ref: 0042D9B3
SendMessageW.USER32(?,0000000C,00000000,004C2414), ref: 0042D9D1
SendMessageW.USER32(?,00000111,00000007,00000000), ref: 0042D9E2
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0042D9F0
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0042DA1F

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Strings

($L, xrefs: 0042DB18
,)L, xrefs: 0042DBE5
($L, xrefs: 0042D9FD
[SETUPEXEDIR], xrefs: 0042DB7B
($L, xrefs: 0042DA36
($L, xrefs: 0042D92F, 0042D93E, 0042DA53, 0042DA84, 0042DA9F, 0042DB22, 0042DB4C, 0042DB67, 0042DB80, 0042DBAB, 0042DBC6, 0042DBDF, 0042DBF8, 0042DC08, 0042D932, 0042DA87, 0042DB4F, 0042DBAE, 0042DBFB
x$L, xrefs: 0042DAB1, 0042DAD9, 0042DB3C, 0042DB9B, 0042DC10
[ProductLanguage], xrefs: 0042DA4E
,)L, xrefs: 0042D91F
ISPREREQDIR, xrefs: 0042D977
($L, xrefs: 0042D933
,)L, xrefs: 0042D953
,)L, xrefs: 0042DABD
[ISPREREQDIR], xrefs: 0042DBDA
[SETUPEXENAME], xrefs: 0042DB1D
x$L, xrefs: 0042DA74, 0042DA94, 0042DB35, 0042DB5C, 0042DB94, 0042DBBB, 0042DB3B, 0042DB9A
($L, xrefs: 0042DA49
,)L, xrefs: 0042DC28

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: MessageSend$ErrorLast$H_prolog3_
String ID: ($L$($L$($L$($L$($L$($L$,)L$,)L$,)L$,)L$,)L$ISPREREQDIR$[ISPREREQDIR]$[ProductLanguage]$[SETUPEXEDIR]$[SETUPEXENAME]$x$L$x$L
API String ID: 860943175-912504307
Opcode ID: b435a69bddb927d95b327de5b10429788aa1cc262981f246438b70175aed2825
Instruction ID: 7d33845c3784a929534d40767880d28e08fc5b97b931e74144f91242248e04fd
Opcode Fuzzy Hash: b435a69bddb927d95b327de5b10429788aa1cc262981f246438b70175aed2825
Instruction Fuzzy Hash: 5DA16075900218EEDB15DB91CD41FDEBBB8AF18304F5440AEF505B7192DBB42A48CF69

Function 0042CB43 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 291windowsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0042A7E1: __EH_prolog3.LIBCMT ref: 0042A7E8
Part of subcall function 0042A7E1: GetCurrentDirectoryW.KERNEL32(00000104,00000000,?,00000105,00000014,0042CBFF,00000008,?,00000001), ref: 0042A838
Part of subcall function 0042A7E1: SetCurrentDirectoryW.KERNEL32(004C2418), ref: 0042A856

_memset.LIBCMT ref: 0042CC14

Part of subcall function 0042BC40: __EH_prolog3_GS.LIBCMT ref: 0042BC47
Part of subcall function 0042BC40: SetWindowTextW.USER32(00000000,?), ref: 0042BD1E

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Part of subcall function 00403FB0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,004AB968,000000FF), ref: 00403FF3
Part of subcall function 00403FB0: SetLastError.KERNEL32(?,004C2254,00000000,?,?,?,?,?,004AB968,000000FF), ref: 00404068

Part of subcall function 00402CE0: GetLastError.KERNEL32(F14A3287,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402D30
Part of subcall function 00402CE0: SetLastError.KERNEL32(?,004C2254,00000000,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402DA8

ShellExecuteExW.SHELL32(?), ref: 0042CE9C
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000004FF), ref: 0042CEFE
PeekMessageW.USER32(?,00000000,00000113,00000113,00000001), ref: 0042CF19
PeekMessageW.USER32(?,00000000,00000000,00000000,04270001), ref: 0042CF2F
TranslateMessage.USER32(?), ref: 0042CF3D
DispatchMessageW.USER32(?), ref: 0042CF47
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042CF54
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0042CF6D
CloseHandle.KERNEL32(00000000), ref: 0042CF79
GetLastError.KERNEL32 ref: 0042CFC1

Strings

Creating new process for prerequisite, launching command line %s [%s] %s, xrefs: 0042CE66
($L, xrefs: 0042CCEB, 0042CCF1
Prerequisite process exited with return code %d, xrefs: 0042CF8B
x$L, xrefs: 0042CC8D, 0042CC90
open, xrefs: 0042CCB0
,)L, xrefs: 0042CDD9
Launching: , xrefs: 0042CD06
<, xrefs: 0042CC22
No process created by successful prerequisite launch, xrefs: 0042CEB9
?, xrefs: 0042CE14
Could not launch prerequisite, last error: %d, ShellExecute: %d, xrefs: 0042CFCE
($L($L, xrefs: 0042CD27, 0042CD2A
($L, xrefs: 0042CE27, 0042CE89
..\..\Shared\Setup\SetupPreRequisite.cpp, xrefs: 0042CE6B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$Message$CurrentDirectoryFreePeekStringWait$CloseCodeDispatchExecuteExitH_prolog3H_prolog3_HandleMultipleObjectObjectsProcessShellSingleTextTranslateWindow_memset
String ID: ($L$($L$($L($L$,)L$..\..\Shared\Setup\SetupPreRequisite.cpp$<$Could not launch prerequisite, last error: %d, ShellExecute: %d$Creating new process for prerequisite, launching command line %s [%s] %s$Launching: $No process created by successful prerequisite launch$Prerequisite process exited with return code %d$open$x$L$?
API String ID: 2605968414-686700460
Opcode ID: b02b7ec253dc43bddbe990940f70f60bf23ea47f20366fadb8e799e5c0d078d0
Instruction ID: 58fdda0f11b724ddf376f7b1e8071529cc576c873586ced899c122d80c33a26e
Opcode Fuzzy Hash: b02b7ec253dc43bddbe990940f70f60bf23ea47f20366fadb8e799e5c0d078d0
Instruction Fuzzy Hash: 60C19171A00168AECB10DBA2DD45FDEBBBCEF15304F5040AFA40AB2181DB785B49CF69

Function 0041D96E Relevance: 42.5, APIs: 1, Strings: 23, Instructions: 498COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041D978

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

Part of subcall function 0041A703: __EH_prolog3_GS.LIBCMT ref: 0041A70D
Part of subcall function 0041A703: SysStringLen.OLEAUT32(?), ref: 0041A80D
Part of subcall function 0041A703: SysFreeString.OLEAUT32(?), ref: 0041A818

Part of subcall function 0041A703: SysFreeString.OLEAUT32(?), ref: 0041A853

Part of subcall function 00409FA9: SysFreeString.OLEAUT32(?), ref: 00409FB8

Strings

runfromtemp, xrefs: 0041DF5A
show_err_msg_invalid_identity, xrefs: 0041DD86
auto, xrefs: 0041DBB9
, xrefs: 0041DFC7
tempdisk1folder:, xrefs: 0041DE1F
delayedstart:, xrefs: 0041DDC9
hide_splash, xrefs: 0041DBEF
x$L, xrefs: 0041DFCC, 0041DFD4, 0041DFE3, 0041DCC7, 0041DCD2, 0041DB63, 0041DB6E, 0041DA4F, 0041DABF, 0041DAA1, 0041DAA4, 0041DB66, 0041DCCA, 0041DFD7
show_beta_msg, xrefs: 0041DD35
no_engine, xrefs: 0041DB81
installfromweb:, xrefs: 0041DF21
no_deleter, xrefs: 0041DCE4
extract_all:, xrefs: 0041DE75
show_err_dlg, xrefs: 0041DD50
hide_usd, xrefs: 0041DC0A
x$L, xrefs: 0041D98C
hide_progress, xrefs: 0041DBD4
show_err_msg, xrefs: 0041DD6B
show_eval_msg, xrefs: 0041DD1A
package, xrefs: 0041DC41
media_path:, xrefs: 0041DECB
reboot, xrefs: 0041DC26
clone_wait, xrefs: 0041DCFF

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: String$Free$ErrorH_prolog3_Last$Alloc
String ID: $auto$clone_wait$delayedstart:$extract_all:$hide_progress$hide_splash$hide_usd$installfromweb:$media_path:$no_deleter$no_engine$package$reboot$runfromtemp$show_beta_msg$show_err_dlg$show_err_msg$show_err_msg_invalid_identity$show_eval_msg$tempdisk1folder:$x$L$x$L
API String ID: 2397638368-2780322223
Opcode ID: 65c47b5baa4fc53e3cf7e39400f7f07ca5c76c5e330931b5c56023da98c5e952
Instruction ID: 5f41c49e37012578e2a10b4aba095b96dffbadd52df93c53fcd63d7626a76e89
Opcode Fuzzy Hash: 65c47b5baa4fc53e3cf7e39400f7f07ca5c76c5e330931b5c56023da98c5e952
Instruction Fuzzy Hash: 5612D870941258ADEB10EBA0CD52FEEB738AF12308F1400EEF145671D2DB795E89CB69

Function 00488A90 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 156windowstringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00488ACD
GetWindowRect.USER32(?,?), ref: 00488ADD
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00488AF0
GetWindowTextW.USER32(?,?,000000A0), ref: 00488B11
SetWindowTextW.USER32(?,004C2254), ref: 00488B2C
GetWindowLongW.USER32(?,000000F0), ref: 00488B3B
GetWindowLongW.USER32(?,000000EC), ref: 00488B47
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 00488B4F
CreateWindowExW.USER32(00000000,STATIC,00000000,00000000,0000000A,?,0000000A,?,?,000000FF,00000000), ref: 00488B97
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00488BBB
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00488BC9
SetWindowLongW.USER32(00000000,000000FC,0048AE90), ref: 00488BD3
SetPropW.USER32(00000000,PROP_STAT_PSKIN,?), ref: 00488BED
SetPropW.USER32(00000000,PROP_STAT_OLDPROC,00000000), ref: 00488BF6
GetDC.USER32(00000000), ref: 00488BF9
SelectObject.GDI32(00000000,?), ref: 00488C1C
lstrlenW.KERNEL32(00000000,?), ref: 00488C30
GetTextExtentPoint32W.GDI32(00000000,00000000,00000000), ref: 00488C3F
ReleaseDC.USER32(00000000,00000000), ref: 00488C47
SetWindowPos.USER32(00000000,?,0000000A,?,00000000,00000000,00000002), ref: 00488C70

Strings

STATIC, xrefs: 00488B91
PROP_STAT_OLDPROC, xrefs: 00488BF0
PROP_STAT_PSKIN, xrefs: 00488BE5

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window$LongText$MessagePropSend$CreateExtentHandleModuleObjectPoint32PointsRectReleaseSelect_memsetlstrlen
String ID: PROP_STAT_OLDPROC$PROP_STAT_PSKIN$STATIC
API String ID: 2762062944-2065393330
Opcode ID: 33170a46a5d83e7e95636aa9d1b2ee5a1695d9d10d32fb68dd2437ff591616a4
Instruction ID: fbfe6f213dbc2734019be83e48021c0921c701911881c4bc85cc1514169af775
Opcode Fuzzy Hash: 33170a46a5d83e7e95636aa9d1b2ee5a1695d9d10d32fb68dd2437ff591616a4
Instruction Fuzzy Hash: F5514C71E01228BFDB209B64DC49F9A7BBDEB49310F0041E5F60AA7291DB746E44CF69

Function 00404640 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 199COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004046A7
SetLastError.KERNEL32(,)L,00000000,00000000,000000FF), ref: 0040470A
GetLastError.KERNEL32(00000000,00000000,000000FF,?,00000000,?,?), ref: 00404792
SysFreeString.OLEAUT32(?), ref: 004047AC
SysFreeString.OLEAUT32(?), ref: 004047BC
SetLastError.KERNEL32(?), ref: 004047E6
GetLastError.KERNEL32 ref: 00404801
SysFreeString.OLEAUT32(?), ref: 00404815
SysFreeString.OLEAUT32(?), ref: 00404822
SetLastError.KERNEL32(?), ref: 00404846

Part of subcall function 00404580: GetLastError.KERNEL32(F14A3287,?,?,?,00000000,004AC158,000000FF,,)L,004050D6,00000000,00000001,000000FF), ref: 004045BE
Part of subcall function 00404580: SetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 0040461A

GetLastError.KERNEL32(?,?,000000FF,?,00000001,00000000), ref: 00404885
SysFreeString.OLEAUT32(?), ref: 00404899
SysFreeString.OLEAUT32(?), ref: 004048A6
SetLastError.KERNEL32(?), ref: 004048CA
GetLastError.KERNEL32 ref: 004048DD
SysFreeString.OLEAUT32(?), ref: 004048F1
SysFreeString.OLEAUT32(?), ref: 004048FE
SetLastError.KERNEL32(?), ref: 00404922

Strings

,)L, xrefs: 00404640
,)L, xrefs: 00404706
($L, xrefs: 00404697
,)L, xrefs: 004046E7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: ($L$,)L$,)L$,)L
API String ID: 2425351278-2459287740
Opcode ID: 7b49335f307edd3c11b8ae13bca550e5d86425cb79771e12ff11cc0f56d5b7bc
Instruction ID: 15200fe3a53af3262a722635726895ad5d6107789824f1bd8efda6cd418b71d5
Opcode Fuzzy Hash: 7b49335f307edd3c11b8ae13bca550e5d86425cb79771e12ff11cc0f56d5b7bc
Instruction Fuzzy Hash: 149113715083809FD720DF29C845B5BBBE1BF89318F104A2DF999972A1DB76E808CF46

Function 00404C00 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 246COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00404C5F
SetLastError.KERNEL32(,)L), ref: 00404C97
GetLastError.KERNEL32(00000000,00000000,000000FF,00000007,00000000,00000000,,)L,00000002,00000001), ref: 00404D70
SysFreeString.OLEAUT32(?), ref: 00404D88
SysFreeString.OLEAUT32(?), ref: 00404D95
SetLastError.KERNEL32(?), ref: 00404DBF
GetLastError.KERNEL32(?), ref: 00404E54
SysFreeString.OLEAUT32(?), ref: 00404E6C
SysFreeString.OLEAUT32(?), ref: 00404E79
SetLastError.KERNEL32(?), ref: 00404E9D
GetLastError.KERNEL32 ref: 00404EB0
SetLastError.KERNEL32(?,00000000,00000000,000000FF), ref: 00404F03
GetLastError.KERNEL32 ref: 00404F12
SysFreeString.OLEAUT32(?), ref: 00404F2A
SysFreeString.OLEAUT32(?), ref: 00404F37
SetLastError.KERNEL32(?), ref: 00404F5B

Strings

\, xrefs: 00404D16
,)L, xrefs: 00404C7C
($L, xrefs: 00404C4F
,)L, xrefs: 00404EA9
,)L, xrefs: 00404CF0, 00404D0E, 00404CF4, 00404D12

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: ($L$,)L$,)L$,)L$\
API String ID: 2425351278-33054487
Opcode ID: 1c50e6382294c3068daca549f39fc2fb937999992bc4a3eaeecf08432f4fac30
Instruction ID: c1cbad8e72ecb4d01faba38dfadaf87a71575b5cf3b1715a9541676a29b91e67
Opcode Fuzzy Hash: 1c50e6382294c3068daca549f39fc2fb937999992bc4a3eaeecf08432f4fac30
Instruction Fuzzy Hash: 36A13AB15083409FD710DF24C985B5BBBE4BF88318F10892EF9899B2A1D775E948CF96

Function 00401CA0 Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 214COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(F14A3287), ref: 00401D5B
SetLastError.KERNEL32(,)L), ref: 00401D91
GetLastError.KERNEL32(?,00000104), ref: 00401E08
SetLastError.KERNEL32(004C292C), ref: 00401E38
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000104), ref: 00401E6A

Part of subcall function 00402CE0: GetLastError.KERNEL32(F14A3287,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402D30
Part of subcall function 00402CE0: SetLastError.KERNEL32(?,004C2254,00000000,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402DA8

Strings

VerboseLogPath, xrefs: 00401DD7
($L, xrefs: 00401DFA
SOFTWARE\InstallShield\22.0\Professional, xrefs: 00401D2F
,)L, xrefs: 00401E01
($L, xrefs: 00401D4D
,)L, xrefs: 00401D79
InstallShield.log, xrefs: 00401ED5

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FileModuleName
String ID: ($L$($L$,)L$,)L$InstallShield.log$SOFTWARE\InstallShield\22.0\Professional$VerboseLogPath
API String ID: 1026760046-52085079
Opcode ID: 8dd69768b3377c92824f6dfc0e61e6ab67aa90bc215c251eacf252eef7b6c7b3
Instruction ID: f923f6ae6cde7910a4750bc37cf60048b396af589e5985edfbbab2f522b3f67c
Opcode Fuzzy Hash: 8dd69768b3377c92824f6dfc0e61e6ab67aa90bc215c251eacf252eef7b6c7b3
Instruction Fuzzy Hash: 08913470D00248DFDB10DFA4CD45BADBBB4BF08308F1441AAE905B72A1DBB96A48CF59

Function 00411F75 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 208windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00411F7F
GetVersionExW.KERNEL32 ref: 00411FAD

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

SendMessageW.USER32(00000000,00000111,-00000003,00000000), ref: 0041213E

Part of subcall function 0041061C: __EH_prolog3_GS.LIBCMT ref: 00410623

Strings

,)L, xrefs: 004120F4
($L, xrefs: 004120BD
..\..\Shared\Setup\IsPreReqDlg.cpp, xrefs: 0041200C, 004120C2, 00412159, 00412181
,)L, xrefs: 004120CD
StartStopProgress - Embedded Looping, xrefs: 004120E2
($L, xrefs: 00411FEF
StartStopProgress - Embedded, xrefs: 00412030
StartStopProgress - Fallback - %d of %d, xrefs: 0041217C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeH_prolog3_LastString$MessageSendVersion
String ID: ($L$($L$,)L$,)L$..\..\Shared\Setup\IsPreReqDlg.cpp$StartStopProgress - Embedded$StartStopProgress - Embedded Looping$StartStopProgress - Fallback - %d of %d
API String ID: 769765983-2596520546
Opcode ID: 804147d270f87c43fad35cf7d6f38dbbf6a46b8690604770374035d4fbf9cf34
Instruction ID: 40e4e5e903a864b9558478d23a3c2e15305b9d0ea7ed216fc3a8d56f68a71b00
Opcode Fuzzy Hash: 804147d270f87c43fad35cf7d6f38dbbf6a46b8690604770374035d4fbf9cf34
Instruction Fuzzy Hash: EB81B270940254BFDB25DB60CD46FEEBBB8AF05304F14416FF646A62E1CBB85A85CB18

Function 004887D0 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 188stringwindowCOMMON

Download Yara Rule

APIs

GetPropW.USER32(?,PROP_PSKIN), ref: 004887F7
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00488822
CopyRect.USER32(?,?), ref: 00488835
GetWindowDC.USER32(?), ref: 00488847
SaveDC.GDI32(00000000), ref: 00488851
SelectObject.GDI32(?,00000000), ref: 00488861
SetBkMode.GDI32(?,00000001), ref: 0048886C
_memset.LIBCMT ref: 00488888
GetWindowTextW.USER32(?,?,00000400), ref: 0048889F
SetTextColor.GDI32(?,?), ref: 0048894F
lstrlenW.KERNEL32(?,?,00000025,?,?,?), ref: 00488965
DrawTextW.USER32(?,?,00000000,?,?), ref: 00488972

Strings

PROP_PSKIN, xrefs: 004887EB

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Text$Window$ColorCopyDrawMessageModeObjectPropRectSaveSelectSend_memsetlstrlen
String ID: PROP_PSKIN
API String ID: 4252396310-87134567
Opcode ID: f803fbd8f955dcd3d5bf9fa8c3e7ecb64fbb154dd894e5bb84c0686e70971015
Instruction ID: eb938ae03f357a90aed2af319e716888e417c90ad2e21ef1b316a1492ac7e37b
Opcode Fuzzy Hash: f803fbd8f955dcd3d5bf9fa8c3e7ecb64fbb154dd894e5bb84c0686e70971015
Instruction Fuzzy Hash: D6717F71900609AFCB11DF64CD49A9ABBF8FF08304F0485AAE546936A0DF35AE95CFD4

Function 00408999 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 175sleepprocessstringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004089E6
lstrcpyW.KERNEL32(?,?), ref: 004089F6
CoCreateGuid.OLE32(?), ref: 00408A0B
wsprintfW.USER32 ref: 00408A63
_memset.LIBCMT ref: 00408A7C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00408AAA
WaitForInputIdle.USER32(?,00004E20), ref: 00408AC9
CloseHandle.KERNEL32(?), ref: 00408ADB
CloseHandle.KERNEL32(?), ref: 00408AE3
CreateItemMoniker.OLE32(004AD7C8,?,00000000), ref: 00408B1E
Sleep.KERNEL32(0000012C), ref: 00408B2F
GetRunningObjectTable.OLE32(00000000,00000000), ref: 00408B43
Sleep.KERNEL32(0000012C), ref: 00408B73
SysFreeString.OLEAUT32(?), ref: 00408BD6
SysFreeString.OLEAUT32(?), ref: 00408BDE

Strings

%s %s:%s, xrefs: 00408A5D
D, xrefs: 00408AA0

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Create$CloseFreeHandleSleepString_memset$GuidIdleInputItemMonikerObjectProcessRunningTableWaitlstrcpywsprintf
String ID: %s %s:%s$D
API String ID: 1856294533-3221625341
Opcode ID: 7a60283c970dea90571228d1562e52fbacf60ffe18a6fccc6462f07bfc52db92
Instruction ID: 1afbd862d99dd37be696037771f1fb9238bc2d6e0dd30b922ea341f91e24d8c1
Opcode Fuzzy Hash: 7a60283c970dea90571228d1562e52fbacf60ffe18a6fccc6462f07bfc52db92
Instruction Fuzzy Hash: 69615D76900129ABCF20DF60CD44B9AB7F9BF48315F0480EAE989A7251DE35AE45CFD4

Function 00410867 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 246synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00403F50: GetLastError.KERNEL32 ref: 00403F6F
Part of subcall function 00403F50: SetLastError.KERNEL32(?), ref: 00403F9F

Part of subcall function 004117F5: __EH_prolog3_GS.LIBCMT ref: 004117FF
Part of subcall function 004117F5: GetCommandLineW.KERNEL32 ref: 0041197A

GetModuleFileNameW.KERNEL32(00000000,?,00000400,000000FF), ref: 004108DB

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040E10B: __EH_prolog3_GS.LIBCMT ref: 0040E112

Part of subcall function 0040E08E: __EH_prolog3_GS.LIBCMT ref: 0040E095

_memset.LIBCMT ref: 00410A67
ShellExecuteExW.SHELL32(?), ref: 00410AE8
WaitForInputIdle.USER32(?,00002710), ref: 00410AFD
ShowWindow.USER32(00000000,00000000), ref: 00410B0F

Part of subcall function 00411707: __EH_prolog3_GS.LIBCMT ref: 00411711
Part of subcall function 00411707: IsWindow.USER32(?), ref: 0041172D
Part of subcall function 00411707: SendMessageW.USER32(?,00001074,?,?), ref: 004117D2
Part of subcall function 00411707: SendMessageW.USER32(?,0000101E,00000000,000000FE), ref: 004117DD

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410B1D
GetExitCodeProcess.KERNEL32(?,?), ref: 00410B30
CloseHandle.KERNEL32(?), ref: 00410B3C

Strings

Prerequisites need elevation; launching elevated with arguments: %s, xrefs: 00410A3B
,)L, xrefs: 004108A7
..\..\Shared\Setup\IsPreReqDlg.cpp, xrefs: 00410A41
/runprerequisites", xrefs: 0041092B
x$L, xrefs: 0041090E, 00410916
($L, xrefs: 0041146C
pJ, xrefs: 00410AB4
/debuglog", xrefs: 004109C5

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_Last$MessageSendWaitWindow$CloseCodeCommandExecuteExitFileHandleIdleInputLineModuleNameObjectProcessShellShowSingle_memset
String ID: /debuglog"$ /runprerequisites"$($L$,)L$..\..\Shared\Setup\IsPreReqDlg.cpp$Prerequisites need elevation; launching elevated with arguments: %s$pJ$x$L
API String ID: 724187610-59452753
Opcode ID: 91aed6808bea0d169d85639e2b9801bd1afd4df30c543b5f9533f7e25dfcc3ce
Instruction ID: 421725123b3175ed05f858fab9274c3ba763bf469c7bb2ef1212b8638da026dc
Opcode Fuzzy Hash: 91aed6808bea0d169d85639e2b9801bd1afd4df30c543b5f9533f7e25dfcc3ce
Instruction Fuzzy Hash: DEB18071901259AFDB10EB65DC45FDAB7B8BF04304F0081EAE54AB7192DB74AB84CF98

Function 0040C030 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 245COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040C03A

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

Part of subcall function 0040B1DA: __EH_prolog3_GS.LIBCMT ref: 0040B1E4
Part of subcall function 0040B1DA: GetTempPathW.KERNEL32(00000104,?,000003C4,0040C0BA,x$L,00000000,setup.log,?,00000000), ref: 0040B200
Part of subcall function 0040B1DA: __CxxThrowException@8.LIBCMT ref: 0040B221
Part of subcall function 0040B1DA: _memset.LIBCMT ref: 0040B233
Part of subcall function 0040B1DA: GetVersionExW.KERNEL32(?), ref: 0040B24C
Part of subcall function 0040B1DA: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000), ref: 0040B2CD

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

ResponseResult, xrefs: 0040C2EA
setup.log, xrefs: 0040C091
x$L, xrefs: 0040C0BE, 0040C0E5, 0040C10C
ErrorInfo, xrefs: 0040C341
InstallShield Silent, xrefs: 0040C233, 0040C238, 0040C2A3
File, xrefs: 0040C217
x$L, xrefs: 0040C144, 0040C147
ResultCode, xrefs: 0040C2D2
Version, xrefs: 0040C283
Log File, xrefs: 0040C1F9
ExtendedError, xrefs: 0040C35D
v7.00, xrefs: 0040C265
x$L, xrefs: 0040C09C
x$L, xrefs: 0040C148, 0040C167, 0040C0A9, 0040C117, 0040C0B0, 0040C14E
x$L, xrefs: 0040C319

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$FreeH_prolog3String$CreateException@8FilePathTempThrowVersion_memset
String ID: ErrorInfo$ExtendedError$File$InstallShield Silent$Log File$ResponseResult$ResultCode$Version$setup.log$v7.00$x$L$x$L$x$L$x$L$x$L
API String ID: 2783467436-1835247442
Opcode ID: 739eb2b140ce769a763c80289ab014d03a5c85020da5e25cc876166e307e0ecf
Instruction ID: a6ba6b350eee06d8406341e7fa78967891937e1ece78f0e5bb9d33ea4d16e8e7
Opcode Fuzzy Hash: 739eb2b140ce769a763c80289ab014d03a5c85020da5e25cc876166e307e0ecf
Instruction Fuzzy Hash: 0AA1B470A41118EEEB05EBA5C856FDDBB78AF15304F1000DEE449671C2DBB95F48CBA6

Function 004398B8 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 417COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004398C2
_memset.LIBCMT ref: 004398E7
SHGetSpecialFolderLocation.SHELL32(00000000,004C2418,?,?,00000000,00000000), ref: 00439905
SHGetPathFromIDListW.SHELL32(?,?), ref: 00439923
SHGetMalloc.SHELL32(?), ref: 00439930

Part of subcall function 0043B5B1: __EH_prolog3_GS.LIBCMT ref: 0043B5BB
Part of subcall function 0043B5B1: _memset.LIBCMT ref: 0043B5E1
Part of subcall function 0043B5B1: RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,?), ref: 0043B603
Part of subcall function 0043B5B1: RegQueryValueExW.ADVAPI32(?,CommonFilesDir,00000000,00000000,?,?), ref: 0043B642

Part of subcall function 0043B1EA: GetFileAttributesW.KERNEL32(004AD950,004399C2,?,?,00000000), ref: 0043B1F6

GetVersion.KERNEL32(?,?,00000000), ref: 00439C77
GetVersion.KERNEL32(?,?,00000000), ref: 00439DFF
GetVersion.KERNEL32(00000000,?,00000000,?), ref: 00439EE6

Part of subcall function 0040B3EC: __EH_prolog3_GS.LIBCMT ref: 0040B3F6
Part of subcall function 0040B3EC: GetModuleHandleW.KERNEL32(KERNEL32.DLL,00000274,00439E16,?,00000000), ref: 0040B419
Part of subcall function 0040B3EC: GetProcAddress.KERNEL32(00000000,GetSystemWindowsDirectoryW), ref: 0040B42D

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

All Users\, xrefs: 00439D66
Program Files, xrefs: 00439C6D
Common Files\, xrefs: 00439B5F
Personal\, xrefs: 00439EF0
Application Data\, xrefs: 00439D9A
My Documents\, xrefs: 00439E53
Fonts, xrefs: 00439DBB

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_Version$ErrorFreeLastString_memset$AddressAttributesFileFolderFromHandleListLocationMallocModuleOpenPathProcQuerySpecialValue
String ID: All Users\$Application Data\$Common Files\$Fonts$My Documents\$Personal\$Program Files
API String ID: 1011625025-157871694
Opcode ID: 72d85319ab9fcd438da79dc4f2dd29d5855ed6c155e2d882fd9ba2667067140f
Instruction ID: 3526afce7aed2ccbceb725b7460c4a6d43a472841ba9ea6f5e899f94cfef833e
Opcode Fuzzy Hash: 72d85319ab9fcd438da79dc4f2dd29d5855ed6c155e2d882fd9ba2667067140f
Instruction Fuzzy Hash: BA028E719041589ADB25EB61CC59BDEB7B8AF19304F0401DFE14A63292EF786F88CF19

Function 00499570 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 203filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0049959A
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004995D8
ReadFile.KERNEL32(00000000,?,0000000C,00000004,00000000), ref: 0049961B
ReadFile.KERNEL32(00000000,?,00000004,0000000C,00000000), ref: 00499645
GlobalAlloc.KERNEL32(00000042,00000408), ref: 00499664
GlobalLock.KERNEL32(00000000), ref: 00499671
ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000), ref: 00499686
ReadFile.KERNEL32(00000000,00000004,?,00000004,00000000), ref: 004996B8

Strings

RIFF, xrefs: 004995FC

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: File$Read$Global$AllocCreateLock
String ID: RIFF
API String ID: 3955436798-110600796
Opcode ID: afaec6ec3c278b05be88a7cb5febd42ebc3a7b6c99a19acd7b6b72031dd3ff17
Instruction ID: bba2a50bc21ec0234a90251e341d3504d38d609b466854fb56bbb4a216f8c27f
Opcode Fuzzy Hash: afaec6ec3c278b05be88a7cb5febd42ebc3a7b6c99a19acd7b6b72031dd3ff17
Instruction Fuzzy Hash: 51617671A00118ABDF24DB69DC42FEA77A8DF09714F0041FAEA05D61C0DBB59E85CFA9

Function 00408BF3 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 108stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00408C25
_memset.LIBCMT ref: 00408C4F
lstrcpyW.KERNEL32(?,?), ref: 00408C5F
_wcschr.LIBCMT ref: 00408C6E
GetModuleFileNameW.KERNEL32(?,?,00000208), ref: 00408C86
_wcsrchr.LIBCMT ref: 00408C95
wsprintfW.USER32 ref: 00408CB3
GetModuleHandleW.KERNEL32(?), ref: 00408CC3
CoLoadLibrary.OLE32(00000000,00000001), ref: 00408CE5
SysFreeString.OLEAUT32(?), ref: 00408CF3

Strings

($K, xrefs: 00408D02
%s\%s, xrefs: 00408CAD
DllGetClassObject, xrefs: 00408D21
..\..\..\inc\CoCreate.cpp, xrefs: 00408D0A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Module$FileFreeHandleLibraryLoadNameString_memset_wcschr_wcsrchrlstrcpylstrlenwsprintf
String ID: %s\%s$($K$..\..\..\inc\CoCreate.cpp$DllGetClassObject
API String ID: 836880797-1851429480
Opcode ID: e3188b174d964709aded9ce4f99434b685b6c73a543e62a34950e6e3f1413a28
Instruction ID: d9df6330bf8deb04591834aac313b44d63c9cb879512d704a8fb1f8999edba55
Opcode Fuzzy Hash: e3188b174d964709aded9ce4f99434b685b6c73a543e62a34950e6e3f1413a28
Instruction Fuzzy Hash: C53196B5D01318ABDF109BA4DC49EDA77B8EF19301F0045BAF905E3192DB789E448F69

Function 00430F26 Relevance: 25.9, APIs: 17, Instructions: 401windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00430F30
SendMessageW.USER32(?,0000000C,00000000,?), ref: 00430FCF
SendMessageW.USER32(?,00000111,00000011,00000000), ref: 004310F1

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: MessageSend$H_prolog3_
String ID:
API String ID: 3491702567-0
Opcode ID: e9c06247e2a64d3da551e7370dbe6fb7fbaec5e6d09d074f22b22f4ab48eddb7
Instruction ID: 9740e2e6ea876a0de4b6e6f6b69dff1b9a3ec4f761475ff4a819a95b59fb080c
Opcode Fuzzy Hash: e9c06247e2a64d3da551e7370dbe6fb7fbaec5e6d09d074f22b22f4ab48eddb7
Instruction Fuzzy Hash: F1E11770A40615AFEB389B55CCC9BAEB7B4FF1C344F10505BE90692AA1D738AD80CF59

Function 00411D94 Relevance: 25.7, APIs: 17, Instructions: 154COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00411DC2
GetDlgItem.USER32(000003EC,?), ref: 00411DEE
GetWindowRect.USER32(00000000), ref: 00411DF7
GetDlgItem.USER32(0000012D), ref: 00411E04
GetWindowRect.USER32(00000000,?), ref: 00411E10
ScreenToClient.USER32(?), ref: 00411E4F
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000004), ref: 00411E62
GetDlgItem.USER32(000003EB), ref: 00411E73
GetWindowRect.USER32(00000000,?), ref: 00411E80
GetWindowRect.USER32(?,?), ref: 00411E99
ScreenToClient.USER32(?), ref: 00411ED0
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000004), ref: 00411EE3
GetDlgItem.USER32(0000040B), ref: 00411EF4
GetWindowRect.USER32(00000000,?), ref: 00411F08
GetWindowRect.USER32(00000000,?), ref: 00411F0F
ScreenToClient.USER32(?), ref: 00411F4B
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00411F60

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window$Rect$Item$ClientScreen
String ID:
API String ID: 1521148189-0
Opcode ID: 944d1c80aec1c238abfec12c9af41b3e6c00c060b168726ff34753a248653d65
Instruction ID: 0da656bdb54757925447cfc54b848efc3f4332cc64ce763699797763487b4825
Opcode Fuzzy Hash: 944d1c80aec1c238abfec12c9af41b3e6c00c060b168726ff34753a248653d65
Instruction Fuzzy Hash: 0F51D872D00218BFDF109FE5ED44AAEBFB9EB49304F14412AEA01B7251CB75A905CF68

Function 0043614A Relevance: 25.6, APIs: 17, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000018,?), ref: 0043617C
GetDesktopWindow.USER32 ref: 00436186
GetClientRect.USER32(00000000), ref: 0043618D
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 004361B4
GetDC.USER32(?), ref: 004361D7
GetObjectW.GDI32(00000018,?), ref: 004361EE
CreateCompatibleDC.GDI32(00000000), ref: 004361F5
UnrealizeObject.GDI32(00000000), ref: 00436212
SelectPalette.GDI32(00000000,00000000), ref: 00436222
RealizePalette.GDI32(00000000), ref: 0043622B
UnrealizeObject.GDI32 ref: 00436233
SelectPalette.GDI32(?,00000000), ref: 00436241
RealizePalette.GDI32(?), ref: 00436244
SelectObject.GDI32(00000000), ref: 00436252
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00436269
ReleaseDC.USER32(?,00000000), ref: 00436273
DeleteDC.GDI32(00000000), ref: 0043627A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Object$Palette$Select$RealizeUnrealizeWindow$ClientCompatibleCreateDeleteDesktopMoveRectRelease
String ID:
API String ID: 366568439-0
Opcode ID: 6aca9d0050495020cf62b20388505b259804d863576dfca81dc953f1fa03c05d
Instruction ID: 506e38027091e58fef5ab087e1cf92a8c6e724c6df4f11dc19d840dc2b447835
Opcode Fuzzy Hash: 6aca9d0050495020cf62b20388505b259804d863576dfca81dc953f1fa03c05d
Instruction Fuzzy Hash: 0B413A71900219BFCB11ABA5EC48DAF7FB9EB8E715F158026F502A3161CB749901CF68

Function 0042C661 Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 342registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042C66B

Part of subcall function 00403F50: GetLastError.KERNEL32 ref: 00403F6F
Part of subcall function 00403F50: SetLastError.KERNEL32(?), ref: 00403F9F

RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,00000004), ref: 0042C8CD

Strings

($L, xrefs: 0042C6A7
HKEY_CLASSES_ROOT, xrefs: 0042C75F
HKEY_CURRENT_CONFIG, xrefs: 0042C7DA
HKEY_CURRENT_USER, xrefs: 0042C77A
HKEY_USERS, xrefs: 0042C7AA
, xrefs: 0042CA26
HKEY_LOCAL_MACHINE, xrefs: 0042C792
T"L, xrefs: 0042C9D0, 0042C9D3, 0042C9E4
,)L, xrefs: 0042C6AE
, xrefs: 0042CAF6
HKEY_PERFORMANCE_DATA, xrefs: 0042C7C2
HKEY_DYN_DATA, xrefs: 0042C7F2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_QueryValue
String ID: $ $($L$,)L$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_DYN_DATA$HKEY_LOCAL_MACHINE$HKEY_PERFORMANCE_DATA$HKEY_USERS$T"L
API String ID: 2669483599-238781603
Opcode ID: f81eb06eb55e52d90dbc984b38b5f93293d22fc3528ef0a9fe6f2909bc85c426
Instruction ID: 671fd3735ee431d75bbc0d4c2013263fd56c129d2a6c47d9fea91f2e881a9789
Opcode Fuzzy Hash: f81eb06eb55e52d90dbc984b38b5f93293d22fc3528ef0a9fe6f2909bc85c426
Instruction Fuzzy Hash: BDD1B071A00229DFDF24DF55DC81BAEB774AF11304F5440ABE809A7281DB789E88CF5A

Function 00461AFC Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00464914: __getptd_noexit.LIBCMT ref: 00464915
Part of subcall function 00464914: __amsg_exit.LIBCMT ref: 00464922

_wcscmp.LIBCMT ref: 00461BE2
_wcscmp.LIBCMT ref: 00461BF8
___lc_wcstolc.LIBCMT ref: 00461C24
___get_qualified_locale.LIBCMT ref: 00461C49

Part of subcall function 0046DC40: _TranslateName.LIBCMT ref: 0046DC80
Part of subcall function 0046DC40: _GetLocaleNameFromLangCountry.LIBCMT ref: 0046DC99
Part of subcall function 0046DC40: _TranslateName.LIBCMT ref: 0046DCB4
Part of subcall function 0046DC40: _GetLocaleNameFromLangCountry.LIBCMT ref: 0046DCCA
Part of subcall function 0046DC40: IsValidCodePage.KERNEL32(00000000,?,?,00000055,?,?,00461C4E,?,?,?,?,00000004,?,00000000), ref: 0046DD1E

GetACP.KERNEL32(?,?,?,?,?,00000004,?,00000000), ref: 00461CE0
_memmove.LIBCMT ref: 00461D96
__lock.LIBCMT ref: 00461E0A
InterlockedDecrement.KERNEL32(00000000), ref: 00461E1D
_free.LIBCMT ref: 00461E33
__lock.LIBCMT ref: 00461E4C
___removelocaleref.LIBCMT ref: 00461E5B
___freetlocinfo.LIBCMT ref: 00461E74
_free.LIBCMT ref: 00461E87

Strings

@xM, xrefs: 00461E6C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Name$CountryFromLangLocaleTranslate__lock_free_wcscmp$CodeDecrementInterlockedPageValid___freetlocinfo___get_qualified_locale___lc_wcstolc___removelocaleref__amsg_exit__getptd_noexit_memmove
String ID: @xM
API String ID: 1815561178-1615895041
Opcode ID: 7c46043d4edf906e4118f468bba9b4f39feb09e0e082862e5d660a0f4c83f6c6
Instruction ID: f7214e89eb8ab2b407343c03861dbc924439d5c81050e8e163542fa79081c079
Opcode Fuzzy Hash: 7c46043d4edf906e4118f468bba9b4f39feb09e0e082862e5d660a0f4c83f6c6
Instruction Fuzzy Hash: 1C91BA71900255ABDB209F65CC41BEF77B8AF54314F18009BFC09A2262FB79DE40CB5A

Function 0041D654 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041D65B
_wcsstr.LIBCMT ref: 0041D6EA
CharNextW.USER32(?,?,00000000,00000001,?,00000060,0041F9D7,?,00000000), ref: 0041D6FB
CharNextW.USER32(00000000,?,?,00000000,00000001,?,00000060,0041F9D7,?,00000000), ref: 0041D700
CharNextW.USER32(00000000,?,?,00000000,00000001,?,00000060,0041F9D7,?,00000000), ref: 0041D705
CharNextW.USER32(00000000,?,?,00000000,00000001,?,00000060,0041F9D7,?,00000000), ref: 0041D70A
CharNextW.USER32(00000000,}},?,00000000,00000001,?,00000060,0041F9D7,?,00000000), ref: 0041D7B2
CharNextW.USER32(?,00000000), ref: 0041D840
CharNextW.USER32(?,00000000,00000001,?,00000060,0041F9D7,?,00000000), ref: 0041D854
CoTaskMemFree.OLE32(?,00000060,0041F9D7,?,00000000), ref: 0041D892

Strings

HKCU{Software{Classes, xrefs: 0041D70C
}}, xrefs: 0041D78E
HKCR, xrefs: 0041D6E3

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CharNext$FreeH_prolog3_Task_wcsstr
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 2086807494-1142484189
Opcode ID: 716066d458e58d7a6ff5e7031634968f7703534dcd1aec0a586ad8ca15b521f9
Instruction ID: fadafca5ef7547899844394b3dadec47463df69fbf3c981936788dc405f405c5
Opcode Fuzzy Hash: 716066d458e58d7a6ff5e7031634968f7703534dcd1aec0a586ad8ca15b521f9
Instruction Fuzzy Hash: 2B7191B0D043469EDF15AFE5C881AEEBBB4AF15344F24002BE815AB385EB799C84C758

Function 0044410A Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00444111

Part of subcall function 00443FE7: GetVersionExW.KERNEL32(?,?,00000000), ref: 00444019

Strings

Windows 8.1 / Server 2012 R2, xrefs: 004441DD
Windows 2000, xrefs: 00444184
Windows 7 / Server 2008 R2, xrefs: 004441EB
Windows Vista / Server 2008, xrefs: 004441F2
Windows Server 2003, xrefs: 004441F9
Windows 95, xrefs: 004441A0
application could not be verified because it was not signed by the publisher. You should continue only if you can identify the p, xrefs: 004441AE
Windows NT 4.0, xrefs: 0044418B
x$L, xrefs: 00444207, 0044420A
Windows 8 / Server 2012, xrefs: 004441E4
Windows Me, xrefs: 00444192
Windows XP, xrefs: 004441A7
Windows 98, xrefs: 00444199

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_Version
String ID: Windows 2000$Windows 7 / Server 2008 R2$Windows 8 / Server 2012$Windows 8.1 / Server 2012 R2$Windows 95$Windows 98$Windows Me$Windows NT 4.0$Windows Server 2003$Windows Vista / Server 2008$Windows XP$application could not be verified because it was not signed by the publisher. You should continue only if you can identify the p$x$L
API String ID: 3152847492-2913533591
Opcode ID: 5c86b4d86ae0405727cd2e0beb72248be03fb4de5cc76f07edeacf5a89a18a30
Instruction ID: 0c53f3662ef83d5f08e6f4675173b540ed74fa03b714021d996534fc8c4c389d
Opcode Fuzzy Hash: 5c86b4d86ae0405727cd2e0beb72248be03fb4de5cc76f07edeacf5a89a18a30
Instruction Fuzzy Hash: 0821FC76900329A6FB149A58898DBEDB2606BA0344F24403BE801776C0CABC1DC7C6AE

Function 00469563 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 0046956B
_free.LIBCMT ref: 00469584

Part of subcall function 0045D1D6: RtlFreeHeap.NTDLL(00000000,00000000), ref: 0045D1EA
Part of subcall function 0045D1D6: GetLastError.KERNEL32(00000000), ref: 0045D1FC

_free.LIBCMT ref: 00469597
_free.LIBCMT ref: 004695B5
_free.LIBCMT ref: 004695C7
_free.LIBCMT ref: 004695D8
_free.LIBCMT ref: 004695E3
_free.LIBCMT ref: 00469605
EncodePointer.KERNEL32(000000FF), ref: 0046960D
_free.LIBCMT ref: 00469622
_free.LIBCMT ref: 00469638
InterlockedDecrement.KERNEL32 ref: 0046964A
_free.LIBCMT ref: 00469664

Strings

H}, xrefs: 00469655, 0046966A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _free$Pointer$DecodeDecrementEncodeErrorFreeHeapInterlockedLast
String ID: H}
API String ID: 4264854383-2439041442
Opcode ID: 3eb2b09f2e536865d6d61781efbb6fbca409ef4a0af922fb37927f8e2aba2aeb
Instruction ID: 8704ace4733bf547804f36cc43e8402896e1b15b040043c9f7276cc74f5c21e7
Opcode Fuzzy Hash: 3eb2b09f2e536865d6d61781efbb6fbca409ef4a0af922fb37927f8e2aba2aeb
Instruction Fuzzy Hash: 6D219C72D02665ABCB726F26FC4851A37B8BB06325314013FEC06D7361E7789C44CA5D

Function 00461F7A Relevance: 24.1, APIs: 16, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00461F91

Part of subcall function 004699AC: __calloc_impl.LIBCMT ref: 004699BB
Part of subcall function 004699AC: Sleep.KERNEL32(00000000,?,00464954,00000001,000003BC), ref: 004699D2

__calloc_crt.LIBCMT ref: 00461FB5
_free.LIBCMT ref: 00461FC3
__calloc_crt.LIBCMT ref: 00461FD1
_free.LIBCMT ref: 00461FE1
_free.LIBCMT ref: 00461FE7
__copytlocinfo_nolock.LIBCMT ref: 00461FF6
__wsetlocale_nolock.LIBCMT ref: 00462003
___removelocaleref.LIBCMT ref: 00462011
___freetlocinfo.LIBCMT ref: 00462018
_free.LIBCMT ref: 0046201E
__setmbcp_nolock.LIBCMT ref: 00462030
_free.LIBCMT ref: 0046203E
___removelocaleref.LIBCMT ref: 00462045
___freetlocinfo.LIBCMT ref: 0046204C
_free.LIBCMT ref: 00462052

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$Sleep__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 2661855409-0
Opcode ID: d017d07c56176f7c4d948bedcae9255476c01a3015885833b3e1adf0eddcb009
Instruction ID: 7385ff350e9ebc5b8a5c0661061bb9941598d585f0ae5dd4f9972f2182b03251
Opcode Fuzzy Hash: d017d07c56176f7c4d948bedcae9255476c01a3015885833b3e1adf0eddcb009
Instruction Fuzzy Hash: B0210231904A00FAEB363F22DD02A1B7BE5EF41759B20442FF885552A2FB7E8900D65F

Function 0041D1C4 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 324COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041D1CE

Part of subcall function 0040A206: __EH_prolog3_GS.LIBCMT ref: 0040A210

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00415D52: __EH_prolog3.LIBCMT ref: 00415D59

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

Part of subcall function 0041A703: __EH_prolog3_GS.LIBCMT ref: 0041A70D
Part of subcall function 0041A703: SysStringLen.OLEAUT32(?), ref: 0041A80D
Part of subcall function 0041A703: SysFreeString.OLEAUT32(?), ref: 0041A818

Part of subcall function 0041A703: SysFreeString.OLEAUT32(?), ref: 0041A853

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Strings

runfromtemp, xrefs: 0041D407
x$L, xrefs: 0041D500, 0041D503
installfromweb:, xrefs: 0041D55D
extract_all:, xrefs: 0041D38D
T"L, xrefs: 0041D3D3
auto, xrefs: 0041D43F
x$L, xrefs: 0041D255
T"L, xrefs: 0041D331
tempdisk1folder:, xrefs: 0041D2EA
delayedstart:, xrefs: 0041D270
media_path:, xrefs: 0041D4A0
no_engine, xrefs: 0041D45B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: String$ErrorLast$Free$H_prolog3_$H_prolog3$Alloc
String ID: T"L$T"L$auto$delayedstart:$extract_all:$installfromweb:$media_path:$no_engine$runfromtemp$tempdisk1folder:$x$L$x$L
API String ID: 2214887534-1351980935
Opcode ID: 85f459009249f4020a63589568f8bfec5e177bac08590541e2b796a941b5348f
Instruction ID: 4cbe7eb252a7ef0108d01b8fffaeba262338701b3abc305b9432accdbb8475be
Opcode Fuzzy Hash: 85f459009249f4020a63589568f8bfec5e177bac08590541e2b796a941b5348f
Instruction Fuzzy Hash: F2D1B670905268AECF14EBA1CC51BDEBB74AF12308F0441EEF145671D3DBB85A89CB69

Function 004117F5 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 248COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004117FF

Part of subcall function 004018F0: GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00401914
Part of subcall function 004018F0: RegCloseKey.KERNELBASE(00000000), ref: 00401977

GetCommandLineW.KERNEL32 ref: 0041197A

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040E229: __EH_prolog3_GS.LIBCMT ref: 0040E230
Part of subcall function 0040E229: __itow_s.LIBCMT ref: 0040E267
Part of subcall function 0040E229: SetLastError.KERNEL32(?,?,00000000,00000001), ref: 0040E296

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

x$L, xrefs: 004119DB, 004119EC, 00411B58, 00411B04, 00411AAE, 004119DE
x$L, xrefs: 0041189B, 004118D7
x$L, xrefs: 00411886, 0041188E
T"L, xrefs: 00411980
.exe, xrefs: 00411A39, 00411A3E, 00411A4A
Software\Microsoft\Windows\CurrentVersion, xrefs: 0041181F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 0041191C, 00411942
%%IS_PREREQ%%-%s, xrefs: 00411889
ISSetupPrerequisistes, xrefs: 00411B3D
x$L, xrefs: 004119A8, 004119B3, 004119C6, 00411B0A, 00411B24, 00411AB3, 00411ACD, 00411848, 004118EA, 0041184E, 004119B9, 00411AB9, 00411B10
x$L, xrefs: 004119E5, 00411B4D, 004119EB

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3_$CloseCommandHandleLineModule__itow_s
String ID: ISSetupPrerequisistes$%%IS_PREREQ%%-%s$.exe$Software\Microsoft\Windows\CurrentVersion$Software\Microsoft\Windows\CurrentVersion\RunOnce$T"L$x$L$x$L$x$L$x$L$x$L
API String ID: 1944748428-3513645468
Opcode ID: e0fb2e69700f8d4e6b8f72fd86cfff845bfa9d717adb50eac91e70892fa47378
Instruction ID: 82047fc53f002c1cb44539da2701e1c2d0571b8cd7508dd9b3d8177b07ac0240
Opcode Fuzzy Hash: e0fb2e69700f8d4e6b8f72fd86cfff845bfa9d717adb50eac91e70892fa47378
Instruction Fuzzy Hash: E6A15C71D0021CEEDB18EBA5CC91FEDB7B8AF14344F5040AEE515B21A1DB786E88CB65

Function 00499DD9 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 206stringCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00499E11
lstrcmpA.KERNEL32(?,GIF87a,?,?,?,75C0E860,?,F14A3287,?,?,00000000), ref: 00499E28
lstrcmpA.KERNEL32(?,GIF89a), ref: 00499E40
_memmove.LIBCMT ref: 00499E66
_memmove.LIBCMT ref: 00499E84
_memmove.LIBCMT ref: 00499EA3
_memmove.LIBCMT ref: 00499EC0
_memmove.LIBCMT ref: 00499EDD
_memset.LIBCMT ref: 00499F32
_memmove.LIBCMT ref: 00499F59
_memmove.LIBCMT ref: 00499F9F

Part of subcall function 0049A53E: __EH_prolog3.LIBCMT ref: 0049A545

Strings

GIF89a, xrefs: 00499E37
GIF87a, xrefs: 00499E22

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _memmove$lstrcmp$H_prolog3_memset
String ID: GIF87a$GIF89a
API String ID: 3198123400-2918331024
Opcode ID: efeff526edb0cab595d7521878abb95e7c44b825ba56867c92db2ca8acf3da82
Instruction ID: e0e8547f1c3c1908c62ffb6c181be3ac8ee196e5e0230b6859a2df892a1e9326
Opcode Fuzzy Hash: efeff526edb0cab595d7521878abb95e7c44b825ba56867c92db2ca8acf3da82
Instruction Fuzzy Hash: 9061F471A00206AFDF248F68C885BAAFFF5EF04304F24847FE885D6146E7398954CB59

Function 00418E7C Relevance: 21.4, APIs: 5, Strings: 7, Instructions: 440stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00418E86
_memmove.LIBCMT ref: 00418EA6

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp), ref: 00418EE2
__setjmp3.LIBCMT ref: 00418F03

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00419DCB: __EH_prolog3_GS.LIBCMT ref: 00419DD2

Part of subcall function 00418B6C: __EH_prolog3_GS.LIBCMT ref: 00418B76
Part of subcall function 00418B6C: _memmove.LIBCMT ref: 00418B9B
Part of subcall function 00418B6C: lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,?,?,00000000), ref: 00418BD0
Part of subcall function 00418B6C: __setjmp3.LIBCMT ref: 00418BF1

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 0040DF24: __EH_prolog3_GS.LIBCMT ref: 0040DF2E

Part of subcall function 0040B0F8: __EH_prolog3_GS.LIBCMT ref: 0040B0FF

Part of subcall function 0040A206: __EH_prolog3_GS.LIBCMT ref: 0040A210

Part of subcall function 00418B6C: _memmove.LIBCMT ref: 00418E5A

Part of subcall function 004090B1: __EH_prolog3_GS.LIBCMT ref: 004090B8

Part of subcall function 00417B68: __EH_prolog3.LIBCMT ref: 00417B6F

_memmove.LIBCMT ref: 0041947A

Strings

setup.cpp, xrefs: 00418EB9
layout.bin, xrefs: 00418F1B, 00418F25, 00418F40
.cab, xrefs: 004190EF, 00419168
x$L, xrefs: 00418F29
&, xrefs: 0041942A
x$L, xrefs: 00418F48
setup.inx, xrefs: 00419304, 00419309, 0041931E

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_$ErrorLast$FreeString_memmove$__setjmp3lstrcpy$H_prolog3_longjmp
String ID: &$.cab$layout.bin$setup.cpp$setup.inx$x$L$x$L
API String ID: 697873258-356224926
Opcode ID: 904aa472bcb7143d8bec7300eca32ee6d38b74e559626b070a05b3d0b1465151
Instruction ID: 2319998ea9398289585d6f81ca6658fd4a3e62e7493c65cedc01098ca7f47be2
Opcode Fuzzy Hash: 904aa472bcb7143d8bec7300eca32ee6d38b74e559626b070a05b3d0b1465151
Instruction Fuzzy Hash: 6C026E70A001589FDB14E7A5CD55BEDBBB9AF58344F0040EEE409A3292EB785F48CF66

Function 004507C8 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 229stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004507D2
MoveFileExW.KERNEL32(?,?,00000005), ref: 00450806
GetLastError.KERNEL32 ref: 00450814

Part of subcall function 004506E5: __EH_prolog3_GS.LIBCMT ref: 004506EC

Part of subcall function 004505E8: __EH_prolog3_GS.LIBCMT ref: 004505EF

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 004516A6: __EH_prolog3_GS.LIBCMT ref: 004516AD
Part of subcall function 004516A6: GetShortPathNameW.KERNEL32(?,00000000,00000104), ref: 0045170A
Part of subcall function 004516A6: __CxxThrowException@8.LIBCMT ref: 00451739

Part of subcall function 004501CE: __EH_prolog3_GS.LIBCMT ref: 004501D5

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

GetPrivateProfileSectionW.KERNEL32(rename,00000000,00001FFF,WININIT.INI), ref: 00450A17
GetPrivateProfileSectionW.KERNEL32(rename,00000000,?,00000000), ref: 00450A6E
lstrcpyW.KERNEL32(00001FFF,?), ref: 00450AA1
lstrlenW.KERNEL32(00001FFF), ref: 00450AA8
WritePrivateProfileSectionW.KERNEL32(rename,00000000,WININIT.INI), ref: 00450AC6
GetLastError.KERNEL32 ref: 00450AE1

Strings

WININIT.INI, xrefs: 00450976, 00450A04, 00450A5B, 00450AB4
NUL, xrefs: 00450829
rename, xrefs: 00450A0B, 00450A69, 00450ABC

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$PrivateProfileSection$FreeString$Exception@8FileH_prolog3H_prolog3_catch_MoveNamePathShortThrowWritelstrcpylstrlen
String ID: NUL$WININIT.INI$rename
API String ID: 3909151621-58278441
Opcode ID: eb3774e6033bb57810564dc377af1af26f52a156504fe4b71ea8a9e8ce1010f2
Instruction ID: b1e1c9a0d2352bfe16e4c7ef0163849e0c05383c84a3bae1bf000083f5a7e0f3
Opcode Fuzzy Hash: eb3774e6033bb57810564dc377af1af26f52a156504fe4b71ea8a9e8ce1010f2
Instruction Fuzzy Hash: D191A831900218EECB10EBA5CC55BDE77B8AF15345F5441AFF806A3192EB786B48CF69

Function 00414402 Relevance: 21.2, APIs: 14, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041440C
SetDlgItemTextW.USER32(?,00000002,-00000004), ref: 00414455
SetDlgItemTextW.USER32(?,000003F0,-00000004), ref: 004144B0
SetWindowTextW.USER32(?,-00000004), ref: 004144F7
GetDesktopWindow.USER32 ref: 00414515
GetClientRect.USER32(00000000), ref: 0041451C
GetWindowRect.USER32(?,?), ref: 00414527
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?,?,00000088), ref: 0041455B
GetDlgItem.USER32(?,00000009), ref: 00414566
EnableWindow.USER32(00000000), ref: 00414573
GetDlgItem.USER32(?,00000002), ref: 0041457C
EnableWindow.USER32(00000000), ref: 00414583
GetDlgItem.USER32(?,00000002), ref: 004145BA
IsWindowEnabled.USER32(00000000), ref: 004145C1

Part of subcall function 0040D135: __EH_prolog3_GS.LIBCMT ref: 0040D13F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Window$Item$Text$EnableH_prolog3_Rect$ClientDesktopEnabledMove
String ID:
API String ID: 3274798458-0
Opcode ID: c4574f23c52b781eed85fae057632e71b62eeb1e0f08ba35f44311e4a0ae3760
Instruction ID: 091c9f7dcb2d2840b396aa15791645da43d7761f994b6db94b7b7ba68af12690
Opcode Fuzzy Hash: c4574f23c52b781eed85fae057632e71b62eeb1e0f08ba35f44311e4a0ae3760
Instruction Fuzzy Hash: 04516071A00218AFDF14DFB8CD49EEE7BB9EB49315F00052AF506A7291DB78A944CF64

Function 00435E6E Relevance: 19.6, APIs: 13, Instructions: 118windowmemoryCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000018,?), ref: 00435E90
CreateCompatibleDC.GDI32(00000000), ref: 00435EB4
SelectObject.GDI32(00000000,?), ref: 00435EC4
GetDIBColorTable.GDI32(00000000,00000000,00000100,?), ref: 00435ED9
GlobalAlloc.KERNEL32(00000042,00000408), ref: 00435EE8
GlobalLock.KERNEL32(00000000), ref: 00435EF5
GetSystemPaletteEntries.GDI32(?,00000000,0000000A,00000004), ref: 00435F90
GetSystemPaletteEntries.GDI32(?,000000F6,0000000A,000003DC), ref: 00435FA1
CreatePalette.GDI32(00000000), ref: 00435FA4
DeleteDC.GDI32(?), ref: 00435FB0
GetDC.USER32(00000000), ref: 00435FC5
CreateHalftonePalette.GDI32(00000000), ref: 00435FCE
ReleaseDC.USER32(00000000,00000000), ref: 00435FDB

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Palette$Create$EntriesGlobalObjectSystem$AllocColorCompatibleDeleteHalftoneLockReleaseSelectTable
String ID:
API String ID: 1699956756-0
Opcode ID: 4da2ae3292a10efa287c4bee3cae2d2f1904b611d0a1fb95a6f0c8aeb922fb5c
Instruction ID: 903631ef789c333fc515251e88812b0fba195c98b2e21d04948930df1aa206cc
Opcode Fuzzy Hash: 4da2ae3292a10efa287c4bee3cae2d2f1904b611d0a1fb95a6f0c8aeb922fb5c
Instruction Fuzzy Hash: 1C412AB19041549FC7119F24DC84BEABFBCEF5A304F1480EAEB46A7242C6359907CF69

Function 00445004 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255processCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044500E
_memset.LIBCMT ref: 004450A7
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000044,004D88E0,?,00000000), ref: 0044511F
GetLastError.KERNEL32 ref: 0044513A
_memset.LIBCMT ref: 0044519A
ShellExecuteExW.SHELL32(0000003C), ref: 00445269
WaitForInputIdle.USER32(?,000003E8), ref: 004452E4
GetExitCodeProcess.KERNEL32(?,004D88DC), ref: 00445308
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00445312

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 0040B0F8: __EH_prolog3_GS.LIBCMT ref: 0040B0FF

Part of subcall function 00413A4F: __EH_prolog3_GS.LIBCMT ref: 00413A56

Strings

D, xrefs: 004450C1
<, xrefs: 004451B5

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$FreeProcessString_memset$CodeCreateExecuteExitIdleInputShellWait
String ID: <$D
API String ID: 120480887-1382654409
Opcode ID: 6bb1f6de96a1946c538b8e9039844abf47541759cb71755b16247d70ca37c8f8
Instruction ID: 6b578b2b53876cb3e69afdbcdff222ffbb3734bbb07d23302e42c4f96b83658e
Opcode Fuzzy Hash: 6bb1f6de96a1946c538b8e9039844abf47541759cb71755b16247d70ca37c8f8
Instruction Fuzzy Hash: 63A1A371800248EFDB11EF65CC45BDE7BB8AF15344F10406FF816A7292EB785A49CB69

Function 00450DB4 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 240registryfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00450DBE
wsprintfW.USER32 ref: 00450EDA
wsprintfW.USER32 ref: 00450EEF
wsprintfW.USER32 ref: 0045105E
wsprintfW.USER32 ref: 00451071
RegSetValueExW.ADVAPI32(?,Count,00000000,00000004,?,00000004), ref: 004510DB

Part of subcall function 0045033B: __EH_prolog3_GS.LIBCMT ref: 00450342

DeleteFileW.KERNEL32(?), ref: 00451113

Strings

source%d, xrefs: 00450EE9, 0045106B
dest%d, xrefs: 00450ED0, 00451058
Software\InstallShieldPendingOperation, xrefs: 00450E0F
Count, xrefs: 00450E28, 004510D0

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: wsprintf$H_prolog3_$DeleteFileValue
String ID: Count$Software\InstallShieldPendingOperation$dest%d$source%d
API String ID: 2703998930-4089646173
Opcode ID: 4c54b933635ecfa37b67bcd03c10d71c904dafb914d25dd0551262ebc686e1bb
Instruction ID: 4d0acd205c6d67496f9e3e646426d23601e65420b5efe276bef498b005a15080
Opcode Fuzzy Hash: 4c54b933635ecfa37b67bcd03c10d71c904dafb914d25dd0551262ebc686e1bb
Instruction Fuzzy Hash: 30A18DB18002199EDB24DB55CC86FE9B7B8AF15304F0041EEE559A7192EBB85AC8CF64

Function 00451150 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 179fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045115A
wsprintfW.USER32 ref: 0045129A
wsprintfW.USER32 ref: 004512AA
DeleteFileW.KERNEL32(?), ref: 004513BE
MoveFileExW.KERNEL32(?,?,00000001), ref: 004513EC
GetLastError.KERNEL32 ref: 004513F6

Strings

source%d, xrefs: 004512A4
dest%d, xrefs: 00451290
InstallShieldPendingOperation, xrefs: 004511D1, 00451425
Software, xrefs: 004511A1
Count, xrefs: 004511F3

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Filewsprintf$DeleteErrorH_prolog3_LastMove
String ID: Count$InstallShieldPendingOperation$Software$dest%d$source%d
API String ID: 2653183521-2585182305
Opcode ID: c61285af9141a7d587ce53e94939966223ef7bb8fce7375374cebe2aa58878dc
Instruction ID: 333a4b0cf8a9e4824a766f5be8b9d6ef07c12c2b26f97d477012fdfe2cc6dd15
Opcode Fuzzy Hash: c61285af9141a7d587ce53e94939966223ef7bb8fce7375374cebe2aa58878dc
Instruction Fuzzy Hash: 46819C70940229DEEB24DF65CC45BEDB7B4AF15304F0040EEE949A2192EBB85BC8CF65

Function 00419B6E Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 172stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00419B78
_memset.LIBCMT ref: 00419BC7
_memmove.LIBCMT ref: 00419BDF

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001), ref: 00419C14
__setjmp3.LIBCMT ref: 00419C35
_wcschr.LIBCMT ref: 00419C50
VariantClear.OLEAUT32(?), ref: 00419CB3
_wcsncpy.LIBCMT ref: 00419CCF

Part of subcall function 004174AD: SysAllocString.OLEAUT32(?), ref: 004174CE

Part of subcall function 00418943: _longjmp.LIBCMT ref: 00418969

VariantClear.OLEAUT32(?), ref: 00419D34
_memmove.LIBCMT ref: 00419D91

Strings

setup.cpp, xrefs: 00419BF0

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$String$ClearFreeVariant_memmove$AllocH_prolog3___setjmp3_longjmp_memset_wcschr_wcsncpylstrcpy
String ID: setup.cpp
API String ID: 217399626-2020632666
Opcode ID: e18e5d94750deb285da35031535535933d55fed33babe67890425daf6e928cc6
Instruction ID: def4a2fcae4409e2e8241ae21c2fc7d32b73f032f02d38350fc4eefc52ff375a
Opcode Fuzzy Hash: e18e5d94750deb285da35031535535933d55fed33babe67890425daf6e928cc6
Instruction Fuzzy Hash: 23616F759012199BDF20EBA4CD49FDEB7B8AF09304F0041DAF909AB291DB74AF848F55

Function 0042D735 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042D73F

Part of subcall function 00403F50: GetLastError.KERNEL32 ref: 00403F6F
Part of subcall function 00403F50: SetLastError.KERNEL32(?), ref: 00403F9F

#17.MSI(00000001,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0042D7CC
#125.MSI(00000000,00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0042D7EB
#171.MSI(?,00000000,00000000,?,?,00000104,00000000,00000000,?,00000001), ref: 0042D821
#171.MSI(?,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000104,00000000,00000000,?,00000001), ref: 0042D871
#8.MSI(00000000,?,00000000,00000000,?,?,00000104,00000000,00000000,?,00000001), ref: 0042D8A4

Strings

($L, xrefs: 0042D78F
,)L, xrefs: 0042D760
,)L, xrefs: 0042D796
($L, xrefs: 0042D759
,)L, xrefs: 0042D893

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: #171ErrorLast$#125H_prolog3_
String ID: ($L$($L$,)L$,)L$,)L
API String ID: 1627053364-3990172876
Opcode ID: b18277a5b2726c4546b280591e7b03f2cd8e0f29ba6a74fd0d15fd302f034848
Instruction ID: f58ee0240a4a372293c1bf5ef6f0b35b73da90ee956890db322ea10d40486555
Opcode Fuzzy Hash: b18277a5b2726c4546b280591e7b03f2cd8e0f29ba6a74fd0d15fd302f034848
Instruction Fuzzy Hash: E5419071D01258DEDB15EFA2C945BEEBBB8AF14308F54406EE505B7282DBB81A04CB69

Function 00402000 Relevance: 18.2, APIs: 12, Instructions: 160fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CE0: GetLastError.KERNEL32(F14A3287,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402D30
Part of subcall function 00402CE0: SetLastError.KERNEL32(?,004C2254,00000000,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402DA8

CreateFileW.KERNEL32(-00000004,C0000000,00000001,00000000,00000004,00000080,00000000,?,?,00000001,F14A3287), ref: 00402066
GetLastError.KERNEL32(?,?,00000001,F14A3287), ref: 00402079
SysFreeString.OLEAUT32(?), ref: 00402095
SysFreeString.OLEAUT32(?), ref: 004020A0
SetLastError.KERNEL32(?), ref: 004020C0
ReadFile.KERNEL32(00000000,00000000,00000002,00000000,00000000), ref: 004020F8
WriteFile.KERNEL32(00000000,00000000,00000002,?), ref: 0040213B
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00402172
GetLastError.KERNEL32 ref: 00402193
SysFreeString.OLEAUT32(?), ref: 004021A9
SysFreeString.OLEAUT32(?), ref: 004021B4
SetLastError.KERNEL32(?), ref: 004021D4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FileFreeString$Write$CreateRead
String ID:
API String ID: 2306213392-0
Opcode ID: 05c7c1de20b3a2be558086342db1d3f04fe4483881229f2b8ccaa4502dc8066e
Instruction ID: defd2f4fe5d5f554a18408f67aeaa135c02e919ed8e957a89b199dcc13a89d2c
Opcode Fuzzy Hash: 05c7c1de20b3a2be558086342db1d3f04fe4483881229f2b8ccaa4502dc8066e
Instruction Fuzzy Hash: 39512971E00248AFEB10DFA4DD49B9EBBB8EF09714F104029E911BB6A1D7B4A905CF59

Function 0042D037 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042D041

Strings

Launching MSI prerequisite %s, command line %s, xrefs: 0042D18B
K, xrefs: 0042D191
CSetupPreRequisite::ExecuteMsiWithProgress, xrefs: 0042D08E
,)L, xrefs: 0042D1BA
,)L, xrefs: 0042D0A0
($L, xrefs: 0042D0B8, 0042D0BB
,)L, xrefs: 0042D07A
..\..\Shared\Setup\SetupPreRequisite.cpp, xrefs: 0042D065
($L, xrefs: 0042D070

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_
String ID: ($L$($L$,)L$,)L$,)L$..\..\Shared\Setup\SetupPreRequisite.cpp$CSetupPreRequisite::ExecuteMsiWithProgress$Launching MSI prerequisite %s, command line %s$K
API String ID: 2427045233-716602132
Opcode ID: c840a9df1054591debfc567e10c5e47d3d8a4cefd7b337e2045d95c6e27104d7
Instruction ID: 2941a2eb01decae8623f846024003dcc8a5539c8246dc06f7b5cbf7407acb215
Opcode Fuzzy Hash: c840a9df1054591debfc567e10c5e47d3d8a4cefd7b337e2045d95c6e27104d7
Instruction Fuzzy Hash: 5E41A371A00228EFCB15EBA1CC45BEEBBB8AF05304F50009FE545A3191DB785B49CF69

Function 0044902A Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044912A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00449033), ref: 0044913D
Part of subcall function 0044912A: GetProcAddress.KERNEL32(00000000), ref: 00449144
Part of subcall function 0044912A: GetCurrentProcess.KERNEL32(00000000,?,?,?,00449033), ref: 00449154

GetModuleHandleW.KERNEL32(kernel32,Wow64DisableWow64FsRedirection), ref: 0044904D
GetProcAddress.KERNEL32(00000000), ref: 00449056
GetModuleHandleW.KERNEL32(kernel32,Wow64RevertWow64FsRedirection), ref: 00449061
GetProcAddress.KERNEL32(00000000), ref: 00449064

Strings

Wow64DisableWow64FsRedirection, xrefs: 00449042
Wow64EnableWow64FsRedirection, xrefs: 004490D7
Wow64RevertWow64FsRedirection, xrefs: 00449058
kernel32, xrefs: 00449047, 0044904C, 0044905D, 004490DC

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc$CurrentProcess
String ID: Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32
API String ID: 565683799-3439747844
Opcode ID: 66bc3201bc3274e99e043425ae3ffbe5a55372cec7871699f230247da2ea1912
Instruction ID: c64e6ebc0ed9733fa1da6ce042ff745a36136ef5eda6c98df09dcbab66a0b4a0
Opcode Fuzzy Hash: 66bc3201bc3274e99e043425ae3ffbe5a55372cec7871699f230247da2ea1912
Instruction Fuzzy Hash: FB11C3A1701305AAEB24ABA99C51AFF7B9CAB94345B10406BA501D3250DF7CCD05AB2D

Function 00459DDC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00459DEF

Part of subcall function 0045C2C1: std::exception::_Copy_str.LIBCMT ref: 0045C2DA

__CxxThrowException@8.LIBCMT ref: 00459E04

Part of subcall function 0045A275: RaiseException.KERNEL32(?,?,00459DDB,00000000,?,?,?,?,00459DDB,00000000,004D043C,?), ref: 0045A2C6

std::exception::exception.LIBCMT ref: 00459E1D
__CxxThrowException@8.LIBCMT ref: 00459E32
std::regex_error::regex_error.LIBCPMT ref: 00459E44

Part of subcall function 00459AB4: std::exception::exception.LIBCMT ref: 00459ACE

__CxxThrowException@8.LIBCMT ref: 00459E52
std::exception::exception.LIBCMT ref: 00459E6B
__CxxThrowException@8.LIBCMT ref: 00459E80

Strings

8kK, xrefs: 00459E79
bad function call, xrefs: 00459E86

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: 8kK$bad function call
API String ID: 2464034642-168189562
Opcode ID: 4a40c579515c506a630a39a1a9e706d6831e658a24e0d1baf6e72aa97a862477
Instruction ID: 1d97406533483a7ad8cad50a0d1a016bdf12ee94ca7b5d5b6ea48875769b54a1
Opcode Fuzzy Hash: 4a40c579515c506a630a39a1a9e706d6831e658a24e0d1baf6e72aa97a862477
Instruction Fuzzy Hash: C711CE75D0020CBB8F00EFA5D8969CD7BBCAA04344F50816BBD15D7242EB78A7588FE9

Function 004961F0 Relevance: 16.7, APIs: 6, Strings: 5, Instructions: 157COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(F14A3287,?,?,771AE010), ref: 00496238
SetLastError.KERNEL32(,)L), ref: 00496264
GetLastError.KERNEL32 ref: 00496282
SetLastError.KERNEL32(004C292C,00000000,00000000,000000FF), ref: 004962E4
GetLastError.KERNEL32 ref: 00496365
SetLastError.KERNEL32(004C2480), ref: 00496391

Strings

($L, xrefs: 00496271
,)L, xrefs: 0049627B
P$L, xrefs: 00496357
($L, xrefs: 0049622A
,)L, xrefs: 0049624C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast
String ID: ($L$($L$,)L$,)L$P$L
API String ID: 1452528299-93379509
Opcode ID: ca515650b5b63b067442571e6a7431d7f286d756add3da944ef450e511d1ac28
Instruction ID: e00ee0f1c15a4df0d6307a6e5da60630617a756b01cedd7efd7714c6cbcc7c86
Opcode Fuzzy Hash: ca515650b5b63b067442571e6a7431d7f286d756add3da944ef450e511d1ac28
Instruction Fuzzy Hash: 23613771D00258DFDB20CFA5C944BDEBBF4BB08318F50416EE419A7291DB786A48CF69

Function 00499030 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 242fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

__wcsnicmp.LIBCMT ref: 004990E6
__wcsnicmp.LIBCMT ref: 0049913F
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004991D2
GetFileSize.KERNEL32(00000000,?), ref: 004991F5
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00499232

Strings

.bmp, xrefs: 00499268
.dll, xrefs: 004990E0
s^I, xrefs: 00499030
.wmf, xrefs: 004992B7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: File$ErrorLast__wcsnicmp$CreateH_prolog3ReadSize
String ID: .bmp$.dll$.wmf$s^I
API String ID: 712479857-2131100726
Opcode ID: 90b6134e853bcb443c3e00d98bb7cf43d479f3b84cb75ed7fecd6038741f038e
Instruction ID: 15b7f5b42c3b183a3ae3624dfe0c02ccdf0ea8f4583c5cf50ce8f3ccb7ca7e33
Opcode Fuzzy Hash: 90b6134e853bcb443c3e00d98bb7cf43d479f3b84cb75ed7fecd6038741f038e
Instruction Fuzzy Hash: B981C571900214AAEF20EB69CC45FEE7B78AF05314F1401BFE815A32D1EB399E49CB59

Function 0042DD2A Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 213registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042DD34
RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Session Manager\Environment,00000000,00020019,?,000000B8,0042EBE7,?,($L), ref: 0042DD6D

Part of subcall function 00403F50: GetLastError.KERNEL32 ref: 00403F6F
Part of subcall function 00403F50: SetLastError.KERNEL32(?), ref: 00403F9F

Part of subcall function 004040F0: SysStringLen.OLEAUT32(?), ref: 004040FE
Part of subcall function 004040F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00404118

Part of subcall function 004040F0: _wmemcpy_s.LIBCMT ref: 00404145

RegEnumValueW.ADVAPI32(?,?,00000000,?,00000000,?,00000000,?,?,?,?,?), ref: 0042DEA1

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

RegEnumValueW.ADVAPI32(?,00000000,00000000,?,00000000,?,00000000,?,?,00000400,?,00000400), ref: 0042DF64

Part of subcall function 00403CF0: GetLastError.KERNEL32(F14A3287,?,00000000,771ADFA0,?,?,?,?,?,?,?,?,00000000,004ABB08,000000FF,,)L), ref: 00403D2F
Part of subcall function 00403CF0: GetLastError.KERNEL32(?,00000000,000000FF), ref: 00403DC9
Part of subcall function 00403CF0: SysFreeString.OLEAUT32(?), ref: 00403DE3
Part of subcall function 00403CF0: SysFreeString.OLEAUT32(?), ref: 00403DF0
Part of subcall function 00403CF0: SetLastError.KERNEL32(?), ref: 00403E14
Part of subcall function 00403CF0: SetLastError.KERNEL32(?,?,00000000,771ADFA0,?,?,?,?,?,?,?,?,00000000,004ABB08,000000FF,,)L), ref: 00403E1A

Strings

($L, xrefs: 0042DDAB, 0042DDC6, 0042DE45, 0042DFDB, 0042DFF3, 0042DF04, 0042DF96, 0042DFDE
,)L, xrefs: 0042DD86
SYSTEM\CurrentControlSet\Control\Session Manager\Environment, xrefs: 0042DD60
,)L, xrefs: 0042DFE7
($L, xrefs: 0042DD81

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$String$Free$EnumValue$AllocH_prolog3_Open_wmemcpy_s
String ID: ($L$($L$,)L$,)L$SYSTEM\CurrentControlSet\Control\Session Manager\Environment
API String ID: 802081060-4107071401
Opcode ID: 4612b02c66125b95c3f0054d51bcbce1f3c25dc5848fe9d1ab4de42126e2500b
Instruction ID: e3189ccd0285a4d13ffe5fdba4cc05da35b00e560443fa05311e58174a882163
Opcode Fuzzy Hash: 4612b02c66125b95c3f0054d51bcbce1f3c25dc5848fe9d1ab4de42126e2500b
Instruction Fuzzy Hash: 48916D71D00258DFDB25DBA4C891BEDBBB8BF58304F1040AEE54AB7282DB741A49CF65

Function 004521F6 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00452214
SysStringLen.OLEAUT32(?), ref: 00452227
SysStringLen.OLEAUT32(?), ref: 00452234
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0045223F
_memmove.LIBCMT ref: 00452254
SysStringLen.OLEAUT32(?), ref: 00452262
_memmove.LIBCMT ref: 00452282
SysFreeString.OLEAUT32(?), ref: 00452290

Strings

\C, xrefs: 004521F6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: String$Free_memmove$Alloc
String ID: \C
API String ID: 2303858246-3231473825
Opcode ID: 02c710289be61314264f1a0224ad54105e300d1f505edce4685b83814637dc11
Instruction ID: be32e7ebfe36d1bedf34f2f6182b8964f507b6f242738a3b9d49e843d6feb429
Opcode Fuzzy Hash: 02c710289be61314264f1a0224ad54105e300d1f505edce4685b83814637dc11
Instruction Fuzzy Hash: 05216A71A00304EFCB209F79DD8885ABFB8FF49365B10066AFC5693262D770A9189B94

Function 004550D6 Relevance: 15.2, APIs: 10, Instructions: 176fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004550DD
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00455111
ReadFile.KERNEL32(00000000,?,00000018,?,00000000), ref: 0045513C
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00455190
GetLastError.KERNEL32 ref: 004551AE
GetLastError.KERNEL32(?,?,?,00000001), ref: 004551EB

Part of subcall function 00453589: SetLastError.KERNEL32(0000007F), ref: 00453597

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001), ref: 00455217
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00455279
GetLastError.KERNEL32 ref: 004552A5

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

Part of subcall function 0045349C: SetLastError.KERNEL32(0000007F), ref: 004534AA

GetLastError.KERNEL32 ref: 004552BB

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$File$Read$CreateH_prolog3__malloc
String ID:
API String ID: 3956137664-0
Opcode ID: 16444cc92332f5f24b071997b90325965883be3cc726f112067d4ab127135106
Instruction ID: 332ce72f9a1cc6ea6749d18cbce2295972d75bee59da27918ec1d3df973eb120
Opcode Fuzzy Hash: 16444cc92332f5f24b071997b90325965883be3cc726f112067d4ab127135106
Instruction Fuzzy Hash: 13517F71C00609EFDB11AFE1CC45AEEBBB8EF14355F10416AF815A6292EB345A09CF59

Function 004886E0 Relevance: 15.1, APIs: 10, Instructions: 82windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00488704
ScreenToClient.USER32(?,?), ref: 00488716
ScreenToClient.USER32(?,?), ref: 0048872A
CreateCompatibleDC.GDI32(?), ref: 00488747
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0048875A
SelectObject.GDI32(00000000,00000000), ref: 00488764
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 00488787
CreatePatternBrush.GDI32(00000000), ref: 0048878E
DeleteObject.GDI32(00000000), ref: 00488797
DeleteDC.GDI32(00000000), ref: 0048879E

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Create$ClientCompatibleDeleteObjectScreen$BitmapBrushPatternRectSelectWindow
String ID:
API String ID: 3450704212-0
Opcode ID: fef63c53dbd55f67e08c0f1fc9b6b14b78e596b6200be3ebae865c00d6399cca
Instruction ID: 5640233de7067f84c3f29f19ff357dfea565817c26aeb877a1e66e78b8ba3015
Opcode Fuzzy Hash: fef63c53dbd55f67e08c0f1fc9b6b14b78e596b6200be3ebae865c00d6399cca
Instruction Fuzzy Hash: 6331C776D00219AFCB00DFA4DD899EEBFB9FF4D310F10406AE906A7221DA356945CB64

Function 0042C10F Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 365fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042C119

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

GetModuleHandleW.KERNEL32(?), ref: 0042C2B3

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

Part of subcall function 00423E83: __EH_prolog3.LIBCMT ref: 00423E8A

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00424A9A: __EH_prolog3_GS.LIBCMT ref: 00424AA4
Part of subcall function 00424A9A: __CxxThrowException@8.LIBCMT ref: 00424B09
Part of subcall function 00424A9A: GetFileSize.KERNEL32(?,?,00000108,00423B96,00000000,00000010,00423EFD,?,?,?,?,?,?,00000000), ref: 00424B12
Part of subcall function 00424A9A: GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00424B1F

CopyFileW.KERNEL32(?,00000004,00000000,?), ref: 0042C439

Strings

T"L, xrefs: 0042C2E2
($L, xrefs: 0042C236
,)L, xrefs: 0042C23D
($L, xrefs: 0042C13B
,)L, xrefs: 0042C142

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FileFreeH_prolog3H_prolog3_String$CopyException@8HandleModuleSizeThrow
String ID: ($L$($L$,)L$,)L$T"L
API String ID: 3870862371-1422120175
Opcode ID: 9655a81741cc3c58010bd89593b54b17c7a380221a07ac4c9cab2dc2b6362302
Instruction ID: d2dc7d387bb4760104be361c0ab7d4d46bf744be932d76c02b64b92c4d26acad
Opcode Fuzzy Hash: 9655a81741cc3c58010bd89593b54b17c7a380221a07ac4c9cab2dc2b6362302
Instruction Fuzzy Hash: 3AE16271A00128EEDF24EB65DD91BEEB7B4AF15304F9040DEE409A3181DB785B89CF69

Function 00421066 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 266COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00421070

Part of subcall function 0040DF24: __EH_prolog3_GS.LIBCMT ref: 0040DF2E

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 00418B6C: __EH_prolog3_GS.LIBCMT ref: 00418B76
Part of subcall function 00418B6C: _memmove.LIBCMT ref: 00418B9B
Part of subcall function 00418B6C: lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,?,?,00000000), ref: 00418BD0
Part of subcall function 00418B6C: __setjmp3.LIBCMT ref: 00418BF1

Strings

!, xrefs: 004213B8
open, xrefs: 00421315
T"L, xrefs: 0042134F
x$L, xrefs: 004210DA
x$L, xrefs: 00421330, 00421333
" -tempdisk1folder:", xrefs: 00421233
-media_path:", xrefs: 0042120B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_Last$FreeString$H_prolog3__setjmp3_memmovelstrcpy
String ID: -media_path:"$!$" -tempdisk1folder:"$T"L$open$x$L$x$L
API String ID: 2038878933-3067124534
Opcode ID: dce78df2267b06d48a49679d3bad9a1857502a77914aa86fcf4ecf39f9a04c57
Instruction ID: cb0960ec7e0c7d512088874a35a44fd71d4d320d2d9c90c6a339794ea2a8591b
Opcode Fuzzy Hash: dce78df2267b06d48a49679d3bad9a1857502a77914aa86fcf4ecf39f9a04c57
Instruction Fuzzy Hash: 3EB1C171910158AFDB15EBA4CC55BEDB7B8AF18344F1400EEF409A3292EB785F48CBA5

Function 004486F0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004486FA

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0044206D: __EH_prolog3_GS.LIBCMT ref: 00442077

GetLastError.KERNEL32 ref: 00448754

Part of subcall function 004484F8: __EH_prolog3.LIBCMT ref: 004484FF

GetLastError.KERNEL32 ref: 004487CC

Strings

x$L, xrefs: 0044872F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3H_prolog3_
String ID: x$L
API String ID: 852442433-723586279
Opcode ID: d06a77e5042d13f62a68d06fc8aaeb5f5952599c34452ae0955d6e7429144db7
Instruction ID: 10c626793c021a97cdd6f1b2f93e8f9f82b5781128f4ec21fcab593006d69023
Opcode Fuzzy Hash: d06a77e5042d13f62a68d06fc8aaeb5f5952599c34452ae0955d6e7429144db7
Instruction Fuzzy Hash: E18173B1900118DBDB10EF65CD42BEE7BB8AF15344F50409FF90A96192DF345A49CBAA

Function 0043D482 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043D489

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 0043D5BF

Part of subcall function 0040B6F4: __EH_prolog3.LIBCMT ref: 0040B6FB
Part of subcall function 0040B6F4: GetLastError.KERNEL32(00000004,00416579,00000008,00423143,004AD954,00000001,?,00000000), ref: 0040B714

__CxxThrowException@8.LIBCMT ref: 0043D50E

Part of subcall function 0045A275: RaiseException.KERNEL32(?,?,00459DDB,00000000,?,?,?,?,00459DDB,00000000,004D043C,?), ref: 0045A2C6

GetWindowsDirectoryW.KERNEL32(00000000,00000104,00000078,00495B01,?,00000000,F14A3287,?,?,?), ref: 0043D4E1

Part of subcall function 00409574: __EH_prolog3_GS.LIBCMT ref: 0040957B
Part of subcall function 00409574: GetLastError.KERNEL32(00000038,0040DCC8,004480DB,?,004AEF80), ref: 00409582
Part of subcall function 00409574: SetLastError.KERNEL32(00000000), ref: 004095D6

GetWindowsDirectoryW.KERNEL32(00000000,00000104,00000078,00495B01,?,00000000,F14A3287,?,?,?), ref: 0043D552

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

Strings

syswow64, xrefs: 0043D574
sysnative, xrefs: 0043D519
x$L, xrefs: 0043D593, 0043D596

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$Directory$H_prolog3_StringWindows$AllocExceptionException@8H_prolog3RaiseSystemThrow
String ID: sysnative$syswow64$x$L
API String ID: 415710860-3518608272
Opcode ID: b83142c2bce5ddda6c70a420d03d26769fc95ae27183ad67b1f0371e425e7a38
Instruction ID: ae9cdd591c00bdf6d367cc6a2cd10e7e343367a996e0c5efba7708a5bb96a04c
Opcode Fuzzy Hash: b83142c2bce5ddda6c70a420d03d26769fc95ae27183ad67b1f0371e425e7a38
Instruction Fuzzy Hash: AE41B670900248EFDB11EFA5C845BDDBBB4AF19308F50406FE44277292DFB85A09DB5A

Function 00448597 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044859E
GetModuleHandleW.KERNEL32(shell32.dll,SHFileOperationW,0000003C,00440423,?,00000000), ref: 004485BA
GetProcAddress.KERNEL32(00000000), ref: 004485C3
GetModuleHandleW.KERNEL32(shell32.dll,SHFileOperationA), ref: 00448651
GetProcAddress.KERNEL32(00000000), ref: 00448654

Part of subcall function 0040A0F0: SysStringLen.OLEAUT32(?), ref: 0040A0FD
Part of subcall function 0040A0F0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 0040A117

Part of subcall function 0043D0DD: _memset.LIBCMT ref: 0043D0EB

Part of subcall function 00409574: __EH_prolog3_GS.LIBCMT ref: 0040957B
Part of subcall function 00409574: GetLastError.KERNEL32(00000038,0040DCC8,004480DB,?,004AEF80), ref: 00409582
Part of subcall function 00409574: SetLastError.KERNEL32(00000000), ref: 004095D6

Strings

SHFileOperationW, xrefs: 004485A9
SHFileOperationA, xrefs: 00448647
shell32.dll, xrefs: 004485AE, 0044864C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProcString$AllocH_prolog3H_prolog3__memset
String ID: SHFileOperationA$SHFileOperationW$shell32.dll
API String ID: 2238935536-1880307489
Opcode ID: 02e44b9c698ed1fc3766f45d51fe38c9df60a922236b4d0e3cdd5f5f11c6aecd
Instruction ID: ee1cd28c2aa6ab60c67d24585b26cdc4529c7d6d3310da1d6fdf71cd92d92da7
Opcode Fuzzy Hash: 02e44b9c698ed1fc3766f45d51fe38c9df60a922236b4d0e3cdd5f5f11c6aecd
Instruction Fuzzy Hash: 70419371800348AEDB01EFE5CC45FDEBBB89F14344F14405AF905B7292DBB89A45CBA9

Function 00405950 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(F14A3287,?,00000003,00000000,?,?,?,?,?,?,?,?,00000000,004ABA70,000000FF), ref: 004059A4
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,004ABA70,000000FF), ref: 004059DA
GetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,004ABA70,000000FF), ref: 00405A25
SysFreeString.OLEAUT32(000000FF), ref: 00405A41
SysFreeString.OLEAUT32(?), ref: 00405A4C
SetLastError.KERNEL32(?), ref: 00405A6C
SetLastError.KERNEL32(00000003), ref: 00405A76

Strings

,)L, xrefs: 00405998

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: ,)L
API String ID: 2425351278-4114281670
Opcode ID: 183877bc0a17d86f46f36cf550d713aa475ddcd2d0d02122d99a110ed59346cd
Instruction ID: 49a7c55a314a379f061bc6ea63809640c74fc4ca134c6d6d5cf670e4e386c85f
Opcode Fuzzy Hash: 183877bc0a17d86f46f36cf550d713aa475ddcd2d0d02122d99a110ed59346cd
Instruction Fuzzy Hash: 02412775A00209EFCB00DFA9D944B9EBBF4FF08314F14812AE809E7650DB75A915CF98

Function 00454E47 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 96stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00454E4E

Part of subcall function 004533CB: SetLastError.KERNEL32(0000007F), ref: 004533D9

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

GetLastError.KERNEL32 ref: 00454E9D

Part of subcall function 00454F5C: _wcsstr.LIBCMT ref: 00454F66
Part of subcall function 00454F5C: lstrlenW.KERNEL32(?), ref: 00454F76
Part of subcall function 00454F5C: _wcsstr.LIBCMT ref: 00454F88

lstrcpynW.KERNEL32(?,00000000,?), ref: 00454EDC
lstrlenW.KERNEL32(00000000), ref: 00454F51

Strings

2.5.4.10, xrefs: 00454F20
2.5.4.3, xrefs: 00454EF4
1.2.840.113549.1.9.1, xrefs: 00454F37
2.5.4.11, xrefs: 00454F09

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast_wcsstrlstrlen$H_prolog3_malloclstrcpyn
String ID: 1.2.840.113549.1.9.1$2.5.4.10$2.5.4.11$2.5.4.3
API String ID: 1347637120-2689139351
Opcode ID: 3471b6c8a763cf6b397fa11d9ba1e10592b2dc31b342e4fd7699b5017dc2202f
Instruction ID: ef8cc49fccd8c73ab754683c38afbe4f94f134a656a3ddd5ca0ed8fdd39dc85d
Opcode Fuzzy Hash: 3471b6c8a763cf6b397fa11d9ba1e10592b2dc31b342e4fd7699b5017dc2202f
Instruction Fuzzy Hash: 82317732500105ABCB15DF658C45DEF36A9EF8535AB11402AFC159B243DF78CD4887AD

Function 00404960 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00405F80: GetLastError.KERNEL32(00000001,75C0E860,F14A3287,?,771AE010,?,?,004ABD28,000000FF,,)L,004049B4), ref: 00405FF4
Part of subcall function 00405F80: SetLastError.KERNEL32(?,00000007,00000000,000000FF), ref: 00406042

GetLastError.KERNEL32 ref: 004049C1
SysFreeString.OLEAUT32(?), ref: 004049DF
SysFreeString.OLEAUT32(?), ref: 004049EC
SetLastError.KERNEL32(?), ref: 00404A16
GetLastError.KERNEL32 ref: 00404A25
SetLastError.KERNEL32(?,00000000,00000000,000000FF), ref: 00404A7F

Strings

,)L, xrefs: 00404A1E
,)L, xrefs: 00404960

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: ,)L$,)L
API String ID: 2425351278-234518685
Opcode ID: d97995be9755c4f0d1eb9db80a03480837983075c7e7857fc3e03aca54a3d309
Instruction ID: be5164853bb2773fea0b538992d7bfd6483a4a0b1de5b37597a41e42cdbcdb13
Opcode Fuzzy Hash: d97995be9755c4f0d1eb9db80a03480837983075c7e7857fc3e03aca54a3d309
Instruction Fuzzy Hash: 0E313CB1508741AFD700CF29C844B1ABBE4FF88314F50462EF855976A1D7B5E819CF8A

Function 004220C6 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90librarystringloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004220D0
_memmove.LIBCMT ref: 004220EA

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,?,?,0000028C), ref: 00422120
__setjmp3.LIBCMT ref: 00422141
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00422160
_memmove.LIBCMT ref: 004221EA

Strings

setup.cpp, xrefs: 004220FD
DllGetClassObject, xrefs: 00422155

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString_memmove$AddressH_prolog3_Proc__setjmp3lstrcpy
String ID: DllGetClassObject$setup.cpp
API String ID: 1563037923-408802517
Opcode ID: 7eb0e7e47530a31a5a4740f7839f514a6996f8da8d89bed6cc6eeb50398a70f2
Instruction ID: d762de645792597c722f477901590a19f3e2a0da2a0356cc2d2b90aecf08d429
Opcode Fuzzy Hash: 7eb0e7e47530a31a5a4740f7839f514a6996f8da8d89bed6cc6eeb50398a70f2
Instruction Fuzzy Hash: 7E319671A40209AFDB14DBA0CD45FBD7778BF44705F4440AEF50AE7282DBB86E488B55

Function 00470C31 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 00470C54

Part of subcall function 00470B27: Replicator::operator[].LIBCMT ref: 00470BA3
Part of subcall function 00470B27: DName::operator+=.LIBCMT ref: 00470BAB

DName::operator+.LIBCMT ref: 00470CAF
DName::DName.LIBCMT ref: 00470D07

Strings

..., xrefs: 00470CEA
void, xrefs: 00470CFF
,<ellipsis>, xrefs: 00470CA2, 00470CA7
<ellipsis>, xrefs: 00470CF1, 00470CF6
,..., xrefs: 00470C9B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: 313b73052913bb26edf9673d837249663d042fb2806e70bd0b6e4c75a1a186ef
Instruction ID: 351aefb8051d0d0ffc1f186ad074b7f5f5f13a1775efcc14801684025ee44b47
Opcode Fuzzy Hash: 313b73052913bb26edf9673d837249663d042fb2806e70bd0b6e4c75a1a186ef
Instruction Fuzzy Hash: 01214CB4602205DFCB19CF5DD491AE63BE4EB04304B1881ABE44ADB362CB78ED45CB98

Function 004280ED Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

std::exception::exception.LIBCMT ref: 00459D41
__CxxThrowException@8.LIBCMT ref: 00459D56
__CxxThrowException@8.LIBCMT ref: 00459D7A
std::exception::exception.LIBCMT ref: 00459D93
__CxxThrowException@8.LIBCMT ref: 00459DA8

Strings

jK, xrefs: 00459D37, 00459D4B, 00459D4E
PkK, xrefs: 00459D73
jK, xrefs: 00459D4F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$_malloc
String ID: PkK$jK$jK
API String ID: 3942750879-1859297253
Opcode ID: 0c477b63d8cfb060540580ae920cc714e927d9ac52db29d6425423f81f45cee3
Instruction ID: 9a9f11c69c5e5db46be9d047344e17c51cd33d1d7dc9d1fcf143cf228e28c536
Opcode Fuzzy Hash: 0c477b63d8cfb060540580ae920cc714e927d9ac52db29d6425423f81f45cee3
Instruction Fuzzy Hash: 7A11367590020DBFCF04EF95D856ADD77B8AF04305F50819FAD15D7242EB78A60C8B99

Function 004314D6 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

std::exception::exception.LIBCMT ref: 00459D41
__CxxThrowException@8.LIBCMT ref: 00459D56
__CxxThrowException@8.LIBCMT ref: 00459D7A
std::exception::exception.LIBCMT ref: 00459D93
__CxxThrowException@8.LIBCMT ref: 00459DA8

Strings

jK, xrefs: 00459D37, 00459D4B, 00459D4E
PkK, xrefs: 00459D73
jK, xrefs: 00459D4F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$_malloc
String ID: PkK$jK$jK
API String ID: 3942750879-1859297253
Opcode ID: 592d0e2027cd5d1c5463800ecc143e022e05f8c995b140e04e467adfe0b68d8e
Instruction ID: 32ec3151b2b3fdd45de85d39878c15b5e5b91ba3c60ec7115b697f5040b3d3af
Opcode Fuzzy Hash: 592d0e2027cd5d1c5463800ecc143e022e05f8c995b140e04e467adfe0b68d8e
Instruction Fuzzy Hash: 4111637580020DBFCF04EF95C866ADE77B8AF04304F5081ABA915D7252EB78A6088B99

Function 00431501 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

std::exception::exception.LIBCMT ref: 00459D41
__CxxThrowException@8.LIBCMT ref: 00459D56
__CxxThrowException@8.LIBCMT ref: 00459D7A
std::exception::exception.LIBCMT ref: 00459D93
__CxxThrowException@8.LIBCMT ref: 00459DA8

Strings

jK, xrefs: 00459D37, 00459D4B, 00459D4E
PkK, xrefs: 00459D73
jK, xrefs: 00459D4F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$_malloc
String ID: PkK$jK$jK
API String ID: 3942750879-1859297253
Opcode ID: 75b353cb38711d8497a6d7f4d24e8eff8708f2e663d83ccb3e5629c1b233e77b
Instruction ID: 4542ed1fb69f28d4931232fad494e60d15896b9f5cc758863294226176440707
Opcode Fuzzy Hash: 75b353cb38711d8497a6d7f4d24e8eff8708f2e663d83ccb3e5629c1b233e77b
Instruction Fuzzy Hash: F611637580020CBFCF04EF95D856ADE77B8AF04304F5081ABA915D7252EB78A6088B99

Function 0043152C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

std::exception::exception.LIBCMT ref: 00459D41
__CxxThrowException@8.LIBCMT ref: 00459D56
__CxxThrowException@8.LIBCMT ref: 00459D7A
std::exception::exception.LIBCMT ref: 00459D93
__CxxThrowException@8.LIBCMT ref: 00459DA8

Strings

jK, xrefs: 00459D37, 00459D4B, 00459D4E
PkK, xrefs: 00459D73
jK, xrefs: 00459D4F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$_malloc
String ID: PkK$jK$jK
API String ID: 3942750879-1859297253
Opcode ID: c356737f87355b7365d754136648bd16cd25ffa362ae88736d55e8303d09a03a
Instruction ID: d9a05e96f8679ce7a4ce8a46b860cef0e849986f5bb8c8dd48c6dd26c01c123c
Opcode Fuzzy Hash: c356737f87355b7365d754136648bd16cd25ffa362ae88736d55e8303d09a03a
Instruction Fuzzy Hash: 9311637580020CBFCF04EF95C856ADE77B8AF04304F5081ABE915D7252EB78A608CB99

Function 004422C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004422CA
GetModuleHandleW.KERNEL32(kernel32.dll,FindFirstFileW,00000254,0044105B), ref: 004422E6
GetProcAddress.KERNEL32(00000000), ref: 004422E9
GetModuleHandleW.KERNEL32(kernel32.dll,FindFirstFileA), ref: 00442329
GetProcAddress.KERNEL32(00000000), ref: 0044232C

Strings

FindFirstFileW, xrefs: 004422DC
FindFirstFileA, xrefs: 0044231F
kernel32.dll, xrefs: 004422E1, 00442324

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc$H_prolog3_
String ID: FindFirstFileA$FindFirstFileW$kernel32.dll
API String ID: 762132516-163559883
Opcode ID: bcd14b1417bea979a74ae6554912813d94d71f02e11e7404f48bc8bd2b768c3a
Instruction ID: 1a954a962536c43a2090a9e7790a4fa87c48929b265e443d7490f134541b8e6d
Opcode Fuzzy Hash: bcd14b1417bea979a74ae6554912813d94d71f02e11e7404f48bc8bd2b768c3a
Instruction Fuzzy Hash: 99110430D002189BCB24EFB4CC49BEE3678AB48325F54025ABD25A71C0DBBC9E458BD9

Function 00470F11 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00470F19
DName::DName.LIBCMT ref: 00470F23

Part of subcall function 0046F33F: DName::doPchar.LIBCMT ref: 0046F36D

UnDecorator::getScopedName.LIBCMT ref: 00470F63
DName::operator+=.LIBCMT ref: 00470F6D
DName::operator+=.LIBCMT ref: 00470F7C
DName::operator+=.LIBCMT ref: 00470F88
DName::operator+=.LIBCMT ref: 00470F95

Strings

void, xrefs: 00470F74

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 7938374b836accc4b29cd10bd606ba4238a6e1c41518f0d8b5628803308ff86f
Instruction ID: 0eeefd4a93e0fa5db585fa06ebea2863db207781c269f8c214587ff23227f299
Opcode Fuzzy Hash: 7938374b836accc4b29cd10bd606ba4238a6e1c41518f0d8b5628803308ff86f
Instruction Fuzzy Hash: 301186715051089AC718EF65D856AED7B64DF10304F04809FE4455B3D2DBB89949C759

Function 00461874 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00461E0A

Part of subcall function 00462DCD: __mtinitlocknum.LIBCMT ref: 00462DDF
Part of subcall function 00462DCD: __amsg_exit.LIBCMT ref: 00462DEB
Part of subcall function 00462DCD: EnterCriticalSection.KERNEL32(00000000,?,004649E4,0000000D), ref: 00462DF8

InterlockedDecrement.KERNEL32(00000000), ref: 00461E1D
_free.LIBCMT ref: 00461E33

Part of subcall function 0045D1D6: RtlFreeHeap.NTDLL(00000000,00000000), ref: 0045D1EA
Part of subcall function 0045D1D6: GetLastError.KERNEL32(00000000), ref: 0045D1FC

__lock.LIBCMT ref: 00461E4C
___removelocaleref.LIBCMT ref: 00461E5B
___freetlocinfo.LIBCMT ref: 00461E74
_free.LIBCMT ref: 00461E87

Strings

@xM, xrefs: 00461E6C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: __lock_free$CriticalDecrementEnterErrorFreeHeapInterlockedLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID: @xM
API String ID: 556454624-1615895041
Opcode ID: 46cb7d994bf4057ecf602bbc85dbe6e2711231802394d2a8f2a9cc345cda6042
Instruction ID: a5a01a64daeed15a38b748f6c9bfff3a9b8a6d0389a95a385ab95385c2668e7b
Opcode Fuzzy Hash: 46cb7d994bf4057ecf602bbc85dbe6e2711231802394d2a8f2a9cc345cda6042
Instruction Fuzzy Hash: 3701D231441700EAEB346F65C806B1B77A4AF00719F28861FF855662F1EBBEC980C95F

Function 00448450 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00448457
GetModuleHandleW.KERNEL32(kernel32.dll,SetFileAttributesW,00000000,00440F2C,?,00000000), ref: 00448471
GetProcAddress.KERNEL32(00000000), ref: 00448474
GetModuleHandleW.KERNEL32(kernel32.dll,SetFileAttributesA), ref: 0044849B
GetProcAddress.KERNEL32(00000000), ref: 0044849E

Strings

SetFileAttributesA, xrefs: 00448491
kernel32.dll, xrefs: 00448469, 00448496
SetFileAttributesW, xrefs: 00448462

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc$H_prolog3
String ID: SetFileAttributesA$SetFileAttributesW$kernel32.dll
API String ID: 1623054726-3589348009
Opcode ID: 48d7a5a303d55293b6ac3f80aa5552254aaa9b56eb2938f50569e2fca9a9d1ff
Instruction ID: d4fc5e3d67f3381795feac4a9ee9633344424475cc518d3d3b022b3eb1b0dcab
Opcode Fuzzy Hash: 48d7a5a303d55293b6ac3f80aa5552254aaa9b56eb2938f50569e2fca9a9d1ff
Instruction Fuzzy Hash: C5F0AF71600209ABCF10BFA5CC09ECE3B64AFD0B91B11412AFD0697191DF7CD585CBA9

Function 00440E64 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00440E6B
GetModuleHandleW.KERNEL32(kernel32.dll,DeleteFileW,00000000,0040E745), ref: 00440E85
GetProcAddress.KERNEL32(00000000), ref: 00440E88
GetModuleHandleW.KERNEL32(kernel32.dll,DeleteFileA), ref: 00440EAC
GetProcAddress.KERNEL32(00000000), ref: 00440EAF

Strings

kernel32.dll, xrefs: 00440E7D, 00440EA7
DeleteFileW, xrefs: 00440E76
DeleteFileA, xrefs: 00440EA2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc$H_prolog3
String ID: DeleteFileA$DeleteFileW$kernel32.dll
API String ID: 1623054726-1437360270
Opcode ID: e4f40d12fdc279c3d6e5f7eacf9dec987320952a54be5137a6659049aa733d4a
Instruction ID: 843e811c02368a30a634006368c8b313445b4fd1357aa0a3b4a473c5d44f256f
Opcode Fuzzy Hash: e4f40d12fdc279c3d6e5f7eacf9dec987320952a54be5137a6659049aa733d4a
Instruction Fuzzy Hash: 3EF0CD71A00304A7CF10BFB58C19BCE3B649F84B52B62452AF90697151DF7CDA05CBAE

Function 004240F6 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 172COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00424100

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Strings

%20, xrefs: 0042427E
x$L, xrefs: 00424328, 0042432E
x$L, xrefs: 0042432F, 00424335
x$L, xrefs: 00424155
x$L, xrefs: 004242A6, 004242AC
file://, xrefs: 00424126, 00424137, 0042416A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3H_prolog3_
String ID: %20$file://$x$L$x$L$x$L$x$L
API String ID: 852442433-991253535
Opcode ID: dc229914433220268f5b8e23df3de32a67f25e03a2f087352395e93e40d20588
Instruction ID: 12bb9869445b30f1184ca8a7f50bfe327072415b40dfb885e32a7dd7bfbde635
Opcode Fuzzy Hash: dc229914433220268f5b8e23df3de32a67f25e03a2f087352395e93e40d20588
Instruction Fuzzy Hash: C261B070A00228EACB14EFA1CC46BDDB3B8EF14744F5041AFE455B31D1DBB85A89CB69

Function 00450B1F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00450B29
wsprintfW.USER32 ref: 00450BD5
wsprintfW.USER32 ref: 00450BE5

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

source%d, xrefs: 00450BDF
dest%d, xrefs: 00450BCF
Software\InstallShieldPendingOperation, xrefs: 00450B7A
Count, xrefs: 00450B93

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeLastStringwsprintf$H_prolog3_
String ID: Count$Software\InstallShieldPendingOperation$dest%d$source%d
API String ID: 3447950213-4089646173
Opcode ID: da29d45a312504dba02cb203fad927f3a70c67f5816780dcb0d1588599e3194a
Instruction ID: f73e4c8e5c0ca1858f89fb20a64ad3db30a5784f068ab9f741f277b9a6dbb516
Opcode Fuzzy Hash: da29d45a312504dba02cb203fad927f3a70c67f5816780dcb0d1588599e3194a
Instruction Fuzzy Hash: 5B619071840219DEDB25EF65CC91BEDB7B4AF15304F0041EEE949A3192EB785B88CF54

Function 004043D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
SysFreeString.OLEAUT32(?), ref: 004044BD
SysFreeString.OLEAUT32(?), ref: 004044C8
SetLastError.KERNEL32(?), ref: 004044E8

Strings

,)L, xrefs: 00404415

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: ,)L
API String ID: 2425351278-4114281670
Opcode ID: 8b9634d92885f6208f08f199b1bc4ff2afc98f0fc16abaa6747b52f8e7b15d72
Instruction ID: a7ae13349a539f204e8b56ab93c512df9a6fe37a54f75cf3ff9b35c19ecab946
Opcode Fuzzy Hash: 8b9634d92885f6208f08f199b1bc4ff2afc98f0fc16abaa6747b52f8e7b15d72
Instruction Fuzzy Hash: 14413AB1900209EFDB00CF65C944BAEBBF4FF58314F14812AE809A7751E775A915CF99

Function 004523CD Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

_Find_unchecked1.LIBCPMT ref: 0045240F
_Find_unchecked1.LIBCPMT ref: 0045242D
SysStringLen.OLEAUT32(00000008), ref: 00452480
SysStringLen.OLEAUT32(?), ref: 0045248F

Strings

\C, xrefs: 004523CD
TbK, xrefs: 004523EB
=, xrefs: 004523F0

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Find_unchecked1String
String ID: =$TbK$\C
API String ID: 2433260155-968369292
Opcode ID: c58c2bf447b16210cd6170251ef63c3a0614507a6af64139b3790ddceb94067a
Instruction ID: 23a96a451e5d5038e3ce9144159a26e2d605cb270043af06adeeca58a07d37ba
Opcode Fuzzy Hash: c58c2bf447b16210cd6170251ef63c3a0614507a6af64139b3790ddceb94067a
Instruction Fuzzy Hash: C631C472900204AFCB14DBA6CC45EEFB7F8AF49705F00852FE942D2152EB78E908CB64

Function 00404AB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00406060: SysFreeString.OLEAUT32(?), ref: 004060C2
Part of subcall function 00406060: GetLastError.KERNEL32(F14A3287,?,771AE010,00000000,00000000,?,004AC128,000000FF,,)L,00404B04), ref: 004060ED
Part of subcall function 00406060: SetLastError.KERNEL32(?,00000004,00000000,000000FF), ref: 0040613E

GetLastError.KERNEL32 ref: 00404B11
SysFreeString.OLEAUT32(?), ref: 00404B2F
SysFreeString.OLEAUT32(?), ref: 00404B3C
SetLastError.KERNEL32(?), ref: 00404B66
GetLastError.KERNEL32 ref: 00404B75
SetLastError.KERNEL32(?,00000000,00000000,000000FF), ref: 00404BCF

Strings

,)L, xrefs: 00404B6E

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: ,)L
API String ID: 2425351278-4114281670
Opcode ID: 4b8e501cf73fcffea774572d515282a6bab8143605f43f0e576b20950ac01622
Instruction ID: 82b0b2912d05b80c6fdc9b0bbe8edc93c3628696302d5c7d747f2b0a30b54e0f
Opcode Fuzzy Hash: 4b8e501cf73fcffea774572d515282a6bab8143605f43f0e576b20950ac01622
Instruction Fuzzy Hash: 683128B1508341AFD700CF69C844B1ABBE4FF89324F504A2EF855976A1D7B5E819CF8A

Function 0042A21E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 73registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042A228
_memset.LIBCMT ref: 0042A251
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00000000,00020019,?), ref: 0042A289
RegQueryValueExW.ADVAPI32 ref: 0042A2C4

Strings

ProgramFilesDir, xrefs: 0042A2A2
CommonFilesDir, xrefs: 0042A2AB, 0042A2B3
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 0042A27F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_OpenQueryValue_memset
String ID: CommonFilesDir$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 3654002236-3256072622
Opcode ID: d6e4f3ae8c4fc01139ce680c0be34217424d96b15972525da4f0343d17439891
Instruction ID: c1eb5c9212ca2a61d2d3d2d781a36cd4c438d5dd03cb856608079705631cacf7
Opcode Fuzzy Hash: d6e4f3ae8c4fc01139ce680c0be34217424d96b15972525da4f0343d17439891
Instruction Fuzzy Hash: 252162B1D01228AFDB50DB55CC89BDDB778EF18304F5041EAB90DA3291DB785E848F59

Function 0043A205 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043A20C
GetLastError.KERNEL32(00000004,0043A1DF,?,00000000,?,00000001), ref: 0043A22E
SetLastError.KERNEL32(?), ref: 0043A261
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 0043A282
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,FFFFFFFF,00000000,00000000,00000000), ref: 0043A2A9
SetLastError.KERNEL32(?), ref: 0043A2B7

Strings

h$L, xrefs: 0043A222

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWide$H_prolog3
String ID: h$L
API String ID: 1573742327-923250583
Opcode ID: 7617ce48d31feb7964bbd24a897b89b773b85ce67b61fdb24dfb09fbe57410bb
Instruction ID: 0c654f332da4e0e3815e1d64af54023b3dfaa4b160263d0e7b11135cab4ebbd0
Opcode Fuzzy Hash: 7617ce48d31feb7964bbd24a897b89b773b85ce67b61fdb24dfb09fbe57410bb
Instruction Fuzzy Hash: 292137B4A00201EFDB148F64D948B5ABBF4FF08314F10852AF94A9B660C7B4A954CF99

Function 00439668 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0043967A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 0043968A
EncodePointer.KERNEL32(00000000), ref: 00439693
DecodePointer.KERNEL32(00000000), ref: 004396A1
LCMapStringW.KERNEL32(00000000,?,?,?,?,?), ref: 004396E5

Strings

kernel32.dll, xrefs: 00439675
LCMapStringEx, xrefs: 00439684

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProcString
String ID: LCMapStringEx$kernel32.dll
API String ID: 405835482-327329431
Opcode ID: ffc18bfe74584c2c706f0af693a59fcda53b989a435afd86a86b675e3fba4cfd
Instruction ID: 36d0c721e1af7426f8841d6e30403e74580a8d3326e64c9adfa5b031f843d2f5
Opcode Fuzzy Hash: ffc18bfe74584c2c706f0af693a59fcda53b989a435afd86a86b675e3fba4cfd
Instruction Fuzzy Hash: 2801E57280221AFFCF021FA0DD05DDE3F66BF0D755B044426FE0595120C77AD861ABA9

Function 00439604 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00439616
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00439626
EncodePointer.KERNEL32(00000000), ref: 0043962F
DecodePointer.KERNEL32(00000000), ref: 0043963D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 0043965C

Strings

kernel32.dll, xrefs: 00439611
InitializeCriticalSectionEx, xrefs: 00439620

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Pointer$AddressCountCriticalDecodeEncodeHandleInitializeModuleProcSectionSpin
String ID: InitializeCriticalSectionEx$kernel32.dll
API String ID: 131412094-2762503851
Opcode ID: cff26d8f97dd6b8edc815ca70fa2b957efa17be875c52b1884bdced112a01a7e
Instruction ID: 913343acf231e11bd5649014da0caeacd44c398594231c7c1896fabf63ddfd32
Opcode Fuzzy Hash: cff26d8f97dd6b8edc815ca70fa2b957efa17be875c52b1884bdced112a01a7e
Instruction Fuzzy Hash: 7BF03A31902215AB8F112FA49C099AA3FA8BB0D795B004032FD06D6620DB78DC119BAD

Function 00436042 Relevance: 12.1, APIs: 8, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00436049

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00440F5B: __EH_prolog3_GS.LIBCMT ref: 00440F65

LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00000010), ref: 004360A1
GetDC.USER32(00000000), ref: 004360D2
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004360E3
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004360EA
ReleaseDC.USER32(00000000,00000000), ref: 004360F2
CreateDialogParamW.USER32(?,0000006C,00000000,Function_0003614A,00000000), ref: 0043611E
SetForegroundWindow.USER32(00000000), ref: 00436128

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CapsDeviceErrorH_prolog3Last$CreateDialogForegroundH_prolog3_ImageLoadParamReleaseWindow
String ID:
API String ID: 2299063506-0
Opcode ID: 7c84a0193a3dfa50167378dc61f4c3b838c6a325c9c167905397c98c4461b7d4
Instruction ID: 968cbd224c798e15c8dedcb2c4c5ba0897137c57e336654e7cd99b5b2ffacf1b
Opcode Fuzzy Hash: 7c84a0193a3dfa50167378dc61f4c3b838c6a325c9c167905397c98c4461b7d4
Instruction Fuzzy Hash: 4331A771900215BFDB109F65CC85E9E3BA8FB18754F11843FF856A7291DB74D904CB58

Function 00499C91 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100stringCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00499CDA
_memmove.LIBCMT ref: 00499CFA
lstrcmpA.KERNEL32(0000000B,NETSCAPE2.0,?,?,?,?,00000000,?,?,00499FCC,00499FCD), ref: 00499D0F
_memmove.LIBCMT ref: 00499D27
_memmove.LIBCMT ref: 00499D4D

Strings

NETSCAPE2.0, xrefs: 00499D09

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _memmove$lstrcmp
String ID: NETSCAPE2.0
API String ID: 1993653321-1278374441
Opcode ID: 176bec63401216a2d726735a42a84e08f4053a092b0884f29a8f2a3ca88164cf
Instruction ID: 15b33456741fa6a56e02851bb63c3f28c5c940eaeb16d352eaf5ac8fa3ef338a
Opcode Fuzzy Hash: 176bec63401216a2d726735a42a84e08f4053a092b0884f29a8f2a3ca88164cf
Instruction Fuzzy Hash: 30317071D00319EFDF21CF98D885AAEBBF8BF59314F14086EE580A7241E3755A44CB55

Function 00480860 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(F14A3287,75C0E860), ref: 004808AC
SetLastError.KERNEL32(h$L,00000000,00000000,000000FF), ref: 0048090C
GetLastError.KERNEL32(00000000,00000000,000000FF), ref: 0048093A
SetLastError.KERNEL32(?,?,00000000,000000FF), ref: 00480988

Strings

h$L, xrefs: 00480933
D)L, xrefs: 0048089E
h$L, xrefs: 004808E7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast
String ID: D)L$h$L$h$L
API String ID: 1452528299-2780156194
Opcode ID: 43ea80f1feffea8f99047e4d90c150dc09251bf7cd3bf0c13de0c5d137bced73
Instruction ID: 6c4c1f6d0388523b6d2659652972e86bb39d6c0fa8dd757fd324c98562cb156b
Opcode Fuzzy Hash: 43ea80f1feffea8f99047e4d90c150dc09251bf7cd3bf0c13de0c5d137bced73
Instruction Fuzzy Hash: 5E413EB5900208DFDB10DF95D944B9EBBF4EF48328F10461EE81667390D7B9A909CF99

Function 00485F60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00485F98
SetLastError.KERNEL32(?), ref: 00485FC8
LoadLibraryW.KERNEL32(uxtheme.dll), ref: 0048604C
GetProcAddress.KERNEL32(?,SetWindowTheme), ref: 00486083

Strings

uxtheme.dll, xrefs: 0048602F
SetWindowTheme, xrefs: 0048607D

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: SetWindowTheme$uxtheme.dll
API String ID: 1866314245-2891710335
Opcode ID: 5b3f09ac7d17f2d09f18e51d8a86051a6a52a7b1fb0831a8988d16c7dca67ac3
Instruction ID: 82b87087e94e73919a355804f4680458f93b5449e7d2fc87ea5e0dac3145e740
Opcode Fuzzy Hash: 5b3f09ac7d17f2d09f18e51d8a86051a6a52a7b1fb0831a8988d16c7dca67ac3
Instruction Fuzzy Hash: 014115B0A04B46AFD754DF2AC54479ABBE4FB09318F10812AD80987F40D7BAB424CFD8

Function 004385A3 Relevance: 10.6, APIs: 7, Instructions: 93windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004385AA
GetDlgItem.USER32(?,000003F2), ref: 004385BF
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 004385D1
GetDlgItem.USER32(?,000003ED), ref: 004385E4
SendMessageW.USER32(00000000,0000100C,000000FF,00000002), ref: 004385F2
_memset.LIBCMT ref: 004385FE
SendMessageW.USER32 ref: 0043861C

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 004388CF: __EH_prolog3.LIBCMT ref: 004388D6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3MessageSend$ErrorItemLast$_memset
String ID:
API String ID: 693980260-0
Opcode ID: 3ab277bcd237b811c935fd1e3692485625a4c8123f400ad343bfbf7467f6f596
Instruction ID: 31dee5acf3ec773db9eb09d810bbe012a3d4de85f889f2c5181b4c359d9f8f6b
Opcode Fuzzy Hash: 3ab277bcd237b811c935fd1e3692485625a4c8123f400ad343bfbf7467f6f596
Instruction Fuzzy Hash: 9431C271A00214ABEB10EF64CD46F5DBBB4EF08714F15815AF505BF2D2CBB4A905CB99

Function 00420F8B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00420F95
_memmove.LIBCMT ref: 00420FAF

Part of subcall function 004043D0: GetLastError.KERNEL32(F14A3287,771ADFA0,?,771AE010,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404421
Part of subcall function 004043D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?,?), ref: 00404451
Part of subcall function 004043D0: GetLastError.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,?,?,?,004ABA30,000000FF,?,00403D9D,?), ref: 004044A1
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044BD
Part of subcall function 004043D0: SysFreeString.OLEAUT32(?), ref: 004044C8
Part of subcall function 004043D0: SetLastError.KERNEL32(?), ref: 004044E8

lstrcpyW.KERNEL32(?,-00000004,setup.cpp,?,00000001,0000015F,00000000,0000015B), ref: 00420FE5
__setjmp3.LIBCMT ref: 00421006
_memmove.LIBCMT ref: 00421056

Strings

setup.cpp, xrefs: 00420FC2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString_memmove$H_prolog3___setjmp3lstrcpy
String ID: setup.cpp
API String ID: 3036740637-2020632666
Opcode ID: 8fd3c824a0f8e6c02f041f74a918cdafa82e0eea4aa711f550830d47b1a3a275
Instruction ID: 66ac03437088ac9dfa31133f15ea1255f134a4da64ac86c4259d623fae5fbf9a
Opcode Fuzzy Hash: 8fd3c824a0f8e6c02f041f74a918cdafa82e0eea4aa711f550830d47b1a3a275
Instruction Fuzzy Hash: CB21ABB1A40118ABDB14EB91DD42FAE7378AF44709F01405FF505E7182DB7C9F498B6A

Function 00474223 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0047426A
DName::operator+.LIBCMT ref: 00474271
DName::DName.LIBCMT ref: 00474293
DName::operator+.LIBCMT ref: 0047429A
DName::operator+.LIBCMT ref: 004742A1

Strings

throw(, xrefs: 00474262, 0047428B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: b30968f6c5f71aa917c3ff1209ff03c6a91fbb2b78503c1731f2dfd6d2d637da
Instruction ID: b56932ee48b6bedde60de2f84b7b0c91c17d8bb3ace5cbbd1438058f8e56f1ab
Opcode Fuzzy Hash: b30968f6c5f71aa917c3ff1209ff03c6a91fbb2b78503c1731f2dfd6d2d637da
Instruction Fuzzy Hash: C1018871600209AFCF04EB65D852FFD77A49B40304F44445AB545AB292EB7899498785

Function 004640A1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00464914: __getptd_noexit.LIBCMT ref: 00464915
Part of subcall function 00464914: __amsg_exit.LIBCMT ref: 00464922

__amsg_exit.LIBCMT ref: 004640CE
__lock.LIBCMT ref: 004640DE
InterlockedDecrement.KERNEL32(?), ref: 004640FB
_free.LIBCMT ref: 0046410E
InterlockedIncrement.KERNEL32(007DEB48), ref: 00464126

Strings

H}, xrefs: 00464114, 0046411C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock_free
String ID: H}
API String ID: 1231874560-2439041442
Opcode ID: 0a8b97ac59232a9c6f436f5de41d90f618e21b0f421b753d820186e245427096
Instruction ID: 075c1dc24cb13abfa7b91959b82c70e486c5493c40e9668880afa3846e12f6aa
Opcode Fuzzy Hash: 0a8b97ac59232a9c6f436f5de41d90f618e21b0f421b753d820186e245427096
Instruction Fuzzy Hash: C801C432906621ABCF21AB65980A79E7760BF81719F05011BE80067792E73C6941CFEF

Function 00464A4E Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00464A4E

Part of subcall function 004697B0: EncodePointer.KERNEL32(00000000,?,00464A53,0045E06C,004D0620,00000014), ref: 004697B3
Part of subcall function 004697B0: __initp_misc_winsig.LIBCMT ref: 004697D4

__mtinitlocks.LIBCMT ref: 00464A53

Part of subcall function 00462F1C: InitializeCriticalSectionAndSpinCount.KERNEL32(004D7080,00000FA0,?,?,00464A58,0045E06C,004D0620,00000014), ref: 00462F3A

__mtterm.LIBCMT ref: 00464A5C
__calloc_crt.LIBCMT ref: 00464A81
GetCurrentThreadId.KERNEL32 ref: 00464AAA

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CountCriticalCurrentEncodeInitializePointerSectionSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm
String ID:
API String ID: 1171689812-0
Opcode ID: b6f0155371b5727c2c005af9ceb69bd998263cc48cb706abf3603e9769d7250e
Instruction ID: f9556c04d72433482068f5783f4e87006f4299d844706337ac027871a998f314
Opcode Fuzzy Hash: b6f0155371b5727c2c005af9ceb69bd998263cc48cb706abf3603e9769d7250e
Instruction Fuzzy Hash: 07F0F0321997112AEA28BBBA3C0664B2BC49FC1738B20462FF460C41DAFF288841814F

Function 004901F0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00490264
__wcsnicmp.LIBCMT ref: 00490325

Strings

.bmp, xrefs: 0049031F
,)L, xrefs: 004901F0
.gif, xrefs: 0049025E

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: __wcsnicmp
String ID: ,)L$.bmp$.gif
API String ID: 1038674560-698891163
Opcode ID: 5dedd6b858cde8d0c4d2dfeee6f6b6b0069dc7278025c944647b949641b923ba
Instruction ID: b12b0de4b08983b63dbce1155e492df431e692765916a45fb229abd0030edf0d
Opcode Fuzzy Hash: 5dedd6b858cde8d0c4d2dfeee6f6b6b0069dc7278025c944647b949641b923ba
Instruction Fuzzy Hash: 8D518D71A00200DFDB24DF29C984B5A7BF1FF48314F1045AEE95A9B391DB3AE945CB98

Function 00430880 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 147COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043088A

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Part of subcall function 00403FB0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,004AB968,000000FF), ref: 00403FF3
Part of subcall function 00403FB0: SetLastError.KERNEL32(?,004C2254,00000000,?,?,?,?,?,004AB968,000000FF), ref: 00404068

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Part of subcall function 00404580: GetLastError.KERNEL32(F14A3287,?,?,?,00000000,004AC158,000000FF,,)L,004050D6,00000000,00000001,000000FF), ref: 004045BE
Part of subcall function 00404580: SetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 0040461A

Part of subcall function 004034E0: GetLastError.KERNEL32 ref: 0040354B
Part of subcall function 004034E0: SetLastError.KERNEL32(,)L,00000000,00000000,000000FF), ref: 004035B4
Part of subcall function 004034E0: SysFreeString.OLEAUT32(?), ref: 004036A6

Part of subcall function 00404640: GetLastError.KERNEL32 ref: 004046A7
Part of subcall function 00404640: SetLastError.KERNEL32(,)L,00000000,00000000,000000FF), ref: 0040470A
Part of subcall function 00404640: GetLastError.KERNEL32(00000000,00000000,000000FF,?,00000000,?,?), ref: 00404792
Part of subcall function 00404640: SysFreeString.OLEAUT32(?), ref: 004047AC
Part of subcall function 00404640: SysFreeString.OLEAUT32(?), ref: 004047BC

Part of subcall function 00447BB4: __EH_prolog3_GS.LIBCMT ref: 00447BBB
Part of subcall function 00447BB4: RegQueryValueExW.KERNELBASE(?,?,00000000,00000008,00000000,004C2418,0000005C,0041A47F,?,-80000001,?,?), ref: 00447C30

Strings

,)L, xrefs: 004308B1
[], xrefs: 004308CA
($L, xrefs: 004308DB
,)L, xrefs: 00430A88

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3_$QueryValue
String ID: ($L$,)L$,)L$[]
API String ID: 3993292288-1789431140
Opcode ID: 44813148afd17033f7d21bfcc9da7104d7d5763a5a72589abc63e4dbb3b8201b
Instruction ID: 8447dd219e2e6132c9bf57398eb6d40dd2715fb255b85058e4367f8c0d6e712a
Opcode Fuzzy Hash: 44813148afd17033f7d21bfcc9da7104d7d5763a5a72589abc63e4dbb3b8201b
Instruction Fuzzy Hash: 5F517D70910258EEDB14EBA1CC51BEDB7B8BF14304F5040AEE509B71C2DBB86A48CF69

Function 0040A206 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040A210

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

\, xrefs: 0040A24B
T"L, xrefs: 0040A26C
x$L, xrefs: 0040A34C, 0040A3B1, 0040A396, 0040A324, 0040A330, 0040A2E0, 0040A2F9, 0040A2E3, 0040A327, 0040A399
x$L, xrefs: 0040A25A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3H_prolog3_
String ID: T"L$\$x$L$x$L
API String ID: 2488494826-1685727734
Opcode ID: d89ff252e278081b8c322feae370995fb1d727da696b6e18bbdd0deb787e0d2b
Instruction ID: bba62cc010cae6024f44c885d5d3b1b0b16f9a1abb5b1efde5af40c7f99fd001
Opcode Fuzzy Hash: d89ff252e278081b8c322feae370995fb1d727da696b6e18bbdd0deb787e0d2b
Instruction Fuzzy Hash: 6B516D30900218DEDB15EBA1CC51BEEB778BF14304F1441AEE845B72D1DBB86A59CF6A

Function 0044019F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004401A6
GetLastError.KERNEL32(00000044), ref: 004401B2

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00457ACE: __EH_prolog3.LIBCMT ref: 00457AD5
Part of subcall function 00457ACE: GetLastError.KERNEL32(0000000C,00440096), ref: 00457AED
Part of subcall function 00457ACE: GetModuleHandleW.KERNEL32(Kernel32,CreateFileW), ref: 00457B04
Part of subcall function 00457ACE: GetProcAddress.KERNEL32(00000000), ref: 00457B0B
Part of subcall function 00457ACE: GetModuleHandleW.KERNEL32(Kernel32,CreateFileMappingW), ref: 00457BBE
Part of subcall function 00457ACE: GetProcAddress.KERNEL32(00000000), ref: 00457BC5
Part of subcall function 00457ACE: GetModuleHandleW.KERNEL32(Kernel32,MapViewOfFile), ref: 00457C38
Part of subcall function 00457ACE: GetProcAddress.KERNEL32(00000000), ref: 00457C3F

Part of subcall function 00457ACE: GetModuleHandleW.KERNEL32(Kernel32,CreateFileA), ref: 00457B5C
Part of subcall function 00457ACE: GetProcAddress.KERNEL32(00000000), ref: 00457B63
Part of subcall function 00457ACE: GetModuleHandleW.KERNEL32(Kernel32,CreateFileMappingA), ref: 00457BF9
Part of subcall function 00457ACE: GetProcAddress.KERNEL32(00000000), ref: 00457C00
Part of subcall function 00457ACE: GetModuleHandleW.KERNEL32(Kernel32,GetFileSize), ref: 00457C7F
Part of subcall function 00457ACE: GetProcAddress.KERNEL32(00000000), ref: 00457C86
Part of subcall function 00457ACE: GetLastError.KERNEL32 ref: 00457CA5

MultiByteToWideChar.KERNEL32(?,00000006,?,?,?,?), ref: 00440267
GetLastError.KERNEL32 ref: 00440274

Part of subcall function 004484F8: __EH_prolog3.LIBCMT ref: 004484FF

Strings

x$L, xrefs: 004401D8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc$H_prolog3$ByteCharMultiWide
String ID: x$L
API String ID: 2799633331-723586279
Opcode ID: 6ec837c258a4cbcd7182ad8eeb134ba3680d13bf360159465ac849bad516f1f6
Instruction ID: 8f7de48a16aa871af84894a22d36397997f568d57597a0ed7a22593f9709f043
Opcode Fuzzy Hash: 6ec837c258a4cbcd7182ad8eeb134ba3680d13bf360159465ac849bad516f1f6
Instruction Fuzzy Hash: CD318674800209DFDF00EFE9D945AED7BB8BF14304F50046EF805A7252EBB95A09CBA9

Function 0042E092 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042E099

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Part of subcall function 00404580: GetLastError.KERNEL32(F14A3287,?,?,?,00000000,004AC158,000000FF,,)L,004050D6,00000000,00000001,000000FF), ref: 004045BE
Part of subcall function 00404580: SetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 0040461A

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Strings

,)L, xrefs: 0042E0B5
($L, xrefs: 0042E13E, 0042E157, 0042E0EE, 0042E106, 0042E0F1, 0042E141
($L, xrefs: 0042E0FA
,)L, xrefs: 0042E171

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3_
String ID: ($L$($L$,)L$,)L
API String ID: 2549205776-3618781326
Opcode ID: dc3e953362e7e5a5620c97a90a447c6c49576ebc9ec5fbd7855d05e393bb64ad
Instruction ID: 157d7bb90998125a7d3366999bf3a0ca1f233e3d8fe8a721a8ac73f11b213541
Opcode Fuzzy Hash: dc3e953362e7e5a5620c97a90a447c6c49576ebc9ec5fbd7855d05e393bb64ad
Instruction Fuzzy Hash: CC3181B1900158EECB05EFA1DD81BFEB378AB54314F54452EE402B72C2DBB86E05CB69

Function 0040DE13 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040DE1D

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0040A206: __EH_prolog3_GS.LIBCMT ref: 0040A210

Strings

x$L, xrefs: 0040DE2E, 0040DF12, 0040DECC, 0040DE94
x$L, xrefs: 0040DE4E, 0040DEF2, 0040DF0A, 0040DED5, 0040DEF5
., xrefs: 0040DE75
x$L, xrefs: 0040DE29

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$H_prolog3
String ID: .$x$L$x$L$x$L
API String ID: 532146472-1067445339
Opcode ID: d788023625e6262a87d42112a178970be63b76ed9fcfd912639c6c32ed1bcc75
Instruction ID: 97b49514e4b9e82d42110ff17056662ec16cc7d512d01af42c6b258334099e09
Opcode Fuzzy Hash: d788023625e6262a87d42112a178970be63b76ed9fcfd912639c6c32ed1bcc75
Instruction Fuzzy Hash: 7231A171A00218DECB14EB95C891BDEB378AF15354F10016FE455732D2DBB82A49CF69

Function 00406060 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004060C2
GetLastError.KERNEL32(F14A3287,?,771AE010,00000000,00000000,?,004AC128,000000FF,,)L,00404B04), ref: 004060ED
SetLastError.KERNEL32(?,00000004,00000000,000000FF), ref: 0040613E

Strings

,)L, xrefs: 00406060
,)L, xrefs: 004060E6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: ,)L$,)L
API String ID: 2425351278-234518685
Opcode ID: 31716296fa55ebf3e79ea8444bc077c1def160cc7cde917a6fa7a12248432ccf
Instruction ID: 4bdeff55563dea13e29fad80c0177dcccbdcc8079e287658d72e02f0d038e76e
Opcode Fuzzy Hash: 31716296fa55ebf3e79ea8444bc077c1def160cc7cde917a6fa7a12248432ccf
Instruction Fuzzy Hash: 09318FB5500601AFDB10CF05C984B56FBF8FF09714F50462EE8169BA90DB79E919CF98

Function 0042DC51 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042DC58

Part of subcall function 00429B72: __EH_prolog3_GS.LIBCMT ref: 00429B79

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Strings

($L, xrefs: 0042DD12
($L, xrefs: 0042DD0A
,)L, xrefs: 0042DCE7
,)L, xrefs: 0042DCAE

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeH_prolog3_String
String ID: ($L$($L$,)L$,)L
API String ID: 2608676048-3618781326
Opcode ID: b824e2cca86462cda5a802e84e9c72c601d3b45374045e2d3106d5a442761796
Instruction ID: 138cc1f823a8b259ce6226ed85ee02910d096d9f0b5fe058f5a3a71bbc829edf
Opcode Fuzzy Hash: b824e2cca86462cda5a802e84e9c72c601d3b45374045e2d3106d5a442761796
Instruction Fuzzy Hash: BE212D75E10218DFCB18EFA9D981AEDBBB4FF58304F60412EE405A7242DBB49944CF64

Function 00411707 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00411711
IsWindow.USER32(?), ref: 0041172D

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

SendMessageW.USER32(?,00001074,?,?), ref: 004117D2
SendMessageW.USER32(?,0000101E,00000000,000000FE), ref: 004117DD

Part of subcall function 0040D135: __EH_prolog3_GS.LIBCMT ref: 0040D13F

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

x$L, xrefs: 0041177F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeH_prolog3_MessageSendString$Window
String ID: x$L
API String ID: 2791905285-723586279
Opcode ID: 2de8a859755c56bea6459981eddef84f5eaf6eeaab2479e24148a6cff595d524
Instruction ID: fa0adb8b7cc0ba1599b38b6f66858b7598d2bd5e55dc0427eef21470b3a0fa18
Opcode Fuzzy Hash: 2de8a859755c56bea6459981eddef84f5eaf6eeaab2479e24148a6cff595d524
Instruction Fuzzy Hash: 46218174E00218EFDB20DFA5C881ADEBBB4AF49704F10406FE955A3391DB749989CB69

Function 0041061C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00410623

Part of subcall function 00403F50: GetLastError.KERNEL32 ref: 00403F6F
Part of subcall function 00403F50: SetLastError.KERNEL32(?), ref: 00403F9F

Part of subcall function 0040D135: __EH_prolog3_GS.LIBCMT ref: 0040D13F

GetDlgItem.USER32(?,00000009), ref: 004106CF
EnableWindow.USER32(00000000), ref: 004106D6

Strings

,)L, xrefs: 0041063E
($L, xrefs: 00410680, 00410683

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_Last$EnableItemWindow
String ID: ($L$,)L
API String ID: 3351711136-1160466256
Opcode ID: fe2c9db6330ee59b309dece2871f5aa8557c2a75e3c2f8dc106201fb5646d94d
Instruction ID: 1047f50f6ce19206d289e053a192c973fdfcd3894bdf0a8df908ca906e4a70d7
Opcode Fuzzy Hash: fe2c9db6330ee59b309dece2871f5aa8557c2a75e3c2f8dc106201fb5646d94d
Instruction Fuzzy Hash: A3219870901244EFCB04DBA4EC95BED7BB8AB15309F14006FE501A7192DBB89558CB69

Function 0046499B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 004649DF

Part of subcall function 00462DCD: __mtinitlocknum.LIBCMT ref: 00462DDF
Part of subcall function 00462DCD: __amsg_exit.LIBCMT ref: 00462DEB
Part of subcall function 00462DCD: EnterCriticalSection.KERNEL32(00000000,?,004649E4,0000000D), ref: 00462DF8

InterlockedIncrement.KERNEL32(?), ref: 004649EC
__lock.LIBCMT ref: 00464A00
___addlocaleref.LIBCMT ref: 00464A1E

Strings

@xM, xrefs: 00464A13

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: @xM
API String ID: 153627126-1615895041
Opcode ID: 313c5c6499f8e3ff1b4345eaf455d45fec648427233fb7cdc91962ee4f021cde
Instruction ID: 50c959ab58b1659be1befa90097121496706ea16fbf70a6021dda361be4062e5
Opcode Fuzzy Hash: 313c5c6499f8e3ff1b4345eaf455d45fec648427233fb7cdc91962ee4f021cde
Instruction Fuzzy Hash: BB018471440B00EFD720EFA6D80574ABBF4AF40329F20890FE496977A1EB78A540DF5A

Function 004158C6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004158CD
__ltow_s.LIBCMT ref: 00415905
SetLastError.KERNEL32(00000000,?,00000000,00000001), ref: 00415934

Strings

,)L, xrefs: 004158E3
,)L, xrefs: 004158F9, 00415913, 004158FE, 00415916

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_Last__ltow_s
String ID: ,)L$,)L
API String ID: 2344196725-234518685
Opcode ID: 82f0078db6c3079b6c140757bcd56387d4844653006441777005e231403c9918
Instruction ID: a963263619616c665a2ddd92f457428a6d447eb967c840e330e634d129c5dfef
Opcode Fuzzy Hash: 82f0078db6c3079b6c140757bcd56387d4844653006441777005e231403c9918
Instruction Fuzzy Hash: 5A01F776900208EBCB11EF91C840DEEBBB8EF48714F04401FF901A7241DBB9DA44CBA8

Function 004AC6A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004AC6B3
SysFreeString.OLEAUT32 ref: 004AC6CF
SysFreeString.OLEAUT32(00000000), ref: 004AC702
SetLastError.KERNEL32(00000000), ref: 004AC732

Strings

x$L, xrefs: 004AC710

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeLastString
String ID: x$L
API String ID: 3822639702-723586279
Opcode ID: b9a7c5c1da1f18c3759cbb799dc644f0badf2369e70084ecb944602f45ed2eee
Instruction ID: 1880b7a561d6a0c4202c5ece42c3c37bc6bb1d3a434952743271c1393b04a23d
Opcode Fuzzy Hash: b9a7c5c1da1f18c3759cbb799dc644f0badf2369e70084ecb944602f45ed2eee
Instruction Fuzzy Hash: B2017C71816102AFCB009F58EC48FA87BE8FB19318B41407FE806A3672EF756818CB5D

Function 0044912A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00449033), ref: 0044913D
GetProcAddress.KERNEL32(00000000), ref: 00449144
GetCurrentProcess.KERNEL32(00000000,?,?,?,00449033), ref: 00449154

Strings

IsWow64Process, xrefs: 00449133
kernel32, xrefs: 00449138

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: 6c05ae88430496d7c1e5747cadbb2450a7d43a6cdcdd9a98c6cdb441cd4baf3e
Instruction ID: 90166c9e98d251b531e62a4516fa3404c564f60de375b7ca6a671feab15bcf4a
Opcode Fuzzy Hash: 6c05ae88430496d7c1e5747cadbb2450a7d43a6cdcdd9a98c6cdb441cd4baf3e
Instruction Fuzzy Hash: 10E04F75C01318EBDB1097F49C0EB8F7AAC9B05762F110862A402E3140D67C990097A9

Function 0041C9FF Relevance: 7.6, APIs: 5, Instructions: 121COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,00000000,?,?,?,?,00417D63,?,F14A3287,?,?,?,?,?,004A1C97), ref: 0041CA3A
CharNextW.USER32(?,?,?,00000000,?,?,?,?,00417D63,?,F14A3287), ref: 0041CAC0

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 85bd4b672b182e9eb2c238d5417de2cf6389fc53f8ab4e700dd7ec8e95eca58b
Instruction ID: a7d5401e36f25a153661962bc042ce700e04339cb60993d94454109360c447cf
Opcode Fuzzy Hash: 85bd4b672b182e9eb2c238d5417de2cf6389fc53f8ab4e700dd7ec8e95eca58b
Instruction Fuzzy Hash: 5241AF35A44306EFCB10CF68D9C16AAB7F5EF58384764452EE986C7310E738AD81C798

Function 0048D4D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(-00000004,?,00000001,?,004AD93C,000000FF,00000002,F14A3287,?I,00489EF7,00489EF7), ref: 0048D5C9
SetLastError.KERNEL32(004C2468,?,00000000,000000FF), ref: 0048D617

Strings

?I, xrefs: 0048D4F0
T"L, xrefs: 0048D54F
h$L, xrefs: 0048D5C2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast
String ID: T"L$h$L$?I
API String ID: 1452528299-1484116276
Opcode ID: 2b2a3f68dfed87ac3b60c71acb3f2be012351ed9ed5c4bdb7ea34c67aa61e6ac
Instruction ID: f904f3a8f54f90b6c6572f4243364bd31cee57d7ada68c09ed9f3731cbb21dec
Opcode Fuzzy Hash: 2b2a3f68dfed87ac3b60c71acb3f2be012351ed9ed5c4bdb7ea34c67aa61e6ac
Instruction Fuzzy Hash: 6A41AD70901204EFDB14EF68C984BAEBBB0FB49318F20462FE0159B6D1D778A905CB88

Function 004805F0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(F14A3287), ref: 0048063C
SetLastError.KERNEL32(004C2480,00000000,00000000,000000FF), ref: 00480696
GetLastError.KERNEL32(00000000,-00000002), ref: 004806DA
SetLastError.KERNEL32(?,00000000,00000000,000000FF), ref: 00480725

Strings

P$L, xrefs: 0048072B

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast
String ID: P$L
API String ID: 1452528299-494869439
Opcode ID: 10040935d14e1193d37ef16a03d3232065db0441b19b9293bdaea828b49e29d1
Instruction ID: aeadcc9f4b1e9b18c7bf804370c684a588ed9f6d52b535cc254baf3cd3407b60
Opcode Fuzzy Hash: 10040935d14e1193d37ef16a03d3232065db0441b19b9293bdaea828b49e29d1
Instruction Fuzzy Hash: 87417F75D00205EFDB00DF94C944B9EBBB4FF08318F10462AE816AB790D7B9A919CB98

Function 00455BD6 Relevance: 7.6, APIs: 5, Instructions: 97fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00455BEE

Part of subcall function 0045BD01: _malloc.LIBCMT ref: 0045BD19

GetLastError.KERNEL32 ref: 00455C10
WriteFile.KERNEL32(?,?,00000004,?,00000000), ref: 00455C70
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00455C80
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00455CB6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: File$PointerWrite$ErrorLast_malloc
String ID:
API String ID: 1600787859-0
Opcode ID: 84bcab722c14cbe2b23b541d97b47d69e42d5a302d6ddb4ab5dffc58f96a107a
Instruction ID: 885501c383654c567a1fa2818647b020c42eae8a8f19ab57b2d6bbad1d4a17d8
Opcode Fuzzy Hash: 84bcab722c14cbe2b23b541d97b47d69e42d5a302d6ddb4ab5dffc58f96a107a
Instruction Fuzzy Hash: 3E31A232600715BFEB225F61CC46FA67FA9FF00751F004026FE00AA1A2D7B2B9649BD4

Function 0046A336 Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0046A342

Part of subcall function 0045D24B: __FF_MSGBANNER.LIBCMT ref: 0045D262
Part of subcall function 0045D24B: __NMSG_WRITE.LIBCMT ref: 0045D269
Part of subcall function 0045D24B: RtlAllocateHeap.NTDLL(007C0000,00000000,00000001,00000000,?,00000000,?,00469A0C,00000008,00000008,00000008,?,?,00462EB6,00000018,004D0708), ref: 0045D28E

_free.LIBCMT ref: 0046A355

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 0e97a03d48efdf758033f947a7fdfbac29c5f97671c8c97523374da1eff1a9c8
Instruction ID: 2e1410c875785363b8131a0b89eec60db6467d749e82a8a55ac84d1ee703b453
Opcode Fuzzy Hash: 0e97a03d48efdf758033f947a7fdfbac29c5f97671c8c97523374da1eff1a9c8
Instruction Fuzzy Hash: CD119832D05A15ABCB313F759C0565A3B949F04365F10442BFD05AA392FA3DCC918B5F

Function 00414099 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004140BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004140CB
GetTickCount.KERNEL32 ref: 004140D5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004140F4
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041411D

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CountTick
String ID:
API String ID: 404621862-0
Opcode ID: 3ba08f6c0388d37db5e5b731d3532e7c6cd3322606b23da0224908394ff07df1
Instruction ID: 4c44fe8c65408a5cdc6b7313866b3a16ea72c02475fadf47d6c4d3abd21fbd0e
Opcode Fuzzy Hash: 3ba08f6c0388d37db5e5b731d3532e7c6cd3322606b23da0224908394ff07df1
Instruction Fuzzy Hash: 50216A71200305AFEB20DF25EC91F6777BAEB94711F20491EB9428B690CB79F855CB64

Function 004159F8 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004159FF
GetLastError.KERNEL32(00000004,00416B0B,?,?,?,00000000), ref: 00415A27
SetLastError.KERNEL32(00000000), ref: 00415A4C
SysStringLen.OLEAUT32(00000000), ref: 00415A69
SetLastError.KERNEL32(?,00000000,00000000,00000001), ref: 00415A95

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3String
String ID:
API String ID: 2160793888-0
Opcode ID: 67acb548ac5358c1fdaef87f5c7e6f97679246ab6f2bd0e70bd9fdc9714f4b5b
Instruction ID: 44f6ec837a339ff0c78b448f17c5c5fd70abd63033e66046810226f2a2f0ef25
Opcode Fuzzy Hash: 67acb548ac5358c1fdaef87f5c7e6f97679246ab6f2bd0e70bd9fdc9714f4b5b
Instruction Fuzzy Hash: 1E215C74600605DFCB00DF64D584A99BBF1FF58315F04825AE8159B3A1C7B4E954CB95

Function 00461879 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00464914: __getptd_noexit.LIBCMT ref: 00464915
Part of subcall function 00464914: __amsg_exit.LIBCMT ref: 00464922

__calloc_crt.LIBCMT ref: 00461EC2

Part of subcall function 004699AC: __calloc_impl.LIBCMT ref: 004699BB
Part of subcall function 004699AC: Sleep.KERNEL32(00000000,?,00464954,00000001,000003BC), ref: 004699D2

__lock.LIBCMT ref: 00461EF8
___addlocaleref.LIBCMT ref: 00461F04
__lock.LIBCMT ref: 00461F18
InterlockedIncrement.KERNEL32(?), ref: 00461F28

Part of subcall function 0045D096: __getptd_noexit.LIBCMT ref: 0045D096

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: __getptd_noexit__lock$IncrementInterlockedSleep___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2144732038-0
Opcode ID: 76eb2fbd5491919f07ace2023da43e45013085706c55ce72011a505e8ab08cd0
Instruction ID: 00eebec80622ee4efbde0cb9d9834e9d9a1aecc04839cc1986aa9ba72ac805bb
Opcode Fuzzy Hash: 76eb2fbd5491919f07ace2023da43e45013085706c55ce72011a505e8ab08cd0
Instruction Fuzzy Hash: 6D015271544701AAEB20BFB5C906B1D77A0AF44718F20411FF4559B2D2EB7D89408B6F

Function 00494A50 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00494F5A,F14A3287), ref: 00494A60
SetLastError.KERNEL32(?), ref: 00494A90
GetLastError.KERNEL32 ref: 00494AA4
SetLastError.KERNEL32(?), ref: 00494AD4

Strings

P$L, xrefs: 00494A96

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast
String ID: P$L
API String ID: 1452528299-494869439
Opcode ID: 577d494c6db54462b770ab6fec96faf82299ca26bb7724b78fe5bc071f19bebc
Instruction ID: 0d7ade02c8340037191c60153f776e10f14f8701a3ca54a0113d9b4420321566
Opcode Fuzzy Hash: 577d494c6db54462b770ab6fec96faf82299ca26bb7724b78fe5bc071f19bebc
Instruction Fuzzy Hash: E1214CB49112818FDB94DF68C9C87053FE1BF09328B1193A9DC698F2AAD7B5C845CF49

Function 00445DF3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00445DFD

Strings

*.*, xrefs: 00445E2E
x$L, xrefs: 00446061, 0044601C, 0044601F
x$L, xrefs: 00445F92, 00445FCD, 00445F95

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_
String ID: *.*$x$L$x$L
API String ID: 2427045233-290107637
Opcode ID: 9bb8ef36f718e3c25d7ea8d7b7070e150be67d8bf774e1d2afe14e4fcaea0c01
Instruction ID: f0b7998df1a9e90041a729464924a010b149ad6420b585b1b2bc6690ea90bce7
Opcode Fuzzy Hash: 9bb8ef36f718e3c25d7ea8d7b7070e150be67d8bf774e1d2afe14e4fcaea0c01
Instruction Fuzzy Hash: 929171719002189BDF24DF24C881BEDB7B4AF45314F1181EFE51AA7282DB785E89CF69

Function 0044D439 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044D443
GetLastError.KERNEL32 ref: 0044D689

Strings

x$L, xrefs: 0044D572, 0044D595, 0044D5D7, 0044D613, 0044D578, 0044D5DE
x$L, xrefs: 0044D500

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_Last
String ID: x$L$x$L
API String ID: 1018228973-3102039750
Opcode ID: 5e0d985899cd61835ac3d487873b918bb3f698ae657756ddb8b950e51e139dc7
Instruction ID: a708936c546995ede1d73ab416a0e34f62dd637d08fa75ea6d829840c0b4597b
Opcode Fuzzy Hash: 5e0d985899cd61835ac3d487873b918bb3f698ae657756ddb8b950e51e139dc7
Instruction Fuzzy Hash: 48818371900158DEDF15EF64C884BED7BB8BF15304F4440EEE849A7282DB78AA88CB75

Function 00430AFC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00430B06

Part of subcall function 00402CE0: GetLastError.KERNEL32(F14A3287,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402D30
Part of subcall function 00402CE0: SetLastError.KERNEL32(?,004C2254,00000000,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402DA8

Part of subcall function 0042E092: __EH_prolog3_GS.LIBCMT ref: 0042E099

Strings

PrereqEngine: , xrefs: 00430C99
($L, xrefs: 00430D3F, 00430D42, 00430D46
T"L, xrefs: 00430C34

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_H_prolog3_catch_
String ID: ($L$PrereqEngine: $T"L
API String ID: 1178870419-519419356
Opcode ID: d521a8e5aea8dad190e81571c3e4609aa2663c13a5d9efcc5f9e86efe21329f9
Instruction ID: ace50688af4f55c77889dcb75be41a018afaf5c58631db45e1dd4b2aec2b6097
Opcode Fuzzy Hash: d521a8e5aea8dad190e81571c3e4609aa2663c13a5d9efcc5f9e86efe21329f9
Instruction Fuzzy Hash: 0E719371A00155AFDB18EF65CD55BDEF7B8AF04304F0046AFA41AB3292DB746A44CF68

Function 0049C11E Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

__getbuf.LIBCMT ref: 0049EC4D
__cftof.LIBCMT ref: 0049ED09

Part of subcall function 0047B6F3: __wctomb_s_l.LIBCMT ref: 0047B704

Strings

xyM, xrefs: 0049EC9C
xyM, xrefs: 0049ECE5

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: __cftof__getbuf__wctomb_s_l
String ID: xyM$xyM
API String ID: 815794881-1300725712
Opcode ID: d6f18dae3cf637cde7fece32a3daa2b80290af14590f252bdf29ba43c49eba8e
Instruction ID: 5406395a7ed0d4de07a692903b5a50c728baff40e9c5ae774d46c211a04c0d02
Opcode Fuzzy Hash: d6f18dae3cf637cde7fece32a3daa2b80290af14590f252bdf29ba43c49eba8e
Instruction Fuzzy Hash: 1A51E771400607ABDB24DB2AC841B7ABFA5BF51328F14837BE465872C1D73CE851CB89

Function 00454C5E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00454C65

Part of subcall function 004532E1: SetLastError.KERNEL32(0000007F), ref: 004532EF

Strings

+SE, xrefs: 00454D90
+SE, xrefs: 00454D4C, 00454CE9
4+SE, xrefs: 00454DA2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3Last
String ID: +SE$+SE$4+SE
API String ID: 685212868-1428225977
Opcode ID: 309e25651d2c398cf27f88e60dc5f4d777b1c3d9cb298216214fa3c8cd0ce130
Instruction ID: d1102f1d2e85df7f51f265bf7b7555d06442bed681a76ade913c82e66f2dc9cb
Opcode Fuzzy Hash: 309e25651d2c398cf27f88e60dc5f4d777b1c3d9cb298216214fa3c8cd0ce130
Instruction Fuzzy Hash: F5516D72C012199FCF15EFA5D8416EEB7B4AF8435AF14005BEC05AB242EB385E49CB99

Function 0044831E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00448325

Part of subcall function 00404200: GetLastError.KERNEL32 ref: 0040421F
Part of subcall function 00404200: SetLastError.KERNEL32(?), ref: 0040424F

Part of subcall function 0044540D: FindResourceExW.KERNEL32(?,00000006,?,?,?,00000000,?,?,0040D383,x$L,?,00000002,?), ref: 0044542C

SetDlgItemTextW.USER32(?,?,?), ref: 0044842B

Strings

x$L, xrefs: 00448387
x$L, xrefs: 0044834C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FindH_prolog3_ItemResourceText
String ID: x$L$x$L
API String ID: 3193201603-3102039750
Opcode ID: 1bd6dc7ea7e6d0a6d4d860ca11779ef7021c4cce3da53f615287195d04a0cec9
Instruction ID: 08c81f22c36335f94d4dcdf5d81088c23b122eb34041e221f994dcbc9005327f
Opcode Fuzzy Hash: 1bd6dc7ea7e6d0a6d4d860ca11779ef7021c4cce3da53f615287195d04a0cec9
Instruction Fuzzy Hash: 09413DB2D00219DBEF11DFE5C884AEE7BB8BF14344F14412FE911A3242EB749945CB65

Function 00440443 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044044A

Part of subcall function 00445DB8: __EH_prolog3.LIBCMT ref: 00445DBF

GetLastError.KERNEL32 ref: 00440485

Part of subcall function 004484F8: __EH_prolog3.LIBCMT ref: 004484FF

Strings

x$L, xrefs: 004404E6
x$L, xrefs: 0044052D

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3$ErrorH_prolog3_Last
String ID: x$L$x$L
API String ID: 3513993312-3102039750
Opcode ID: ad2b8bef8b226f32cb5ad596dfb8b9165d135dcd8352903bb7f102a4807ef1ae
Instruction ID: e7b1eeeaedc518ef8b0a4ddcf36bc6975898cb4a1abae706b1c99d60f94e3066
Opcode Fuzzy Hash: ad2b8bef8b226f32cb5ad596dfb8b9165d135dcd8352903bb7f102a4807ef1ae
Instruction Fuzzy Hash: 9131C6B1C01104AFDB04FFA5C942AEE7768AF15348F54401FFD196B192EB7C5609C7AA

Function 00461807 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 0046181A

Strings

U, xrefs: 00461823

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: 98e28b441c8a6c9bfef29dba5fb15df6fdd51774617e295fa26da9ef8557c35f
Instruction ID: 2a902158faab939ae1d7fb08c97c20a2e6bdcde8a368e0c736c2f7cc2adfa216
Opcode Fuzzy Hash: 98e28b441c8a6c9bfef29dba5fb15df6fdd51774617e295fa26da9ef8557c35f
Instruction Fuzzy Hash: CE21D8316052086EEB10AAA5DC41BBB73ACDB84754F58406BF909C71A1FB68ED40969A

Function 0040D44B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040D455
DialogBoxIndirectParamW.USER32(?,00000000,?,?,?), ref: 0040D54B

Strings

MS Sans Serif, xrefs: 0040D4A5
x$L, xrefs: 0040D512

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: DialogH_prolog3_IndirectParam
String ID: MS Sans Serif$x$L
API String ID: 1500191164-3827839863
Opcode ID: 7b82429e080cc8c611aafd173976e5de93cecfa76f6aedf2f99314faee23d17c
Instruction ID: 649b708799c343c68b205abb52ed75fed7877b7eba6694afb2ae34dc38361df7
Opcode Fuzzy Hash: 7b82429e080cc8c611aafd173976e5de93cecfa76f6aedf2f99314faee23d17c
Instruction Fuzzy Hash: 26314C70800219EBDF10EFA5C845BADBBB4BF14348F10406EF855B7282DB786A59DBA5

Function 0043066E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00430685

Part of subcall function 00403FB0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,004AB968,000000FF), ref: 00403FF3
Part of subcall function 00403FB0: SetLastError.KERNEL32(?,004C2254,00000000,?,?,?,?,?,004AB968,000000FF), ref: 00404068

Strings

[System64Folder], xrefs: 004306AD
($L, xrefs: 00430845, 0043084B
,)L, xrefs: 00430854

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$DirectorySystem
String ID: ($L$,)L$[System64Folder]
API String ID: 860285823-2915527212
Opcode ID: 603db4cafcbc1ea15bfc0f4fceaa3a8c5b7f8ed311c92741f519c57a130597a8
Instruction ID: aae636797dd6e181bfe829deb93d3fdc6d801a54654e922ad42965acbdbc360e
Opcode Fuzzy Hash: 603db4cafcbc1ea15bfc0f4fceaa3a8c5b7f8ed311c92741f519c57a130597a8
Instruction Fuzzy Hash: E8312C71910218DADB65EB61CD99BDDB778AB14304F4001EAA109B20E1DF782FC8CF69

Function 00430488 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00430494

Part of subcall function 00403FB0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,004AB968,000000FF), ref: 00403FF3
Part of subcall function 00403FB0: SetLastError.KERNEL32(?,004C2254,00000000,?,?,?,?,?,004AB968,000000FF), ref: 00404068

Strings

($L, xrefs: 00430845, 0043084B
,)L, xrefs: 00430854
[WindowsFolder], xrefs: 004304BC

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$DirectoryWindows
String ID: ($L$,)L$[WindowsFolder]
API String ID: 1506654308-117676957
Opcode ID: f5b9e58285d3dba385d50c69bbd9fad0dac8d7b203e28903c6595544843c01f5
Instruction ID: ead1f98a0f67c36631cdbda8275539057effedca260fdfca1dd8d93893c3f26a
Opcode Fuzzy Hash: f5b9e58285d3dba385d50c69bbd9fad0dac8d7b203e28903c6595544843c01f5
Instruction Fuzzy Hash: 01310C71911118DADF65EB61CD99BDDB7B8AF14304F4002EAA109B21A1DF782FC8CF69

Function 0043057B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00430587

Part of subcall function 00403FB0: GetLastError.KERNEL32(F14A3287,?,?,?,?,?,004AB968,000000FF), ref: 00403FF3
Part of subcall function 00403FB0: SetLastError.KERNEL32(?,004C2254,00000000,?,?,?,?,?,004AB968,000000FF), ref: 00404068

Strings

($L, xrefs: 00430845, 0043084B
[SystemFolder], xrefs: 004305AF
,)L, xrefs: 00430854

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$DirectorySystem
String ID: ($L$,)L$[SystemFolder]
API String ID: 860285823-1618051968
Opcode ID: d42a5b922f7a67ff9e128e3891ae8cf53147c50d70bbb06cd42959d7c6b8bb08
Instruction ID: 840996e71fe138e90bf02b2d0015a7973eecd09812a0e9badf2a5cf7eb97a6e0
Opcode Fuzzy Hash: d42a5b922f7a67ff9e128e3891ae8cf53147c50d70bbb06cd42959d7c6b8bb08
Instruction Fuzzy Hash: 1A313E70900159DADF65EB61CDA9BDDB778AB14304F4002EAA109B21E1DF782FC8CF69

Function 00444B3D Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00444B47

Part of subcall function 0043A393: _memset.LIBCMT ref: 0043A3BC

Part of subcall function 004090B1: __EH_prolog3_GS.LIBCMT ref: 004090B8

Part of subcall function 0040B3EC: __EH_prolog3_GS.LIBCMT ref: 0040B3F6
Part of subcall function 0040B3EC: GetModuleHandleW.KERNEL32(KERNEL32.DLL,00000274,00439E16,?,00000000), ref: 0040B419
Part of subcall function 0040B3EC: GetProcAddress.KERNEL32(00000000,GetSystemWindowsDirectoryW), ref: 0040B42D

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Strings

Kernel32.dll, xrefs: 00444B62
Z, xrefs: 00444C1C
x$L, xrefs: 00444BB3

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_$ErrorLast$AddressH_prolog3HandleModuleProc_memset
String ID: Kernel32.dll$Z$x$L
API String ID: 1928657999-1373644189
Opcode ID: 91b5874072f446d44c93912bf89af71a6a4ba2e67e8097de5b565f9dff57bb48
Instruction ID: b996e9510bb1b24447c1389079f2c61d56c97d6a24abda17b111db35bdb5d793
Opcode Fuzzy Hash: 91b5874072f446d44c93912bf89af71a6a4ba2e67e8097de5b565f9dff57bb48
Instruction Fuzzy Hash: 4321A0308012189EDB54EB90CC92BDDB378EF14304F5080AEE54967192DFB85B8DCB69

Function 004948B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004948F7
_memset.LIBCMT ref: 00494904

Part of subcall function 004999D0: GetDC.USER32(?), ref: 004999D9
Part of subcall function 004999D0: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004999EA
Part of subcall function 004999D0: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004999F1
Part of subcall function 004999D0: ReleaseDC.USER32(?,00000000), ref: 004999F9

Strings

d, xrefs: 0049492F
d, xrefs: 00494936

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CapsDevice_memset$Release
String ID: d$d
API String ID: 2582967517-195624457
Opcode ID: d9ef455ce54d51cc95e94b86417a353445c7cad84f34930164943f8fb67da3f3
Instruction ID: bb71435feac8ad824ddb331ede0f656f7eae214162ec6989636dce8986d83c42
Opcode Fuzzy Hash: d9ef455ce54d51cc95e94b86417a353445c7cad84f34930164943f8fb67da3f3
Instruction Fuzzy Hash: 2C21F4B1600244EFEB54DF59C885B4ABBE8FB08714F5041AEED149B386D3BAA904CB94

Function 0046DABA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 0046DAD1
_wcscmp.LIBCMT ref: 0046DAE2

Strings

OCP, xrefs: 0046DADC
ACP, xrefs: 0046DACB

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _wcscmp
String ID: ACP$OCP
API String ID: 856254489-711371036
Opcode ID: e68728434965ee4785b78a891b9105f575cc7671040f233f40e709cb2c3f5a99
Instruction ID: 92a64fc01f30d840308e080ad64c935c8224c6dc8ad1161c4ed3cf4ac9ccb31f
Opcode Fuzzy Hash: e68728434965ee4785b78a891b9105f575cc7671040f233f40e709cb2c3f5a99
Instruction Fuzzy Hash: 6A018032F002057AEB10AA5ADC42FD7378C9F14B65F154427F908EA28AF638F650829F

Function 0043A154 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043A15B
GetLastError.KERNEL32(0000003C,00486CD9,?,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 0043A186
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0043A1B7

Strings

h$L, xrefs: 0043A17A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_
String ID: h$L
API String ID: 3339191932-923250583
Opcode ID: 9f6dd5faf65c11ddf59242128bbe51d701420a8acc8519130eae53367d93529f
Instruction ID: 1af0edeafed65eacda4521db2ea90bb9a27958ca7ead67402a8a32cfa19b3164
Opcode Fuzzy Hash: 9f6dd5faf65c11ddf59242128bbe51d701420a8acc8519130eae53367d93529f
Instruction Fuzzy Hash: 97216DB1900216EFCB00DF65C944A5ABBB4FF18714F14811FE8059B751C7B4EA65CBD9

Function 0040E229 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040E230
__itow_s.LIBCMT ref: 0040E267
SetLastError.KERNEL32(?,?,00000000,00000001), ref: 0040E296

Strings

,)L, xrefs: 0040E246

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_Last__itow_s
String ID: ,)L
API String ID: 3681815494-4114281670
Opcode ID: c5d5a8c69f8075cb70a2df17bee260a137f44c0f47ec50f36711d8017f098c4e
Instruction ID: 744ae986decb669dd3b515fe56183bcfd3d85984a9d8209420d6d46bf4e1ec05
Opcode Fuzzy Hash: c5d5a8c69f8075cb70a2df17bee260a137f44c0f47ec50f36711d8017f098c4e
Instruction Fuzzy Hash: 6601D475900204EBC710EF91D841EAE77B8FF54704F04442FF901AB281DBB99905CB98

Function 004107BF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,?,?,0040E7B5,?,?,00000000,?,?,?,?,?,?), ref: 004107CF
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 004107DF

Strings

Advapi32.dll, xrefs: 004107CA
RegCreateKeyTransactedW, xrefs: 004107D9

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1646373207-2994018265
Opcode ID: 1a4218d802c678f4a45034468431c99236844564acd63b0ca38e9309f50746c6
Instruction ID: 07d3fab8b9e74e72114f3ac9f5acb52d8db5b84f7d1b571f280d41e1b0e1b579
Opcode Fuzzy Hash: 1a4218d802c678f4a45034468431c99236844564acd63b0ca38e9309f50746c6
Instruction Fuzzy Hash: AAF03732144209EFCF122F90DC04BEA7BA5FF09B52F048426FA4690460C7BAC4E0EB98

Function 00408EF3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00408EFA
GetLastError.KERNEL32(00000004,0040AAE9,?,004480EE,00000098,?,00000000,?,?,?,0040A496,x$L,00000000,00000002,0000003A,00000001), ref: 00408F1C
SetLastError.KERNEL32(?,00000000,004480EE,00000098,00000000,?,004480EE,00000098,?,00000000,?,?,?,0040A496,x$L,00000000), ref: 00408F5D

Strings

h$L, xrefs: 00408F10

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3
String ID: h$L
API String ID: 3502553090-923250583
Opcode ID: 0baff9add7c46e2743696bc47ce554dff753f495ee0b0847cace27ae5cc0785f
Instruction ID: 83f44063af9ff95183e6f1c12798c23c96d0b7b94c32f63933576602f8da04bc
Opcode Fuzzy Hash: 0baff9add7c46e2743696bc47ce554dff753f495ee0b0847cace27ae5cc0785f
Instruction Fuzzy Hash: 8B0148B5900206EBCB009F65CA44959BBF0FF08754B40812AB8099BA61D7B4E921DF89

Function 00401820 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00401830
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00401840

Strings

Advapi32.dll, xrefs: 0040182B
RegOpenKeyTransactedW, xrefs: 0040183A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1646373207-3913318428
Opcode ID: 11045f41e212249c8ad9a16e393da81905597585f095999f917618116799cfcc
Instruction ID: 21935906008992eb64849443a66015796f3843e177551ba4bf8d071e4f36ae89
Opcode Fuzzy Hash: 11045f41e212249c8ad9a16e393da81905597585f095999f917618116799cfcc
Instruction Fuzzy Hash: 32F03032140218ABDB216F95EC04FD77B95AB05751F048037FA01905B0C7B9C9A0EB68

Function 00409574 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040957B
GetLastError.KERNEL32(00000038,0040DCC8,004480DB,?,004AEF80), ref: 00409582
SetLastError.KERNEL32(00000000), ref: 004095D6

Strings

T"L, xrefs: 00409592

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_
String ID: T"L
API String ID: 3339191932-1277957349
Opcode ID: 02345dc90da8019aa92152dc478d91ef415f402a5bcbeb6b1da40204ee2683f1
Instruction ID: 728a7f5e02787a863d088c42abdb00d1ee10d10699d3555baa31abef38f5623b
Opcode Fuzzy Hash: 02345dc90da8019aa92152dc478d91ef415f402a5bcbeb6b1da40204ee2683f1
Instruction Fuzzy Hash: CCF0AF31900205DBCB15EB62C854BADB7B5AF84309F40847EF4426B1D2CB7DED4ACB49

Function 0042E005 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042E00F

Part of subcall function 0042A98B: __EH_prolog3.LIBCMT ref: 0042A992

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Strings

($L, xrefs: 0042E036, 0042E05F
($L, xrefs: 0042E047, 0042E04A
,)L, xrefs: 0042E053

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3H_prolog3_
String ID: ($L$($L$,)L
API String ID: 852442433-2360569925
Opcode ID: 126864c6abed3a8b2c94201ee69ba4d671859c36c8aac0ae6ffd887cf9200692
Instruction ID: 4c7f4091ddb1bf0d1f940531c17d909c900a24f7b16e6814c57aa840dde18e22
Opcode Fuzzy Hash: 126864c6abed3a8b2c94201ee69ba4d671859c36c8aac0ae6ffd887cf9200692
Instruction Fuzzy Hash: 52F08170700224DFDB55FB52C891BED73A8AB10304F90405EF545AA181CBFC5A8ACB9A

Function 0042E273 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042E27D

Part of subcall function 0042A98B: __EH_prolog3.LIBCMT ref: 0042A992

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Strings

($L, xrefs: 0042E2A4, 0042E2CD
x$L, xrefs: 0042E2B5, 0042E2B8
,)L, xrefs: 0042E2C1

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3H_prolog3_
String ID: ($L$,)L$x$L
API String ID: 852442433-444186537
Opcode ID: 5e99b2c3b3a6e007fab7ae23ad08e220333a0ff289e7023122daafebed39e0f3
Instruction ID: dedd52f07bf6eaf8c6ed6f04e3e06abfa141803484477bdd9f2d3458bcd7bf12
Opcode Fuzzy Hash: 5e99b2c3b3a6e007fab7ae23ad08e220333a0ff289e7023122daafebed39e0f3
Instruction Fuzzy Hash: B6F081707002249FDB41EB52C851BAD73A8BB10305F90409EF545AA181CBFC5A49CBAE

Function 00444C97 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.lib,IsTextUnicode), ref: 00444CAC
GetProcAddress.KERNEL32(00000000), ref: 00444CB3

Strings

IsTextUnicode, xrefs: 00444CA2
Advapi32.lib, xrefs: 00444CA7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.lib$IsTextUnicode
API String ID: 1646373207-3723215607
Opcode ID: 6bbb00f72ed701958eedc7a73e552777480d14488978a414efe764b7fb557654
Instruction ID: 8180677f1a6d51b6db277f64fac6042deab5dbddf1f47d366f4d5127e15ba5f3
Opcode Fuzzy Hash: 6bbb00f72ed701958eedc7a73e552777480d14488978a414efe764b7fb557654
Instruction Fuzzy Hash: 50E0ED31602629A7BF200EA18C88BEB3758AA8271170D4023F80493640CA3CC940ABAA

Function 0041585B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00415862
GetLastError.KERNEL32(00000004,0041596D,?,?,?,00000000), ref: 00415884
SetLastError.KERNEL32(?,?,?,?), ref: 004158B6

Strings

h$L, xrefs: 00415878

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3
String ID: h$L
API String ID: 3502553090-923250583
Opcode ID: 0999962d8df64610b294d4946d182f7d81d783f443721d1c210ae56f5c9d33b2
Instruction ID: bf63fee513bed128d57c7b3c464fdef35c9cda7da32fa710fc10d221852ae00f
Opcode Fuzzy Hash: 0999962d8df64610b294d4946d182f7d81d783f443721d1c210ae56f5c9d33b2
Instruction Fuzzy Hash: BC01F2B4900A16EFCB059F15C944A99BBF0FF18724B00811AF8098BA21C7B4EA64DFC9

Function 004617A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 004617C1

Part of subcall function 00462DCD: __mtinitlocknum.LIBCMT ref: 00462DDF
Part of subcall function 00462DCD: __amsg_exit.LIBCMT ref: 00462DEB
Part of subcall function 00462DCD: EnterCriticalSection.KERNEL32(00000000,?,004649E4,0000000D), ref: 00462DF8

__updatetlocinfoEx_nolock.LIBCMT ref: 004617D1

Part of subcall function 00463D9B: ___addlocaleref.LIBCMT ref: 00463DB7
Part of subcall function 00463D9B: ___removelocaleref.LIBCMT ref: 00463DC2
Part of subcall function 00463D9B: ___freetlocinfo.LIBCMT ref: 00463DD6

Strings

@xM, xrefs: 004617B2
@xM, xrefs: 004617B7, 004617CC, 004617D8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CriticalEnterEx_nolockSection___addlocaleref___freetlocinfo___removelocaleref__amsg_exit__lock__mtinitlocknum__updatetlocinfo
String ID: @xM$@xM
API String ID: 236788210-775209513
Opcode ID: bda1b5882d8b55477feb5ff394aa03f274afb83e3cb3da782089ac43fcaa84f0
Instruction ID: dc244f286a0109975fd64268f9202caae1140b72f16b70d820191970d27ccf52
Opcode Fuzzy Hash: bda1b5882d8b55477feb5ff394aa03f274afb83e3cb3da782089ac43fcaa84f0
Instruction Fuzzy Hash: B5E0CD3158A300A6D610BBA69C4BB0D77A09B0072AF60516FF014952D1FABC0500DEEF

Function 00459DAE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00459DC1

Part of subcall function 0045C2C1: std::exception::_Copy_str.LIBCMT ref: 0045C2DA

__CxxThrowException@8.LIBCMT ref: 00459DD6

Part of subcall function 0045A275: RaiseException.KERNEL32(?,?,00459DDB,00000000,?,?,?,?,00459DDB,00000000,004D043C,?), ref: 0045A2C6

Strings

kK, xrefs: 00459DCF
kK, xrefs: 00459DCB, 00459DBE

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: kK$ kK
API String ID: 757275642-1876632798
Opcode ID: c2bd168662d5fb4859ba41059f1b18f0b49d6d293c01d518088545664fa37370
Instruction ID: 7d811e14caa721f60922b2b0d6e7cb6582691d6c45cbc5807753b866d98e5921
Opcode Fuzzy Hash: c2bd168662d5fb4859ba41059f1b18f0b49d6d293c01d518088545664fa37370
Instruction Fuzzy Hash: 5CD06776C0020CBB8F04EF95D8969CD7BB8AA04344F50816BB91596241EB78A7488BD9

Function 00444AFC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetProcessId), ref: 00444B06
GetProcAddress.KERNEL32(00000000), ref: 00444B0D

Strings

kernel32.dll, xrefs: 00444B01
GetProcessId, xrefs: 00444AFC

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetProcessId$kernel32.dll
API String ID: 1646373207-399901964
Opcode ID: fc3ef0b76fdcdaef80fdf94d113d038b9c3340bb568f08adaa7576c829d47a7e
Instruction ID: fddd4db4f3f8ea54cb94bc0578594d30d2817c703d23c0e4206a5de5d42f2cd4
Opcode Fuzzy Hash: fc3ef0b76fdcdaef80fdf94d113d038b9c3340bb568f08adaa7576c829d47a7e
Instruction Fuzzy Hash: E4B092F0AD520A968E001BF49C0EE983A5456DAB0372006217913C54D0CAAC8040473A

Function 004858C0 Relevance: 6.3, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(F14A3287,?,?,?,?,00000000,004AA679,000000FF,?,0048585A,?,00000000), ref: 00485903
SetLastError.KERNEL32(?,?,0048585A,?,00000000), ref: 0048593C
MultiByteToWideChar.KERNEL32(00000000,00000000,004C20A8,?,00000000,00000000,?,0048585A,?,00000000), ref: 00485962
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,0048585A,?,00000000), ref: 004859AE
SetLastError.KERNEL32(?,?,0048585A,?,00000000), ref: 004859BC

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWide
String ID:
API String ID: 3361762293-0
Opcode ID: b9a72b0f5264e09d39f208567396b4048f44132e739a934a173ba456c100fa32
Instruction ID: 937148096f0d878cc4936a0d6a921a161936a72249e9b41c2212f9482a41f1f1
Opcode Fuzzy Hash: b9a72b0f5264e09d39f208567396b4048f44132e739a934a173ba456c100fa32
Instruction Fuzzy Hash: 5D3159B5A00701EFDB249F18D944B5ABBF4FB08720F10452EE946DB7A0D7B4A910CB99

Function 004658E3 Relevance: 6.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00465967
_memmove.LIBCMT ref: 004659AE
___AdjustPointer.LIBCMT ref: 004659FC
_memmove.LIBCMT ref: 00465A05

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: 53612768e8c88b7936308da9dcfcdabf9d7a907422bbfa5cb1b83898def4bd14
Instruction ID: cd1d2b410ebc96b64e32288308ec7004953489122a10ef66447fad1cac591b1d
Opcode Fuzzy Hash: 53612768e8c88b7936308da9dcfcdabf9d7a907422bbfa5cb1b83898def4bd14
Instruction Fuzzy Hash: 7541F675204B029EEB259F95D882B6737A49F00324F24411FF8458A6D2FB79D884DA1F

Function 00404F90 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(F14A3287,00000000,771ADFA0,771AE010), ref: 00405053
SysFreeString.OLEAUT32(?), ref: 0040506F
SysFreeString.OLEAUT32(?), ref: 0040507A
SetLastError.KERNEL32(?), ref: 0040509A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeLastString
String ID:
API String ID: 3822639702-0
Opcode ID: 4ddb2d0d05fd0561f71f3d85e8ea4d32f124cc9cf9380a9582a6516a45d9e3f5
Instruction ID: 4c69a49339489d1424332c467c9519990d6d6ffb2f827d33a62a8e007e3cf78e
Opcode Fuzzy Hash: 4ddb2d0d05fd0561f71f3d85e8ea4d32f124cc9cf9380a9582a6516a45d9e3f5
Instruction Fuzzy Hash: A3417C31604609ABCF10DF24C941B9E77E4EF05728F50863AF816A72D1DB39EA09CF99

Function 0044003E Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00440045
GetLastError.KERNEL32(00000048), ref: 00440051

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00457ACE: __EH_prolog3.LIBCMT ref: 00457AD5
Part of subcall function 00457ACE: GetLastError.KERNEL32(0000000C,00440096), ref: 00457AED
Part of subcall function 00457ACE: GetModuleHandleW.KERNEL32(Kernel32,CreateFileW), ref: 00457B04
Part of subcall function 00457ACE: GetProcAddress.KERNEL32(00000000), ref: 00457B0B
Part of subcall function 00457ACE: GetModuleHandleW.KERNEL32(Kernel32,CreateFileMappingW), ref: 00457BBE
Part of subcall function 00457ACE: GetProcAddress.KERNEL32(00000000), ref: 00457BC5
Part of subcall function 00457ACE: GetModuleHandleW.KERNEL32(Kernel32,MapViewOfFile), ref: 00457C38
Part of subcall function 00457ACE: GetProcAddress.KERNEL32(00000000), ref: 00457C3F

Part of subcall function 00444C97: GetModuleHandleW.KERNEL32(Advapi32.lib,IsTextUnicode), ref: 00444CAC
Part of subcall function 00444C97: GetProcAddress.KERNEL32(00000000), ref: 00444CB3

WideCharToMultiByte.KERNEL32(?,00000240,?,?,?,?,004B5BA4,?), ref: 0044012C
GetLastError.KERNEL32 ref: 00440139

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$AddressHandleModuleProc$H_prolog3$ByteCharMultiWide
String ID:
API String ID: 731440430-0
Opcode ID: 9e804e2f95abb8e34ebda321eec0eb34f82cc9ff88e499ef268996cee24fb288
Instruction ID: 825d2731be7f71520ae4ce6512bb409e2b98447dc169b88fbd6ec27e849dc2f9
Opcode Fuzzy Hash: 9e804e2f95abb8e34ebda321eec0eb34f82cc9ff88e499ef268996cee24fb288
Instruction Fuzzy Hash: FA4199B4801108AFDF00EFE4C945AEE7BB4AF15344F54042EF905A7252E7B95A49CBA9

Function 004556DA Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 004556F0
GetLastError.KERNEL32(?,?,?,?,?,?,0045567D,?,?,?), ref: 004556F6
IsBadReadPtr.KERNEL32(?,00000000), ref: 00455716
_memmove.LIBCMT ref: 00455747

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Read$ErrorLast_memmove
String ID:
API String ID: 1328700803-0
Opcode ID: e497389a6371511eb7504e06b937e71d72c5e2e38f69b280b9652ad900cfe469
Instruction ID: cfe727a950a7ba475585655b57f43bcbb5292f188cec95708af8229180c439cb
Opcode Fuzzy Hash: e497389a6371511eb7504e06b937e71d72c5e2e38f69b280b9652ad900cfe469
Instruction Fuzzy Hash: E231B571900616BBDB119F25CC85AABBBE8FF05355F04002BFC0497242E775E869CBA4

Function 00480B20 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00480B47
SysFreeString.OLEAUT32(?), ref: 00480B63
SysFreeString.OLEAUT32(?), ref: 00480B6E
SetLastError.KERNEL32(?), ref: 00480B8C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeLastString
String ID:
API String ID: 3822639702-0
Opcode ID: 7813cf8053f793ed92fea12e90202085a8a7cb280ed3ba72c597e23bae52fdf8
Instruction ID: 8e026de7b447388cd0975e6f375bede91bd33024bbf917e682e86c2d72d553e7
Opcode Fuzzy Hash: 7813cf8053f793ed92fea12e90202085a8a7cb280ed3ba72c597e23bae52fdf8
Instruction Fuzzy Hash: EC41B2719102149FDB61EF68C484B1ABBE0BF05358F19C4AAD8498F362C774FC98CB84

Function 00411B86 Relevance: 6.1, APIs: 4, Instructions: 94windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00411BAE
GetTickCount.KERNEL32 ref: 00411BEF
SendDlgItemMessageW.USER32(00000000,000003EC,0000000C,00000000,-00000004), ref: 00411C2B
SendDlgItemMessageW.USER32(00000000,000003ED,0000000C,00000000,-00000004), ref: 00411C64

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ItemMessageSend$CountTickWindow
String ID:
API String ID: 373309326-0
Opcode ID: bba068b499c6ede94149437b6ccb1f073806249f9430d7b68eabb287471ce5dd
Instruction ID: 254792aebdaa4617f89ee1205985f2190514e0976628983eb23283ce96efeb2f
Opcode Fuzzy Hash: bba068b499c6ede94149437b6ccb1f073806249f9430d7b68eabb287471ce5dd
Instruction Fuzzy Hash: E6317C71A01208AFDB14EFA5DC85FDEBBB9EF49704F00002AF506E72A1EB34A905CB54

Function 00418219 Relevance: 6.1, APIs: 4, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 0041824E
SysAllocStringLen.OLEAUT32(00000000,?), ref: 004182A6
SysStringLen.OLEAUT32 ref: 004182BB
SysFreeString.OLEAUT32 ref: 004182F8

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 6ea435b7fe83fa3da5ca806feab9dbedf55d89280ef7f40d5ecf892662f37b1d
Instruction ID: 02ab22465b694e4c81c9044175607345a9cf88781f27630763225839a12b7b48
Opcode Fuzzy Hash: 6ea435b7fe83fa3da5ca806feab9dbedf55d89280ef7f40d5ecf892662f37b1d
Instruction Fuzzy Hash: 8B21CEB1A00208FBDB119FA4CC45ADEBBB8AF08354F14802EFD55D6211EB3ADA548B58

Function 0044540D Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

FindResourceExW.KERNEL32(?,00000006,?,?,?,00000000,?,?,0040D383,x$L,?,00000002,?), ref: 0044542C
FindResourceExW.KERNEL32(?,00000006,00000000,?,?,?,0040D383,x$L,?,00000002,?), ref: 00445464
FindResourceExW.KERNEL32(?,00000006,00000000,00000400,?,?,0040D383,x$L,?,00000002,?), ref: 00445491
FindResourceExW.KERNEL32(?,00000006,00000000,00000000,?,?,0040D383,x$L,?,00000002,?), ref: 004454BB

Part of subcall function 00445399: __EH_prolog3_GS.LIBCMT ref: 004453A0
Part of subcall function 00445399: LoadResource.KERNEL32(?,?,00000038,004454D6,?,?,?,?,?,?,0040D383,x$L,?,00000002,?), ref: 004453B7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Resource$Find$H_prolog3_Load
String ID:
API String ID: 4133745404-0
Opcode ID: 1c8a19217f7acce447f84125a05574c9114a65b7da2423789dbf1377969c40bd
Instruction ID: c460527ce8d350057be4bbe8b86a400145f32ea703c81ab625a243240fdc712c
Opcode Fuzzy Hash: 1c8a19217f7acce447f84125a05574c9114a65b7da2423789dbf1377969c40bd
Instruction Fuzzy Hash: 652171B5800608BBFF209F15DD01BEB3B6DEF06354F008022FE15EA251E675DA119B65

Function 00405F80 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,75C0E860,F14A3287,?,771AE010,?,?,004ABD28,000000FF,,)L,004049B4), ref: 00405FF4
SetLastError.KERNEL32(?,00000007,00000000,000000FF), ref: 00406042

Strings

,)L, xrefs: 00405F80
,)L, xrefs: 00405FED

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast
String ID: ,)L$,)L
API String ID: 1452528299-234518685
Opcode ID: b07c0634277dad1bf05839cce3058bc75d6478fda9401d6351e11db2668cf60c
Instruction ID: f304d5a3a4aee354ebeeb316b95c4a533ff2e8cd1a93597df79acc89d867c640
Opcode Fuzzy Hash: b07c0634277dad1bf05839cce3058bc75d6478fda9401d6351e11db2668cf60c
Instruction Fuzzy Hash: 1A218E75500700AFDB10CF15C904B66BBF4FF49728F20466EE816AB690D7BAE906CF98

Function 00424A9A Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00424AA4
__CxxThrowException@8.LIBCMT ref: 00424B09
GetFileSize.KERNEL32(?,?,00000108,00423B96,00000000,00000010,00423EFD,?,?,?,?,?,?,00000000), ref: 00424B12
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00424B1F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorException@8FileH_prolog3_LastSizeThrow
String ID:
API String ID: 4197087271-0
Opcode ID: ade279372aa9bcff4a2347081942481f89809be84707bb464a706a1a181b60a1
Instruction ID: 9b848dc1e1dac020692ad222f2ac6f83b82e134f0cbf9d86e3b314a3ed996a72
Opcode Fuzzy Hash: ade279372aa9bcff4a2347081942481f89809be84707bb464a706a1a181b60a1
Instruction Fuzzy Hash: A22165B5D00129DBCB10DFA4C881AEEBBB8FB14314F40426EE916A3681DB74DD44CB99

Function 00404580 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(F14A3287,?,?,?,00000000,004AC158,000000FF,,)L,004050D6,00000000,00000001,000000FF), ref: 004045BE
SetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 0040461A

Strings

,)L, xrefs: 004045B7
,)L, xrefs: 00404580

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast
String ID: ,)L$,)L
API String ID: 1452528299-234518685
Opcode ID: 54589927dc04b62c1d3b6d19022bc229e103df160a442cead3c30c4d0dbdf499
Instruction ID: 9578470ac4a3df80d5b9d82803f81581c529041e6a7b1213d990f02776db03d5
Opcode Fuzzy Hash: 54589927dc04b62c1d3b6d19022bc229e103df160a442cead3c30c4d0dbdf499
Instruction Fuzzy Hash: 351149B6900704AFD7208F15C804B5ABBF4FF49724F10462EE81A9B790D7BAA506CB98

Function 00495640 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00495663
IntersectRect.USER32(?,?,?), ref: 00495678
GetWindowTextW.USER32(?,?,00000104), ref: 0049568F
InvalidateRect.USER32(?,?,00000000), ref: 004956BB

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Rect$Window$IntersectInvalidateText
String ID:
API String ID: 1165118807-0
Opcode ID: ee45ceceeeceb18cb30c64b162fa762985d3aeb1d900ded5f2b49ae295d5f6eb
Instruction ID: 4a277b2f99a65d001c5e7beee23f68803180b38d9d846b19a74f973eaa496f37
Opcode Fuzzy Hash: ee45ceceeeceb18cb30c64b162fa762985d3aeb1d900ded5f2b49ae295d5f6eb
Instruction Fuzzy Hash: 5311A17690110CABCB10DFA4DC48AFEB77CEB49714F5480AAE906D7250DB34AE46CB64

Function 00411CC9 Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F0EC: FindWindowExW.USER32(000000FD,00000000,IsPrqHook,-00000004), ref: 0040F133

SendMessageW.USER32(00000000,0000000C,00000000,?), ref: 00411CEC
SendMessageW.USER32(00000000,00000111,00000002,00000000), ref: 00411CFC

Part of subcall function 0041061C: __EH_prolog3_GS.LIBCMT ref: 00410623

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: MessageSend$FindH_prolog3_Window
String ID:
API String ID: 1301945986-0
Opcode ID: bb64c2cb553e9f02b6c09e88a79a18af3878e3e9f41ad3c94650a8a0e6a8a3ed
Instruction ID: f7c6f422418aab7ccc44f9318a6a0e6b1cf6f06f0909d8c0ef6127ddf6b0a3ab
Opcode Fuzzy Hash: bb64c2cb553e9f02b6c09e88a79a18af3878e3e9f41ad3c94650a8a0e6a8a3ed
Instruction Fuzzy Hash: 8E01F531644244BFEB114B24FC89FEA7BB89B45714F10807BF306561B2CBB9A88C8719

Function 0046515C Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00465173

Part of subcall function 00465855: ___AdjustPointer.LIBCMT ref: 0046589E

_UnwindNestedFrames.LIBCMT ref: 0046518A
___FrameUnwindToState.LIBCMT ref: 0046519C
CallCatchBlock.LIBCMT ref: 004651C0

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 27e79ab33c4d578f4c52484ccca98c0abcd94c40b21da6e470d74e7055c0f6db
Instruction ID: 2d5f2d7bd7ae177cd772d814b927705002f6ed6e25f16b5c26e6c7ab6d92e9c6
Opcode Fuzzy Hash: 27e79ab33c4d578f4c52484ccca98c0abcd94c40b21da6e470d74e7055c0f6db
Instruction Fuzzy Hash: 30018C32400508BBCF129F55CC01FDA3BBAFF49714F01411AFD1862121E33AE861DBA5

Function 004993A0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,0045004B,00000002,?,00000000,00000001,?,00499A72,004AD954,?,00000000,004991AA,?,?,004991AA,?), ref: 004993D0
LoadResource.KERNEL32(?,00000000,?,00499A72,004AD954,?,00000000,004991AA,?,?,004991AA,?,?,004AD954,?), ref: 004993E3
LockResource.KERNEL32(00000000,?,00499A72,004AD954,?,00000000,004991AA,?,?,004991AA,?,?,004AD954,?), ref: 004993F0
FreeResource.KERNEL32(00000000,?,004AD954,?), ref: 00499402

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: e32b258cc88b93c04f6459a739b17448ab95d7f0112cba27171edb0674cb60e8
Instruction ID: 88e3c587caa34c33bfe39c396a316fcd6623ce8ffa6be6ec84b003baff541eab
Opcode Fuzzy Hash: e32b258cc88b93c04f6459a739b17448ab95d7f0112cba27171edb0674cb60e8
Instruction Fuzzy Hash: 250112765102046BD7109F69EC84ABB7BECFB89725F00452EFD0AC7641D775E8018B65

Function 00410598 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004105D5
IsDialogMessageW.USER32(?), ref: 004105E9
TranslateMessage.USER32(?), ref: 004105F7
DispatchMessageW.USER32(?), ref: 00410601

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: d12216128abbc9f4458ccb46f85f5b775c74d01cb2cc9ac5dd94e662d1f730d6
Instruction ID: d2e42d067f63848c397c2c84474b419e8145b705ae52750d5acf6c9324465707
Opcode Fuzzy Hash: d12216128abbc9f4458ccb46f85f5b775c74d01cb2cc9ac5dd94e662d1f730d6
Instruction Fuzzy Hash: A2012DB1C06258BADF11DBB0AC58FFA7FADBB0A344F44406AE44192191D6A884C4DB68

Function 00438942 Relevance: 6.0, APIs: 4, Instructions: 45windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004389AE: IsWindow.USER32(?), ref: 004389D6
Part of subcall function 004389AE: GetLastError.KERNEL32(?,00438955,?), ref: 004389E7

IsDialogMessageW.USER32(?,?), ref: 00438968
TranslateMessage.USER32(?), ref: 00438976
DispatchMessageW.USER32(?), ref: 00438980
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0043898F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Message$DialogDispatchErrorLastTranslateWindow
String ID:
API String ID: 2045501086-0
Opcode ID: 2dbbabd56165c94af68f8f2ce3a26828e55b167be9036af1d9bf8d49c50b4049
Instruction ID: 65ef266e451f7128c68185701206fd67c64febd05da3e123debd2d15b7fd3e39
Opcode Fuzzy Hash: 2dbbabd56165c94af68f8f2ce3a26828e55b167be9036af1d9bf8d49c50b4049
Instruction Fuzzy Hash: A30121F1D0030AABDB209F61DC08B6BBBFCAF59754F00442AF502D2110E778E4058A66

Function 0041230D Relevance: 6.0, APIs: 4, Instructions: 42windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00412331
GetObjectW.GDI32(00000000,0000005C,?), ref: 0041233E

Part of subcall function 0041237B: GetLocaleInfoW.KERNEL32(?,00001004,?,00000014), ref: 004123AF
Part of subcall function 0041237B: TranslateCharsetInfo.GDI32(00000000,?,00000002), ref: 004123CA

CreateFontIndirectW.GDI32(?), ref: 00412355
SendMessageW.USER32(?,00000030,00000000,00000000), ref: 00412365

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: InfoMessageSend$CharsetCreateFontIndirectLocaleObjectTranslate
String ID:
API String ID: 2681337867-0
Opcode ID: 289e1d65ea79ce45d948beb5ee0a3420a12099116759d83553fb83c02562e029
Instruction ID: 577006e5e34d818b6d97ae65ffdf15e9c150290e5b6ab06768ae005bfc83c496
Opcode Fuzzy Hash: 289e1d65ea79ce45d948beb5ee0a3420a12099116759d83553fb83c02562e029
Instruction Fuzzy Hash: B1014F71A05318BFDF14DFA4DC4AF9EBBB9AB0D700F004019BA06AB291DA74A914CB58

Function 00451E80 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00451E99
SysFreeString.OLEAUT32(00000002), ref: 00451EA5
_free.LIBCMT ref: 00451EB5
_free.LIBCMT ref: 00451EC7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: FreeString_free
String ID:
API String ID: 2157979973-0
Opcode ID: 33db23725dcf7bb5ab28ba9f6f476a4faf8e1a207c84d1237cdf53a582b8af53
Instruction ID: 700e241ce985d7e698aced0a0f5e29487fbfc8d95961ce2e9275b60e31620e07
Opcode Fuzzy Hash: 33db23725dcf7bb5ab28ba9f6f476a4faf8e1a207c84d1237cdf53a582b8af53
Instruction Fuzzy Hash: 21F06275500523AFC7215F55D886906FF61FF08752710822BF81683A22CB75AC65CBC4

Function 00454F5C Relevance: 6.0, APIs: 4, Instructions: 35stringCOMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 00454F66
lstrlenW.KERNEL32(?), ref: 00454F76
_wcsstr.LIBCMT ref: 00454F88
lstrlenW.KERNEL32(-00000002), ref: 00454F9A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _wcsstrlstrlen
String ID:
API String ID: 4267858634-0
Opcode ID: 50e40c8e52d1bc616aec02207a8da92a15370e551dd370081bac95761c02fa3c
Instruction ID: 669c7890614353d931fdb3cdeff2e87ccaec5a8b0de3567b86eb8f9ee5689c3e
Opcode Fuzzy Hash: 50e40c8e52d1bc616aec02207a8da92a15370e551dd370081bac95761c02fa3c
Instruction Fuzzy Hash: ACF02737508225AF8B115F6DEC0089F7B54EF41727310402AFC05AB292DA39D911C7DC

Function 004518C7 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004518CE
GetLastError.KERNEL32(00000004,00451FF4,?,00000001,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004518F2
SetLastError.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0045191F
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0045193F

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3
String ID:
API String ID: 3502553090-0
Opcode ID: 89408db3be183232510d90455201f7fd2ee290ffbdc8b0101bb15b0a748812b0
Instruction ID: b02b95ec1d836aa2fda2200379531f0900e8ba702d30b982fa224b8c9d062708
Opcode Fuzzy Hash: 89408db3be183232510d90455201f7fd2ee290ffbdc8b0101bb15b0a748812b0
Instruction Fuzzy Hash: 3701D378900214DFCB04EF54C985A99BBE0FB29319F05C4AAEC058F267CBB8D909CF59

Function 00415974 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041597B
GetLastError.KERNEL32(00000004,004163C4,?,00000000), ref: 0041599F
SetLastError.KERNEL32(?), ref: 004159CC
SetLastError.KERNEL32(00000000), ref: 004159EC

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3
String ID:
API String ID: 3502553090-0
Opcode ID: fed1e4201af91264b6d14aa9a2701dedc67cf65ca4941bf5d59b8ac09f6d4992
Instruction ID: 5150cd44beb3aad3422623debfea6ddbc9c4b1e4e08b1155890b7069fe171cc8
Opcode Fuzzy Hash: fed1e4201af91264b6d14aa9a2701dedc67cf65ca4941bf5d59b8ac09f6d4992
Instruction Fuzzy Hash: 3F01D774900214CFCB44DF65D985A89BBE0FF19319F05C4AAAC059F267C7B8E944CF55

Function 00412290 Relevance: 6.0, APIs: 4, Instructions: 35windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00412299
GetDlgItem.USER32(0000012D,00000001), ref: 004122B2
SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 004122C2
SendMessageW.USER32(00000000,00000402,?,00000000), ref: 004122DF

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: MessageSend$ItemWindow
String ID:
API String ID: 591194657-0
Opcode ID: c25a0ce6a4c72ea649f6034dff8e9cc968c8d371b1d6dc3d4f815a2d5249e8ca
Instruction ID: 0ed558e5bd568f9ef228adcc022c1c4f41eb1b0b47a9aaabc77b2dd6fe20dc67
Opcode Fuzzy Hash: c25a0ce6a4c72ea649f6034dff8e9cc968c8d371b1d6dc3d4f815a2d5249e8ca
Instruction Fuzzy Hash: 19F0E931640210BBC7101761BC08FBA7F68EB4E791B00803AF609D10A0DA748810DAAC

Function 00401A60 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004050EA,00000000,00000000,00000001,000000FF,F14A3287,00000000,771ADFA0,771AE010), ref: 00401A6F
SysFreeString.OLEAUT32(?), ref: 00401A8B
SysFreeString.OLEAUT32(?), ref: 00401A96
SetLastError.KERNEL32(?), ref: 00401AB4

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeLastString
String ID:
API String ID: 3822639702-0
Opcode ID: 190014a5b126da629fc190ad644ddcb535daabdca90a69b0deed560546f8e7d6
Instruction ID: d47bf52dfab4ef92a84c8f599846b520b2c669885ed1989dd61de9170a30ce50
Opcode Fuzzy Hash: 190014a5b126da629fc190ad644ddcb535daabdca90a69b0deed560546f8e7d6
Instruction Fuzzy Hash: 4FF0F935900516EFC7009F19E948A40BBF1FF593257158226E80997A21CB75F9A4CFC5

Function 00401AC0 Relevance: 6.0, APIs: 4, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
SysFreeString.OLEAUT32(?), ref: 00401AEB
SysFreeString.OLEAUT32(?), ref: 00401AF6
SetLastError.KERNEL32(?), ref: 00401B14

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeLastString
String ID:
API String ID: 3822639702-0
Opcode ID: 190014a5b126da629fc190ad644ddcb535daabdca90a69b0deed560546f8e7d6
Instruction ID: 1862098b2f5b6cff4b9e99c2b1540a83a4327470dbe020fab997ba68da8bbfb8
Opcode Fuzzy Hash: 190014a5b126da629fc190ad644ddcb535daabdca90a69b0deed560546f8e7d6
Instruction Fuzzy Hash: D5F0F435900512EFCB009F29E948A40BBF1FF59329B15822AE80997A21CB75F9A4DFC5

Function 00401B20 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00401B2F
SysFreeString.OLEAUT32(?), ref: 00401B4B
SysFreeString.OLEAUT32(?), ref: 00401B56
SetLastError.KERNEL32(?), ref: 00401B74

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorFreeLastString
String ID:
API String ID: 3822639702-0
Opcode ID: 190014a5b126da629fc190ad644ddcb535daabdca90a69b0deed560546f8e7d6
Instruction ID: 2a228f366beaf082319d8ae21420c2d9d26b903b8e1d5f376fce0ea6fe5f29ce
Opcode Fuzzy Hash: 190014a5b126da629fc190ad644ddcb535daabdca90a69b0deed560546f8e7d6
Instruction Fuzzy Hash: D1F0F935800512EFC7009F19E948A40BBF1FF593257158226E80997A21DB71F9A4CFC5

Function 004999D0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 004999D9
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004999EA
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004999F1
ReleaseDC.USER32(?,00000000), ref: 004999F9

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 7567664282ad5ca6a399621fe5db18b8c181efbab7b2fe89ae67c747db932c2a
Instruction ID: 7a6d4422fbff088d846f2d6997d09799f444d076fe2c18018dc5ac44cdbef338
Opcode Fuzzy Hash: 7567664282ad5ca6a399621fe5db18b8c181efbab7b2fe89ae67c747db932c2a
Instruction Fuzzy Hash: D4E04872D4422C7FE711177A9C49D977F5CEB491B4F020431FC0D9B190D5659C5185D0

Function 00448AA3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 202COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00448AAD

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0043349A: __EH_prolog3_GS.LIBCMT ref: 004334A1

Part of subcall function 00408EF3: __EH_prolog3.LIBCMT ref: 00408EFA
Part of subcall function 00408EF3: GetLastError.KERNEL32(00000004,0040AAE9,?,004480EE,00000098,?,00000000,?,?,?,0040A496,x$L,00000000,00000002,0000003A,00000001), ref: 00408F1C
Part of subcall function 00408EF3: SetLastError.KERNEL32(?,00000000,004480EE,00000098,00000000,?,004480EE,00000098,?,00000000,?,?,?,0040A496,x$L,00000000), ref: 00408F5D

Part of subcall function 00413A4F: __EH_prolog3_GS.LIBCMT ref: 00413A56

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

x$L, xrefs: 00448BCD, 00448BD3
x$L, xrefs: 00448BD4, 00448BD7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$FreeH_prolog3String
String ID: x$L$x$L
API String ID: 888054269-3102039750
Opcode ID: 37c7008ce4ae04d06754de605289a87ccc83201983f7f1727e1848f265fdeaf2
Instruction ID: ef156468faf2548de0b9dec99bbffb6ce25da66515af0590fe3bf028a82a52bb
Opcode Fuzzy Hash: 37c7008ce4ae04d06754de605289a87ccc83201983f7f1727e1848f265fdeaf2
Instruction Fuzzy Hash: 64819FB1C0021CAEDB14EBA0CC81FDEB778AF15304F54419EE555B3192DBB81A49CBA9

Function 004412E6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004412ED

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00440F5B: __EH_prolog3_GS.LIBCMT ref: 00440F65

Strings

x$L, xrefs: 0044131B
*.*, xrefs: 00441361, 004413E2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3Last$H_prolog3_
String ID: *.*$x$L
API String ID: 2324316964-3141928915
Opcode ID: 20fe915a55e96c3196c1097617cb3d6c0f137b389a7aae0ef946cb372dbd01c0
Instruction ID: 441cafbd25898599b00e7f121126c08287b6d8e575c78fe58133c7b84e349e47
Opcode Fuzzy Hash: 20fe915a55e96c3196c1097617cb3d6c0f137b389a7aae0ef946cb372dbd01c0
Instruction Fuzzy Hash: CE51CCB5D00108ABFF00EFA9C542ADDBBA8AF15348F54006FF91477291D7BA4A45C7EA

Function 0044057E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00440585
GetLastError.KERNEL32 ref: 00440640

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00440F5B: __EH_prolog3_GS.LIBCMT ref: 00440F65

Part of subcall function 004414B1: __EH_prolog3.LIBCMT ref: 004414B8

Strings

x$L, xrefs: 004405B9

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3H_prolog3_
String ID: x$L
API String ID: 852442433-723586279
Opcode ID: 76c5f1b11f11f45991562188d3587970bc6c47bb6b2233daa2d1d9863adbb696
Instruction ID: 37fb51891af3559848482a54302360b7c658a0dd4a1a8c744c8eccc8bd5fbaf7
Opcode Fuzzy Hash: 76c5f1b11f11f45991562188d3587970bc6c47bb6b2233daa2d1d9863adbb696
Instruction Fuzzy Hash: E24119B1801208ABDB00FF65C942ADD7B689F15348F54006FFD095B292EB39565AC7EE

Function 00406170 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00406243

Strings

invalid string position, xrefs: 00406272, 0040627C
string too long, xrefs: 00406286

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 84c317eba97b550b0181d68f1a0d0323b3432c486c907089c0959483aa43291d
Instruction ID: e6b54765224eb51faa02426c66f99b4bc6aa5a7fd9ab0e8a8c475f66bdbb66bb
Opcode Fuzzy Hash: 84c317eba97b550b0181d68f1a0d0323b3432c486c907089c0959483aa43291d
Instruction Fuzzy Hash: D7310A32304310DBD721AE5CE940F57F7A5EB91721F11067FE8429B2D2C7B59860C7A9

Function 004414B1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004414B8

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00440F5B: __EH_prolog3_GS.LIBCMT ref: 00440F65

Part of subcall function 004429BC: __EH_prolog3.LIBCMT ref: 004429C3

Part of subcall function 00442457: __EH_prolog3_GS.LIBCMT ref: 0044245E

Strings

x$L, xrefs: 004414EA
x$L, xrefs: 004415B2

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3$ErrorH_prolog3_Last
String ID: x$L$x$L
API String ID: 3513993312-3102039750
Opcode ID: d3dc69ac554d7753ef3b44f0e127ce6f566231c03a44536f0c60f8a7a40105bd
Instruction ID: d0a091396b2515cb4dadd6bb5dffe3d0cad2cf8f76255b67ede8358b3034b427
Opcode Fuzzy Hash: d3dc69ac554d7753ef3b44f0e127ce6f566231c03a44536f0c60f8a7a40105bd
Instruction Fuzzy Hash: 7741DAB5800108ABDF00EFA9C505ADE7BB89F45348F14416FF8557B252C7B94A46C7EE

Function 00466323 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045D096: __getptd_noexit.LIBCMT ref: 0045D096

__getbuf.LIBCMT ref: 004663BA
__lseeki64.LIBCMT ref: 0046642A

Strings

xyM, xrefs: 0046641A

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: __getbuf__getptd_noexit__lseeki64
String ID: xyM
API String ID: 3311320906-1395859304
Opcode ID: 409c4169bdc0a7d74e184da96e3ee353911cec00dff0707287cc244af0a63511
Instruction ID: 9f4e368595462673c7f25a818e2f93d1a5384c3d6e3c229f264609a6c0d6cb5f
Opcode Fuzzy Hash: 409c4169bdc0a7d74e184da96e3ee353911cec00dff0707287cc244af0a63511
Instruction Fuzzy Hash: 8941F171500B059FD3249F29C8516BB77A49F45324B05C62FE8AACB3C1EB7CA8818B5A

Function 004259EF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00425B1B

Strings

map/set<T> too long, xrefs: 00425B09
}wB, xrefs: 00425B3B, 00425AF7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_catch
String ID: map/set<T> too long$}wB
API String ID: 3886170330-2504645066
Opcode ID: dfb9592cde44b3a6b6c14aeea368a1736387c4cc1a8a26aabb46e79046965b2a
Instruction ID: 3ff75a8b2b8e21f24381eac164135cac6f57801d29b174cb3314d4c1c8a84614
Opcode Fuzzy Hash: dfb9592cde44b3a6b6c14aeea368a1736387c4cc1a8a26aabb46e79046965b2a
Instruction Fuzzy Hash: 6E515430200650DFDB11CF09D1C5A6ABBE1AF18318F59C19EE8498B362CBBAEC41CF55

Function 00440308 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044030F

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00445DB8: __EH_prolog3.LIBCMT ref: 00445DBF

GetLastError.KERNEL32 ref: 0044036D

Part of subcall function 004484F8: __EH_prolog3.LIBCMT ref: 004484FF

Strings

x$L, xrefs: 0044034C

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3$ErrorLast
String ID: x$L
API String ID: 1123136255-723586279
Opcode ID: 7ea54311800cb819899414c3ac7f2088d4f19a0b6a86314c92704aba521e7e7f
Instruction ID: 674163d294ac6dd2f8669efeacbc7a1ca70fab806e3952c68746044fe3b94bad
Opcode Fuzzy Hash: 7ea54311800cb819899414c3ac7f2088d4f19a0b6a86314c92704aba521e7e7f
Instruction Fuzzy Hash: 9D31ECB1801104AFDB00FF65C9429EE7B689F11398F54006FFD055B2A2EB794A5AC7DE

Function 0044D185 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044D18C

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

x$L, xrefs: 0044D1E9
x$L, xrefs: 0044D1A6

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3H_prolog3_
String ID: x$L$x$L
API String ID: 2488494826-3102039750
Opcode ID: 73b2d861001314858a6112cae9f7af1409ef1be2433f9a1d259d5578995cd7ea
Instruction ID: 65b4be7f5565668f60ec9774ec93772a097d219875c3c1bce5443bcb8b0fde50
Opcode Fuzzy Hash: 73b2d861001314858a6112cae9f7af1409ef1be2433f9a1d259d5578995cd7ea
Instruction Fuzzy Hash: 44316074900208EBDF04EF99C845BDDBB74BF14308F50812EF915A7291DBB8AA19CB99

Function 0044113E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00441148

Part of subcall function 00416471: __EH_prolog3.LIBCMT ref: 00416478

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 00423E83: __EH_prolog3.LIBCMT ref: 00423E8A

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Part of subcall function 0041693E: __EH_prolog3.LIBCMT ref: 00416945

__CxxThrowException@8.LIBCMT ref: 00441207

Part of subcall function 0045A275: RaiseException.KERNEL32(?,?,00459DDB,00000000,?,?,?,?,00459DDB,00000000,004D043C,?), ref: 0045A2C6

Part of subcall function 0041733D: __EH_prolog3.LIBCMT ref: 00417344

Strings

, xrefs: 004411C5

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3$ErrorLast$FreeString$ExceptionException@8H_prolog3_catch_RaiseThrow
String ID:
API String ID: 1995314774-3916222277
Opcode ID: 387e70e1be37b79f8fcdd4251f387ac834976ce414374b8cd7eed1bd26450819
Instruction ID: 75c1a2ef9203399b357444e1be4c601dcf53f7a5a540de05905c7da78c5c0972
Opcode Fuzzy Hash: 387e70e1be37b79f8fcdd4251f387ac834976ce414374b8cd7eed1bd26450819
Instruction Fuzzy Hash: 6031A47080025CE9EB10EBE0C895BDE7B786F15348F44409FE945B7182DBB8578CCBA9

Function 00444DB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00444DBC

Part of subcall function 0041502B: __EH_prolog3_GS.LIBCMT ref: 00415032

OpenProcess.KERNEL32(00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0000003B), ref: 00444E24

Strings

x$L, xrefs: 00444E16

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_$OpenProcess
String ID: x$L
API String ID: 613148867-723586279
Opcode ID: 9b913148abc9040f8fb87a48c44e134c569ea3a5e20c9a7c3e7ce9c6f19cab19
Instruction ID: 2b29a40e983586327ce8ce00aa4770f68ba46e4abf31396eaae2f8b88e478abd
Opcode Fuzzy Hash: 9b913148abc9040f8fb87a48c44e134c569ea3a5e20c9a7c3e7ce9c6f19cab19
Instruction Fuzzy Hash: 39114CB1D002189AEB14EBE6CC56ADEBB78FF94704F10001FE511B71D1DBB86A06CB59

Function 00425D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00425D17

Strings

($L, xrefs: 00425D32
,)L, xrefs: 00425D39

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: H_prolog3_
String ID: ($L$,)L
API String ID: 2427045233-1160466256
Opcode ID: bae92f96b844ce6749218980c7c704ce52f3bc5e3d2b3c65dfee7ea6d4dfd7bb
Instruction ID: 0371d3e7225b5705b1f18424cfe0701477e8a149a1d577536137bc5e31263b56
Opcode Fuzzy Hash: bae92f96b844ce6749218980c7c704ce52f3bc5e3d2b3c65dfee7ea6d4dfd7bb
Instruction Fuzzy Hash: 8B11A571A10524DBDB04EF61D9496FFB778AF40304F90841FE805A7181DB38BE05C699

Function 004106F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004106FE

Part of subcall function 00403F50: GetLastError.KERNEL32 ref: 00403F6F
Part of subcall function 00403F50: SetLastError.KERNEL32(?), ref: 00403F9F

Part of subcall function 0040D135: __EH_prolog3_GS.LIBCMT ref: 0040D13F

Strings

($L, xrefs: 00410712
,)L, xrefs: 00410719

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorH_prolog3_Last
String ID: ($L$,)L
API String ID: 1018228973-1160466256
Opcode ID: 5f89ab4785527c6c7adb051b2983b6408b4d51297aecc4a1556bd5f3f61454ab
Instruction ID: 341f85b9c3142005879b88a873c327399d5b4446155f50cc5b1806113c2558ba
Opcode Fuzzy Hash: 5f89ab4785527c6c7adb051b2983b6408b4d51297aecc4a1556bd5f3f61454ab
Instruction Fuzzy Hash: B7119D71D00208EFCB14EBE5D991BDD77B8AF05348F44006FE505B7292DB78AA48CBA9

Function 0040DF24 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040DF2E

Part of subcall function 00408E82: __EH_prolog3.LIBCMT ref: 00408E89
Part of subcall function 00408E82: GetLastError.KERNEL32(00000004,00409E1B,x$L,00000000,00439787,?,?,00000001), ref: 00408EAB
Part of subcall function 00408E82: SetLastError.KERNEL32(?,00000000), ref: 00408EE3

Part of subcall function 0040DE13: __EH_prolog3_GS.LIBCMT ref: 0040DE1D

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

x$L, xrefs: 0040DF7A
x$L, xrefs: 0040DFAC, 0040DFCA, 0040DF60, 0040DF9E, 0040DF63, 0040DFAF

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeH_prolog3_String$H_prolog3
String ID: x$L$x$L
API String ID: 386487564-3102039750
Opcode ID: cf982dd99f93328bc7d81760ba7667df6c1745227532e88bbd69647a54e661b1
Instruction ID: 8e5da4e36e7cc1aa24794650b7dfa85c756c88a2d7cc954911dd86eeb4bbd9ef
Opcode Fuzzy Hash: cf982dd99f93328bc7d81760ba7667df6c1745227532e88bbd69647a54e661b1
Instruction Fuzzy Hash: A2215B70900258EECB05EBA5C991EEEB778BF15348F14416EE401772D2DB786E09CBA6

Function 00475431 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00475453
__calloc_crt.LIBCMT ref: 0047546C

Strings

@}M, xrefs: 00475491

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: __calloc_crt
String ID: @}M
API String ID: 3494438863-489123396
Opcode ID: 74ec27704f86842bd2f4548b762d4fd83aecff82554f411c30b21a69092dad22
Instruction ID: 162f75d10a3a00e0abc23a783297f12cc96844d957e8b48df2d4f56c8148bd8f
Opcode Fuzzy Hash: 74ec27704f86842bd2f4548b762d4fd83aecff82554f411c30b21a69092dad22
Instruction Fuzzy Hash: F4F0A471249A114AEF189B29BC417E62794E748328B51802BE508CE290F6B8ECC1C68D

Function 00425DDD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00425DE4

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Strings

,)L, xrefs: 00425E1C
($L, xrefs: 00425E15

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3_
String ID: ($L$,)L
API String ID: 2549205776-1160466256
Opcode ID: e4c25fa2e39c28b21c2e1b62f073f13b3bd63f6e6afa35a2a5b6a36a06bad107
Instruction ID: d95c1ef63c630d4fb9f7bdd953de3cacbf6642a0fd5a0b51969999c746140d6f
Opcode Fuzzy Hash: e4c25fa2e39c28b21c2e1b62f073f13b3bd63f6e6afa35a2a5b6a36a06bad107
Instruction Fuzzy Hash: 0001F776D016249BDB14EAB6DD06B9D7779EF40350F95011EF804B72C2DBB46F048B98

Function 00440ED8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00440EDF
GetFileAttributesW.KERNEL32(?,00000000,00441461), ref: 00440EFA

Strings

x$L, xrefs: 00440F12

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: AttributesFileH_prolog3
String ID: x$L
API String ID: 1973727094-723586279
Opcode ID: bac988a60b7acb080839474e70f4491c990345442668ff290e814600c124b299
Instruction ID: d543013a0e57d8db1a58b75a4133ed187790f753dbc5795cb635558a1af3362a
Opcode Fuzzy Hash: bac988a60b7acb080839474e70f4491c990345442668ff290e814600c124b299
Instruction Fuzzy Hash: 4701F7B5500204ABDB00AF65C45168D3BA8AF14358F50842FFD499B252DB79CA49C79D

Function 00499340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39memoryfilewindowCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010,?,?,C^I,004960AF,?,C^I,00000000,?,?,?,?,?,00495E43,?,00000000), ref: 00499358
GdipCreateBitmapFromFile.GDIPLUS(?,?,00000010,?,?,C^I,004960AF,?,C^I,00000000,?,?,?,?), ref: 00499377

Strings

C^I, xrefs: 00499340

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFileFrom
String ID: C^I
API String ID: 2762118622-2795856741
Opcode ID: 31ea1cfd88b08d3d4096136b46b8a21f965b4db2bcca84eb3b2712b27d0c022a
Instruction ID: f94498642b48c4549718ad3d006ccb0a38b0638d3b3a9e0cd8f00aa80fe8387e
Opcode Fuzzy Hash: 31ea1cfd88b08d3d4096136b46b8a21f965b4db2bcca84eb3b2712b27d0c022a
Instruction Fuzzy Hash: 52F0F97620071A9BCB609F59E84179ABBA8EB88765F00443FF95CC7600D375A811CBA5

Function 0040E08E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040E095

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Part of subcall function 0040E19A: __EH_prolog3.LIBCMT ref: 0040E1A1
Part of subcall function 0040E19A: GetLastError.KERNEL32(00000004,0040E0D9,00000000,00000001,?), ref: 0040E1C3
Part of subcall function 0040E19A: SetLastError.KERNEL32(?), ref: 0040E1EF

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Strings

,)L, xrefs: 0040E0A9
($L, xrefs: 0040E0FB

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3H_prolog3_
String ID: ($L$,)L
API String ID: 2488494826-1160466256
Opcode ID: c3fc6b3340d289a716dc0d431eb8759e66dffb444edce4a8e6bfd116d33452e0
Instruction ID: bafd164bb0b8ed7fbd0c139b7ca172ea8dcb76d999780908c710bb9a41eef6ba
Opcode Fuzzy Hash: c3fc6b3340d289a716dc0d431eb8759e66dffb444edce4a8e6bfd116d33452e0
Instruction Fuzzy Hash: 55011A74910208DBCB15EF62CD81BEEB774BF54315F50442EB801BB292CBB86A05CB98

Function 0042E18F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042E199

Part of subcall function 0042A98B: __EH_prolog3.LIBCMT ref: 0042A992

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Strings

,)L, xrefs: 0042E1E0
($L, xrefs: 0042E1C0, 0042E1D1, 0042E1EC, 0042E1D7

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$H_prolog3H_prolog3_
String ID: ($L$,)L
API String ID: 852442433-1160466256
Opcode ID: 023e5e1da77017f3823a6f7af6c7aadba2c58fc22342e14cff5e84bbda113d9c
Instruction ID: 017a64e0563a36ae9b9dff82617f1069f0679b15d59abe953df6b692c485de3f
Opcode Fuzzy Hash: 023e5e1da77017f3823a6f7af6c7aadba2c58fc22342e14cff5e84bbda113d9c
Instruction Fuzzy Hash: 990181707002289FDB45EB52C855BAD73A8BB10304F90409EF545AA181CBFC5A89CBAA

Function 0040E10B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040E112

Part of subcall function 00402CE0: GetLastError.KERNEL32(F14A3287,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402D30
Part of subcall function 00402CE0: SetLastError.KERNEL32(?,004C2254,00000000,?,00000000,771ADFA0,?,?,004ABAA8,000000FF,,)L,00401EE2,InstallShield.log,?), ref: 00402DA8

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Strings

,)L, xrefs: 0040E14C
($L, xrefs: 0040E12B, 0040E158

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3_
String ID: ($L$,)L
API String ID: 2549205776-1160466256
Opcode ID: 66c67f8ca0e2f2024dec55cb4d7f033485bedfc6ad618bb05f9f2a05c9f6ab97
Instruction ID: 8c80fe01f812e50c6b0a12505a9b2e81dd1f33e026090713c7ab8a024a6c73a2
Opcode Fuzzy Hash: 66c67f8ca0e2f2024dec55cb4d7f033485bedfc6ad618bb05f9f2a05c9f6ab97
Instruction Fuzzy Hash: 4CF03A346102049BDB05AF52CC82BAD72A8AF44359F50402EB801BB2C2CBFC69098B9D

Function 00474797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 004747CB
DName::DName.LIBCMT ref: 004747D7

Strings

{flat}, xrefs: 004747C1

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: 367439aa3bbd32830795ba4e85d65de9d618a06c525716b83c47ff65598460e1
Instruction ID: 16a21d60b784c1607c5c32542e5da12a388627e88c9aa71d9a06d2fe20e1d89a
Opcode Fuzzy Hash: 367439aa3bbd32830795ba4e85d65de9d618a06c525716b83c47ff65598460e1
Instruction Fuzzy Hash: 22F0A0701012088FC704CF64E4A5BF53BD09B42715F08C08BE94C4F362C778D8908B89

Function 00419DCB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00419DD2

Part of subcall function 00408F6D: __EH_prolog3.LIBCMT ref: 00408F74
Part of subcall function 00408F6D: GetLastError.KERNEL32(00000004,004091E9,00000000,?,00000000,00000000), ref: 00408F96
Part of subcall function 00408F6D: SetLastError.KERNEL32(?,00000000,?), ref: 00408FCF

Part of subcall function 0040B7EB: __EH_prolog3_GS.LIBCMT ref: 0040B7F2

Part of subcall function 00401B80: GetLastError.KERNEL32(?,00000000,00409F66,00000000,?,00000000,?,00000001,00000048,00409E02,x$L,?,00000000,00000000,0000003C,00409181), ref: 00401B8F
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BAB
Part of subcall function 00401B80: SysFreeString.OLEAUT32(?), ref: 00401BB6
Part of subcall function 00401B80: SetLastError.KERNEL32(?), ref: 00401BD4

Strings

data1.hdr, xrefs: 00419DE6
x$L, xrefs: 00419E05, 00419E08

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeH_prolog3_String$H_prolog3
String ID: data1.hdr$x$L
API String ID: 386487564-2227121434
Opcode ID: ec42ad77c7b7cc7dd498a4de812a1f922d8a69fcf80e7537b34bf4371325e893
Instruction ID: 49964e490ec3b2a1ccbe81a44eb4886d2b28c94ef1b61aa49cc1c4210663f476
Opcode Fuzzy Hash: ec42ad77c7b7cc7dd498a4de812a1f922d8a69fcf80e7537b34bf4371325e893
Instruction Fuzzy Hash: 8BF05875900208DBDB50EB91C842BEDB3B8AF54744F40402EF900B7191CBB86A0ACBAD

Function 00425FF6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00425FFD

Part of subcall function 004053A0: GetLastError.KERNEL32(F14A3287,?,?,?,?,004AB908,000000FF), ref: 004053E2
Part of subcall function 004053A0: SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,004AB908,000000FF), ref: 0040543E

Part of subcall function 00401AC0: GetLastError.KERNEL32(?,?,0040E433), ref: 00401ACF
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AEB
Part of subcall function 00401AC0: SysFreeString.OLEAUT32(?), ref: 00401AF6
Part of subcall function 00401AC0: SetLastError.KERNEL32(?), ref: 00401B14

Strings

($L!bB0, xrefs: 0042602A, 0042602D
,)L, xrefs: 00426018

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3_
String ID: ($L!bB0$,)L
API String ID: 2549205776-3332879775
Opcode ID: 2e50c4746d379ca62caf38617dd9e8e03bfa3cb4ceedcd282816931b600e39fb
Instruction ID: 1a67dd08189dcd5ab2c308966e4dc3f4b9a9a996e44c78d5808b1d6dbd263de6
Opcode Fuzzy Hash: 2e50c4746d379ca62caf38617dd9e8e03bfa3cb4ceedcd282816931b600e39fb
Instruction Fuzzy Hash: ECF030B5D01124EBDB01EB928D06BEE7638EF11765F85401AFD04772C2D7B86A05CBE9

Function 00488260 Relevance: 5.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004882AE
SetLastError.KERNEL32(004AD95C,00000000,00000000,000000FF), ref: 00488308
GetLastError.KERNEL32(?), ref: 0048832F
SetLastError.KERNEL32(?,00000000,00000000,000000FF), ref: 00488385

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9e39ec28f9529472a540d4e972dbd9c5f5c6de026344adc68c89a4f8bf89f282
Instruction ID: 04b91cc654750394b94440efcde2741b1fa9e3e950351a2162e9a4b14c1abca1
Opcode Fuzzy Hash: 9e39ec28f9529472a540d4e972dbd9c5f5c6de026344adc68c89a4f8bf89f282
Instruction Fuzzy Hash: 844139B5900208DFDB10DF95C8047AEBBF4FF48718F10462EE816A7790DB79A909CB85

Function 00485E80 Relevance: 5.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004924C7,?,?,?,?,?,?,?,?,?,F14A3287,?,000001A4,00000000), ref: 00485E91
SetLastError.KERNEL32(53746547,?,?,?,?,?,?,?,?,?,F14A3287,?,000001A4,00000000), ref: 00485EC1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,F14A3287,?,000001A4,00000000), ref: 00485ED5
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,F14A3287,?,000001A4,00000000), ref: 00485F05

Memory Dump Source

Source File: 00000002.00000002.2430806234.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2430762854.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2430910825.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431023536.00000000004D6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.00000000004DB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000508000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2431104439.0000000000518000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LocalPlayback.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 04bc00ecbdaa0ecb0843f71f7285a224adaa5b0f01dfb54fba676dcd98e2509d
Instruction ID: 9c5b1741ad6a8d511b1b729e26a4d7f2e315c6254118b2c374ce2f70b0234475
Opcode Fuzzy Hash: 04bc00ecbdaa0ecb0843f71f7285a224adaa5b0f01dfb54fba676dcd98e2509d
Instruction Fuzzy Hash: 721109B49112408FCB84CF68D5C86457FE4BF1D318B6191AADC09CF62AE779D848DF49

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LocalPlayback.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\6c4c8e.rbs

C:\Config.Msi\6c4c92.rbs

C:\Config.Msi\6c4c96.rbs

C:\Config.Msi\6c4c9a.rbs

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\0x0409.ini (copy)

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\0x0804.ini (copy)

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\0x0814D.tmp

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\0x0817D.tmp

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\ISS80A0.tmp

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\ISSetup.dll (copy)

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\dat7B00.tmp

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\dat7B01.tmp

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\data1.cab (copy)

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\data1.hdr (copy)

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\lay7AEF.tmp

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\layout.bin (copy)

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\set7FB5.tmp

C:\Program Files (x86)\InstallShield Installation Information\{6674BCC5-BC57-446B-B83B-FA53501E0FDC}\set81BD.tmp

Windows Analysis Report
LocalPlayback.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre