Edit tour

Windows Analysis Report
FlowTracker_Setup.exe

Overview

General Information

Sample name:	FlowTracker_Setup.exe
Analysis ID:	1546436
MD5:	e103387250c2f8330978838bd5b6365f
SHA1:	f441f01bf13e1498a2d8b5dbb3de4ae52c43227d
SHA256:	cc43b037bdb72a60d29e0ac7be83e1dbabc472bfd8555b5ae90736ea10da02a3
Infos:

Detection

Score:	6
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

FlowTracker_Setup.exe (PID: 4480 cmdline: "C:\Users\user\Desktop\FlowTracker_Setup.exe" MD5: E103387250C2F8330978838BD5B6365F)

msiexec.exe (PID: 5936 cmdline: "C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS1DC4B5CF7D8A44A99CDFF7A5DD359A38_2_30.MSI" WISE_SETUP_EXE_PATH="C:\Users\user\Desktop\FlowTracker_Setup.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 4916 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5076 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 721A14B488BA2239A99405E88BE13886 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6928 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 401F6D3C4DBC37D117E40A823546F8D4 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6612 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5012 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonUsb.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 4092 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScriptLib.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 4852 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Communications.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2476 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5724 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Graphics.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 3156 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataControls.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2212 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataLib.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1436 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonData.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6012 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Base.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2764 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUtils.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1228 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataExport.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5020 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDTP.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5228 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\YsiPlatform.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2128 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUI.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2336 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDiag.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2476 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommunications.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5436 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataUI.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5932 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\UI.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5440 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataProcessing.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5596 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataBrowser.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

FlowTrackerExport.exe (PID: 2672 cmdline: "C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe" /RegServer MD5: F2B4252F45413AA4644C1CCE16C8C811)

cleanup

Sigma Signatures

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Source: Process started

Author: frack113: Data: Command: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll", CommandLine: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\msiexec.exe, NewProcessName: C:\Windows\SysWOW64\msiexec.exe, OriginalFileName: C:\Windows\SysWOW64\msiexec.exe, ParentCommandLine: C:\Windows\system32\msiexec.exe /V, ParentImage: C:\Windows\System32\msiexec.exe, ParentProcessId: 4916, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll", ProcessId: 6612, ProcessName: msiexec.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T22:09:16.686531+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.4	49730	TCP
2024-10-31T22:09:55.573210+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.4	49736	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: FlowTracker_Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\msiexec.exe	Window detected: I &do not accept the license agreementI &accept the license agreement&Next >< &Back&ResetCancelSonTek/YSI Software License AgreementNotice to Registered User: By downloading and/or installing any software created by SonTek/YSI the registered user must accept all the terms and conditions of this agreement. This software program is licensed by SonTek/YSI for use only on the terms set forth herein.Scope of Use: The registered user has the right to use this software on any computer or network for internal use only. This means that the software may be used by the registered user's employees or those of its subsidiaries or parent company and in the performance of consulting or research for third parties who have engaged the registered user as an employee or independent contractor. The registered user may not sell license sublicense rent or make the software available for use by third parties. Nor may the registered user makeavailable to third parties the System Serial Number and software License number entered during the software installation and registration process.Limit of Liability: SonTek/YSI makes no warranty express or implied with respect to this software its quality performance merchantability or fitness for a particular purpose. In no event shall SonTek/YSI be liable for direct indirect special or consequential damages. The software is distributed "as is" and the user assumes the entire risk of its performance and suitability to the user's purpose.In relation to the software which the registered user is entitled to use the registered user shall not decompile disassemble or otherwise reverse engineer the software. Further the registered user may not alter or modify the software without the direct written consent of SonTek/YSI.The software should not be used as the exclusive determinant of any experiment or hypotheses. Where life is involved results obtained with the software should be examined carefully before any conclusions are made. SonTek/YSI takes no responsibility for any inconvenience loss of time property or product damage personal damage or any other incidental or consequential damages resulting from the use of this software.Copyright: This software is owned by SonTek/YSI and is protected by United States copyright law and international treaty provisions. All rights are reserved.You must agree with the license agreement below to proceed.top16License AgreementWise Installation Wizard
Source: C:\Windows\SysWOW64\msiexec.exe	Window detected: I &do not accept the license agreementI &accept the license agreement&Next >< &Back&ResetCancelSonTek/YSI Software License AgreementNotice to Registered User: By downloading and/or installing any software created by SonTek/YSI the registered user must accept all the terms and conditions of this agreement. This software program is licensed by SonTek/YSI for use only on the terms set forth herein.Scope of Use: The registered user has the right to use this software on any computer or network for internal use only. This means that the software may be used by the registered user's employees or those of its subsidiaries or parent company and in the performance of consulting or research for third parties who have engaged the registered user as an employee or independent contractor. The registered user may not sell license sublicense rent or make the software available for use by third parties. Nor may the registered user makeavailable to third parties the System Serial Number and software License number entered during the software installation and registration process.Limit of Liability: SonTek/YSI makes no warranty express or implied with respect to this software its quality performance merchantability or fitness for a particular purpose. In no event shall SonTek/YSI be liable for direct indirect special or consequential damages. The software is distributed "as is" and the user assumes the entire risk of its performance and suitability to the user's purpose.In relation to the software which the registered user is entitled to use the registered user shall not decompile disassemble or otherwise reverse engineer the software. Further the registered user may not alter or modify the software without the direct written consent of SonTek/YSI.The software should not be used as the exclusive determinant of any experiment or hypotheses. Where life is involved results obtained with the software should be examined carefully before any conclusions are made. SonTek/YSI takes no responsibility for any inconvenience loss of time property or product damage personal damage or any other incidental or consequential damages resulting from the use of this software.Copyright: This software is owned by SonTek/YSI and is protected by United States copyright law and international treaty provisions. All rights are reserved.You must agree with the license agreement below to proceed.top16License AgreementWise Installation Wizard

Source: C:\Windows\System32\msiexec.exe

File opened: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcr80.dll

Jump to behavior

Source:	Binary string: msvcr80.i386.pdb source: msvcr80.dll.2.dr
Source:	Binary string: msvcm80.i386.pdb source: msvcm80.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\SonDataUI.pdb source: SonDataUI.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\SonDataBrowser.pdb source: SonDataBrowser.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\SonScriptLib.pdb source: SonScriptLib.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\Base.pdb source: Base.dll.2.dr
Source:	Binary string: h:\nt.obj.x86fre\base\wcp\tools\msmcustomaction\objfre\i386\msmcustomaction.pdb source: FlowTracker_Setup.exe, WIS1DC4B5CF7D8A44A99CDFF7A5DD359A38_2_30.MSI.0.dr, MSIAB0F.tmp.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\SonCommunications.pdb( source: SonCommunications.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\Base.pdb source: Base.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\SonCommunications.pdb source: SonCommunications.dll.2.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.4:49736

Source: FlowTrackerExport.exe, 0000001D.00000002.1940091480.0000000002530000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://premier.intel.com/
Source: FlowTracker Users Manual.English.pdf.2.dr, FlowTracker Users Manual.Spanish.pdf.2.dr	String found in binary or memory: http://www.sontek.com/)
Source: FlowTracker Release Notes (FWv3.1 SWv2.10).pdf.2.dr	String found in binary or memory: http://www.sontek.com/product/fw/ftfw.htm)/S/URI
Source: FlowTracker Release Notes (FWv3.1 SWv2.10).pdf.2.dr	String found in binary or memory: http://www.sontek.com/product/sw/flowtracker/flowtracker.htm)/S/URI
Source: FlowTracker Release Notes (FWv3.1 SWv2.10).pdf.2.dr	String found in binary or memory: http://www.sontek.com/product/sw/sonutils/sonutils.htm)/S/URI
Source: FlowTracker Release Notes (FWv3.7 SWv2.30).pdf.2.dr	String found in binary or memory: http://www.sontek.com/software.html)

Source: msiexec.exe

Process created: 48

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5aa756.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAB0F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIACD5.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\atl71.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msvcr71.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msvcp71.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ippcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipps20.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsa6.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsw7.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippspx.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippscw7.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsi7.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsct7.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippscpx.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsca6.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsri7.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippst7.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsrw7.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsrt7.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsci7.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsrpx.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsra6.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ippsc20.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\libguide40.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ippsr20.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcr80.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcp80.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcm80.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916257.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916257.0\8.0.50727.762.policy	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916257.0\8.0.50727.762.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}\IconA6B7F1401.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5aa758.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5aa758.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIAB0F.tmp

Jump to behavior

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0041C040	29_2_0041C040
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0046B97B	29_2_0046B97B
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_004239D0	29_2_004239D0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_004111A4	29_2_004111A4
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0045E2F5	29_2_0045E2F5
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_004113C3	29_2_004113C3
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0046B437	29_2_0046B437
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_00410C80	29_2_00410C80
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_00429540	29_2_00429540
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_00411571	29_2_00411571
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_00464D19	29_2_00464D19
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0046C5B7	29_2_0046C5B7
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0046D60C	29_2_0046D60C
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0046DEC1	29_2_0046DEC1
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_00417E80	29_2_00417E80
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0046BEBF	29_2_0046BEBF
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_004247D0	29_2_004247D0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_004257D0	29_2_004257D0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023E220C	29_2_023E220C
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02412238	29_2_02412238
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024CC2C8	29_2_024CC2C8
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024A42F0	29_2_024A42F0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023D02D0	29_2_023D02D0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0246A2B0	29_2_0246A2B0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0243A3C0	29_2_0243A3C0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024003FC	29_2_024003FC
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02436047	29_2_02436047
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02498050	29_2_02498050
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0249A060	29_2_0249A060
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024BE010	29_2_024BE010
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0243E0F0	29_2_0243E0F0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024560F0	29_2_024560F0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02400170	29_2_02400170
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023B2140	29_2_023B2140
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0240C1C0	29_2_0240C1C0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023EA1A8	29_2_023EA1A8
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02370610	29_2_02370610
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0249C670	29_2_0249C670
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02368664	29_2_02368664
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0235A660	29_2_0235A660
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024B86F0	29_2_024B86F0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0236A6D0	29_2_0236A6D0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023E27B4	29_2_023E27B4
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023E67B4	29_2_023E67B4
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024007CC	29_2_024007CC
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024B8786	29_2_024B8786
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023D07C4	29_2_023D07C4
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0240C460	29_2_0240C460
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02478470	29_2_02478470
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024A44E0	29_2_024A44E0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023B4490	29_2_023B4490
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024144FC	29_2_024144FC
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024A24A0	29_2_024A24A0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023F4510	29_2_023F4510
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0241C570	29_2_0241C570
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0238E500	29_2_0238E500
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0240E508	29_2_0240E508
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02384554	29_2_02384554
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_022F65C4	29_2_022F65C4
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0243A5B0	29_2_0243A5B0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0234E5CC	29_2_0234E5CC
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02494AC0	29_2_02494AC0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023DAAF4	29_2_023DAAF4
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02472AA0	29_2_02472AA0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024A0AA0	29_2_024A0AA0
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_023B4B78	29_2_023B4B78
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_02494BE0	29_2_02494BE0

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: String function: 00402A70 appears 215 times
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: String function: 024C88C9 appears 87 times
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: String function: 0045C79C appears 34 times
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: String function: 00459400 appears 65 times
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: String function: 004101C0 appears 101 times

Source: ippsi7.dll.2.dr

Static PE information: Number of sections : 35 > 10

Source: IconA6B7F1401.exe.2.dr

Static PE information: No import functions for PE file found

Source: FlowTracker_Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean6.winEXE@51/206@0/0

Source: FlowTracker Users Manual.Spanish.pdf.2.dr	Initial sample: mailto:sales@sontek.com
Source: FlowTracker Release Notes (FWv3.1 SWv2.10).pdf.2.dr	Initial sample: http://www.sontek.com/product/fw/ftfw.htm
Source: FlowTracker Release Notes (FWv3.1 SWv2.10).pdf.2.dr	Initial sample: http://www.sontek.com/product/sw/flowtracker/flowtracker.htm
Source: FlowTracker Users Manual.Spanish.pdf.2.dr	Initial sample: mailto:support@sontek.com
Source: FlowTracker Users Manual.Spanish.pdf.2.dr	Initial sample: http://www.sontek.com/
Source: FlowTracker Release Notes (FWv3.1 SWv2.10).pdf.2.dr	Initial sample: http://www.sontek.com/product/sw/sonutils/sonutils.htm
Source: FlowTracker Release Notes (FWv3.7 SWv2.30).pdf.2.dr	Initial sample: http://www.sontek.com/software.html
Source: FlowTracker Users Manual.Spanish.pdf.2.dr	Initial sample: mailto:inquiry@sontek.com

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Code function: 29_2_00415860 CoCreateInstance,OleRun,_com_util::ConvertStringToBSTR,_com_util::ConvertStringToBSTR,VariantClear,VariantClear,VariantClear,VariantClear,SysStringLen,GetFileAttributesA,CreateDirectoryA,GetLastError,InterlockedDecrement,SysFreeString,

29_2_00415860

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Code function: 29_2_00401250 LoadResource,LockResource,SizeofResource,

29_2_00401250

Source: C:\Users\user\Desktop\FlowTracker_Setup.exe

File created: C:\Program Files (x86)\Common Files\Wise Installation Wizard

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSI7931.tmp

Jump to behavior

Source: FlowTracker_Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: FlowTracker_Setup.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\FlowTracker_Setup.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FlowTracker_Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\FlowTracker_Setup.exe

File read: C:\Users\user\Desktop\FlowTracker_Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FlowTracker_Setup.exe "C:\Users\user\Desktop\FlowTracker_Setup.exe"
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS1DC4B5CF7D8A44A99CDFF7A5DD359A38_2_30.MSI" WISE_SETUP_EXE_PATH="C:\Users\user\Desktop\FlowTracker_Setup.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 721A14B488BA2239A99405E88BE13886 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 401F6D3C4DBC37D117E40A823546F8D4
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonUsb.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScriptLib.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Communications.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Graphics.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataControls.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataLib.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonData.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Base.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUtils.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataExport.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDTP.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\YsiPlatform.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUI.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDiag.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataUI.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\UI.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataProcessing.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataBrowser.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe "C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe" /RegServer
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS1DC4B5CF7D8A44A99CDFF7A5DD359A38_2_30.MSI" WISE_SETUP_EXE_PATH="C:\Users\user\Desktop\FlowTracker_Setup.exe"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 721A14B488BA2239A99405E88BE13886 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 401F6D3C4DBC37D117E40A823546F8D4	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonUsb.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScriptLib.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Communications.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Graphics.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataControls.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataLib.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonData.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Base.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUtils.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataExport.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDTP.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\YsiPlatform.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUI.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDiag.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataUI.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\UI.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataProcessing.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataBrowser.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe "C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe" /RegServer	Jump to behavior

Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ipps20.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: libguide40.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Section loaded: ipps20.dll	Jump to behavior
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Section loaded: libguide40.dll	Jump to behavior
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\FlowTracker_Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\drivers2.ini

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: I accept the license agreement
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: OK
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\msiexec.exe	Window detected: I &do not accept the license agreementI &accept the license agreement&Next >< &Back&ResetCancelSonTek/YSI Software License AgreementNotice to Registered User: By downloading and/or installing any software created by SonTek/YSI the registered user must accept all the terms and conditions of this agreement. This software program is licensed by SonTek/YSI for use only on the terms set forth herein.Scope of Use: The registered user has the right to use this software on any computer or network for internal use only. This means that the software may be used by the registered user's employees or those of its subsidiaries or parent company and in the performance of consulting or research for third parties who have engaged the registered user as an employee or independent contractor. The registered user may not sell license sublicense rent or make the software available for use by third parties. Nor may the registered user makeavailable to third parties the System Serial Number and software License number entered during the software installation and registration process.Limit of Liability: SonTek/YSI makes no warranty express or implied with respect to this software its quality performance merchantability or fitness for a particular purpose. In no event shall SonTek/YSI be liable for direct indirect special or consequential damages. The software is distributed "as is" and the user assumes the entire risk of its performance and suitability to the user's purpose.In relation to the software which the registered user is entitled to use the registered user shall not decompile disassemble or otherwise reverse engineer the software. Further the registered user may not alter or modify the software without the direct written consent of SonTek/YSI.The software should not be used as the exclusive determinant of any experiment or hypotheses. Where life is involved results obtained with the software should be examined carefully before any conclusions are made. SonTek/YSI takes no responsibility for any inconvenience loss of time property or product damage personal damage or any other incidental or consequential damages resulting from the use of this software.Copyright: This software is owned by SonTek/YSI and is protected by United States copyright law and international treaty provisions. All rights are reserved.You must agree with the license agreement below to proceed.top16License AgreementWise Installation Wizard
Source: C:\Windows\SysWOW64\msiexec.exe	Window detected: I &do not accept the license agreementI &accept the license agreement&Next >< &Back&ResetCancelSonTek/YSI Software License AgreementNotice to Registered User: By downloading and/or installing any software created by SonTek/YSI the registered user must accept all the terms and conditions of this agreement. This software program is licensed by SonTek/YSI for use only on the terms set forth herein.Scope of Use: The registered user has the right to use this software on any computer or network for internal use only. This means that the software may be used by the registered user's employees or those of its subsidiaries or parent company and in the performance of consulting or research for third parties who have engaged the registered user as an employee or independent contractor. The registered user may not sell license sublicense rent or make the software available for use by third parties. Nor may the registered user makeavailable to third parties the System Serial Number and software License number entered during the software installation and registration process.Limit of Liability: SonTek/YSI makes no warranty express or implied with respect to this software its quality performance merchantability or fitness for a particular purpose. In no event shall SonTek/YSI be liable for direct indirect special or consequential damages. The software is distributed "as is" and the user assumes the entire risk of its performance and suitability to the user's purpose.In relation to the software which the registered user is entitled to use the registered user shall not decompile disassemble or otherwise reverse engineer the software. Further the registered user may not alter or modify the software without the direct written consent of SonTek/YSI.The software should not be used as the exclusive determinant of any experiment or hypotheses. Where life is involved results obtained with the software should be examined carefully before any conclusions are made. SonTek/YSI takes no responsibility for any inconvenience loss of time property or product damage personal damage or any other incidental or consequential damages resulting from the use of this software.Copyright: This software is owned by SonTek/YSI and is protected by United States copyright law and international treaty provisions. All rights are reserved.You must agree with the license agreement below to proceed.top16License AgreementWise Installation Wizard

Source: FlowTracker_Setup.exe

Static file information: File size 26464768 > 1048576

Source: C:\Windows\System32\msiexec.exe

File opened: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcr80.dll

Jump to behavior

Source: FlowTracker_Setup.exe

Static PE information: Raw size of .WISE is bigger than: 0x100000 < 0x1930e00

Source:	Binary string: msvcr80.i386.pdb source: msvcr80.dll.2.dr
Source:	Binary string: msvcm80.i386.pdb source: msvcm80.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\SonDataUI.pdb source: SonDataUI.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\SonDataBrowser.pdb source: SonDataBrowser.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\SonScriptLib.pdb source: SonScriptLib.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\Base.pdb source: Base.dll.2.dr
Source:	Binary string: h:\nt.obj.x86fre\base\wcp\tools\msmcustomaction\objfre\i386\msmcustomaction.pdb source: FlowTracker_Setup.exe, WIS1DC4B5CF7D8A44A99CDFF7A5DD359A38_2_30.MSI.0.dr, MSIAB0F.tmp.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\SonCommunications.pdb( source: SonCommunications.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\Base.pdb source: Base.dll.2.dr
Source:	Binary string: C:\SonDev\WinDev\Components2\Bin\Release\SonCommunications.pdb source: SonCommunications.dll.2.dr

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Code function: 29_2_004679F0 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

29_2_004679F0

Source: initial sample

Static PE information: section where entry point is pointing to: .rdata

Source: FlowTracker_Setup.exe	Static PE information: section name: .WISE
Source: ippcore.dll.2.dr	Static PE information: section name: .data1
Source: ipps20.dll.2.dr	Static PE information: section name: .data1
Source: ippsa6.dll.2.dr	Static PE information: section name: .data1
Source: ippsw7.dll.2.dr	Static PE information: section name: .data1
Source: ippspx.dll.2.dr	Static PE information: section name: .data1
Source: ippscw7.dll.2.dr	Static PE information: section name: .data1
Source: ippscw7.dll.2.dr	Static PE information: section name: CONST1
Source: ippsi7.dll.2.dr	Static PE information: section name: ps10lgin
Source: ippsi7.dll.2.dr	Static PE information: section name: psexpflt
Source: ippsi7.dll.2.dr	Static PE information: section name: psexpflt
Source: ippsi7.dll.2.dr	Static PE information: section name: psexpdbl
Source: ippsi7.dll.2.dr	Static PE information: section name: KaiserSh
Source: ippsi7.dll.2.dr	Static PE information: section name: Kaiserfl
Source: ippsi7.dll.2.dr	Static PE information: section name: Kaiserdb
Source: ippsi7.dll.2.dr	Static PE information: section name: psln32ss
Source: ippsi7.dll.2.dr	Static PE information: section name: magsquar
Source: ippsi7.dll.2.dr	Static PE information: section name: MiniMax
Source: ippsi7.dll.2.dr	Static PE information: section name: MiniMaxI
Source: ippsi7.dll.2.dr	Static PE information: section name: Norm32fc
Source: ippsi7.dll.2.dr	Static PE information: section name: Norm64fc
Source: ippsi7.dll.2.dr	Static PE information: section name: advnrmlz
Source: ippsi7.dll.2.dr	Static PE information: section name: phaseshf
Source: ippsi7.dll.2.dr	Static PE information: section name: phaseshf
Source: ippsi7.dll.2.dr	Static PE information: section name: phasesho
Source: ippsi7.dll.2.dr	Static PE information: section name: phasesho
Source: ippsi7.dll.2.dr	Static PE information: section name: phaseflt
Source: ippsi7.dll.2.dr	Static PE information: section name: phaseflt
Source: ippsi7.dll.2.dr	Static PE information: section name: phaseint
Source: ippsi7.dll.2.dr	Static PE information: section name: phasedbl
Source: ippsi7.dll.2.dr	Static PE information: section name: phasedbl
Source: ippsi7.dll.2.dr	Static PE information: section name: psplr2cr
Source: ippsi7.dll.2.dr	Static PE information: section name: psplr2cr
Source: ippsi7.dll.2.dr	Static PE information: section name: .srdata
Source: ippsi7.dll.2.dr	Static PE information: section name: .sdata1
Source: ippsi7.dll.2.dr	Static PE information: section name: .data1
Source: ippsct7.dll.2.dr	Static PE information: section name: .data1
Source: ippsct7.dll.2.dr	Static PE information: section name: CONST1
Source: ippscpx.dll.2.dr	Static PE information: section name: .data1
Source: ippsca6.dll.2.dr	Static PE information: section name: .data1
Source: ippsca6.dll.2.dr	Static PE information: section name: CONST1
Source: ippsri7.dll.2.dr	Static PE information: section name: .srdata
Source: ippsri7.dll.2.dr	Static PE information: section name: .sdata1
Source: ippsri7.dll.2.dr	Static PE information: section name: .data1
Source: ippst7.dll.2.dr	Static PE information: section name: .data1
Source: ippsrw7.dll.2.dr	Static PE information: section name: .data1
Source: ippsrw7.dll.2.dr	Static PE information: section name: _DATA1
Source: ippsrw7.dll.2.dr	Static PE information: section name: _DATA2
Source: ippsrt7.dll.2.dr	Static PE information: section name: .data1
Source: ippsrt7.dll.2.dr	Static PE information: section name: _DATA1
Source: ippsrt7.dll.2.dr	Static PE information: section name: _DATA2
Source: ippsci7.dll.2.dr	Static PE information: section name: .srdata
Source: ippsci7.dll.2.dr	Static PE information: section name: .sdata1
Source: ippsci7.dll.2.dr	Static PE information: section name: .data1
Source: ippsrpx.dll.2.dr	Static PE information: section name: .data1
Source: ippsra6.dll.2.dr	Static PE information: section name: .data1
Source: ippsra6.dll.2.dr	Static PE information: section name: _DATA1
Source: ippsc20.dll.2.dr	Static PE information: section name: .data1
Source: libguide40.dll.2.dr	Static PE information: section name: .data1
Source: ippsr20.dll.2.dr	Static PE information: section name: .data1

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0045C7E1 push ecx; ret		29_2_0045C7F4
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_024C8470 push eax; ret		29_2_024C849E

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI7931.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Base.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataProcessing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\MultiLanguage.Dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippspx.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsci7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ippcore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippst7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataControls.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ippsr20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipps20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsrpx.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\UI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsrt7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msvcr71.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataUI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsrw7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDTP.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\atl71.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsi7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsri7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\libguide40.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ippsc20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcm80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SonTek\FlowTracker\GDIPlus.Dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsca6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\SontekDrivers.Dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsw7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcp80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScriptLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommunications.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\YsiPlatform.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Communications.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msvcp71.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataBrowser.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}\IconA6B7F1401.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsa6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsra6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAB0F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippscpx.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Graphics.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataExport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsct7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippscw7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDiag.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcr80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonUsb.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippspx.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsw7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsci7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcp80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ippcore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippst7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ippsr20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipps20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsrpx.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msvcp71.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}\IconA6B7F1401.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsrt7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsa6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msvcr71.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAB0F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsra6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippscpx.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsrw7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\atl71.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsct7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsi7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsri7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\libguide40.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippscw7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ippsc20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcr80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcm80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ipp20\ippsca6.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sontek Software	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sontek Software\FlowTracker Manual.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sontek Software\FlowTracker.lnk	Jump to behavior

Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI7931.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Base.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataProcessing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\MultiLanguage.Dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippspx.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsci7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ippcore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippst7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataControls.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ippsr20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsrpx.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\UI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsrt7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataUI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\msvcr71.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsrw7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDTP.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\atl71.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsi7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsri7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ippsc20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcm80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SonTek\FlowTracker\GDIPlus.Dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsca6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\SontekDrivers.Dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsw7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcp80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScriptLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommunications.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUtils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\YsiPlatform.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Communications.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\msvcp71.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataBrowser.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}\IconA6B7F1401.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsa6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsra6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIAB0F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippscpx.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Graphics.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataExport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippsct7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ipp20\ippscw7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDiag.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcr80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonUsb.dll	Jump to dropped file

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_29-63420
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_29-63358

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

API coverage: 1.5 %

Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Code function: 29_2_0045AAE1 VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,

29_2_0045AAE1

Source: FlowTrackerExport.exe, 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmp, FlowTrackerExport.exe, 0000001D.00000000.1938096761.0000000000490000.00000008.00000001.01000000.00000005.sdmp, Base.dll.2.dr, FlowTrackerExport.exe.2.dr, SonCommunications.dll.2.dr, SonScriptLib.dll.2.dr, SonDataUI.dll.2.dr, SonDataBrowser.dll.2.dr	Binary or memory string: .?AVCRegistryVirtualMachine@ATL@@
Source: FlowTrackerExport.exe, 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmp, FlowTrackerExport.exe, 0000001D.00000000.1938096761.0000000000490000.00000008.00000001.01000000.00000005.sdmp, FlowTrackerExport.exe.2.dr	Binary or memory string: G.?AVCRegistryVirtualMachine@ATL@@L
Source: SonDataBrowser.dll.2.dr	Binary or memory string: .?AVCRegistryVirtualMachine@ATL@@4

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

API call chain: ExitProcess graph end node

graph_29-63359

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Code function: 29_2_00459EDC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

29_2_00459EDC

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Code function: 29_2_0045AAE1 VirtualProtect ?,-00000001,00000104,?

29_2_0045AAE1

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

29_2_004679F0

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Code function: 29_2_00458D6A IsProcessorFeaturePresent,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapAlloc,InterlockedCompareExchange,GetProcessHeap,HeapFree,

29_2_00458D6A

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_0045F65B __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_0045F65B
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_00459EDC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_00459EDC
Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	Code function: 29_2_00459F5B _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_00459F5B

Source: C:\Users\user\Desktop\FlowTracker_Setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS1DC4B5CF7D8A44A99CDFF7A5DD359A38_2_30.MSI" WISE_SETUP_EXE_PATH="C:\Users\user\Desktop\FlowTracker_Setup.exe"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonUsb.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScriptLib.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Communications.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Graphics.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataControls.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataLib.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonData.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Base.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUtils.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataExport.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDTP.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\YsiPlatform.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUI.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDiag.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataUI.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\UI.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataProcessing.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataBrowser.dll"	Jump to behavior

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Code function: GetLocaleInfoA,

29_2_00467D5A

Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Code function: 29_2_0046711C GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

29_2_0046711C

Source: C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Code function: 29_2_024C84FF GetVersion,GetCommandLineA,

29_2_024C84FF

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	2 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Replication Through Removable Media	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	25 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FlowTracker_Setup.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\MultiLanguage.Dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Base.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Communications.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Graphics.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUI.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUtils.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommunications.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDTP.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonData.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataBrowser.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataControls.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataExport.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataLib.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataProcessing.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataUI.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDiag.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScriptLib.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonUsb.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\UI.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\YsiPlatform.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\SontekDrivers.Dll	0%	ReversingLabs
C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe	0%	ReversingLabs
C:\Program Files (x86)\SonTek\FlowTracker\GDIPlus.Dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI7931.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIAB0F.tmp	0%	ReversingLabs
C:\Windows\Installer\{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}\IconA6B7F1401.exe	0%	ReversingLabs
C:\Windows\SysWOW64\atl71.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsa6.dll	2%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsca6.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsci7.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippscpx.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsct7.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippscw7.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsi7.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippspx.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsra6.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsri7.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsrpx.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsrt7.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsrw7.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippst7.dll	2%	ReversingLabs
C:\Windows\SysWOW64\ipp20\ippsw7.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ippcore.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ipps20.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ippsc20.dll	0%	ReversingLabs
C:\Windows\SysWOW64\ippsr20.dll	0%	ReversingLabs
C:\Windows\SysWOW64\libguide40.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msvcp71.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msvcr71.dll	0%	ReversingLabs
C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcm80.dll	0%	ReversingLabs
C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcp80.dll	0%	ReversingLabs
C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcr80.dll	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://www.sontek.com/software.html)	FlowTracker Release Notes (FWv3.7 SWv2.30).pdf.2.dr	false	unknown
http://premier.intel.com/	FlowTrackerExport.exe, 0000001D.00000002.1940091480.0000000002530000.00000004.00000001.01000000.00000008.sdmp	false	unknown
http://www.sontek.com/)	FlowTracker Users Manual.English.pdf.2.dr, FlowTracker Users Manual.Spanish.pdf.2.dr	false	unknown
http://www.sontek.com/product/sw/sonutils/sonutils.htm)/S/URI	FlowTracker Release Notes (FWv3.1 SWv2.10).pdf.2.dr	false	unknown
http://www.sontek.com/product/fw/ftfw.htm)/S/URI	FlowTracker Release Notes (FWv3.1 SWv2.10).pdf.2.dr	false	unknown
http://www.sontek.com/product/sw/flowtracker/flowtracker.htm)/S/URI	FlowTracker Release Notes (FWv3.1 SWv2.10).pdf.2.dr	false	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546436
Start date and time:	2024-10-31 22:08:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FlowTracker_Setup.exe
Detection:	CLEAN
Classification:	clean6.winEXE@51/206@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 89% Number of executed functions: 21 Number of non-executed functions: 248
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: FlowTracker_Setup.exe

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	261672
Entropy (8bit):	5.397301673649275
Encrypted:	false
SSDEEP:	6144:2fb4fBlyM7JeBkEO7Rz6XScON68KvfzjP7wxVGHlMm235il0l8nABiZJ2XhFhCX1:3TteQMtaoYF+2Hxp8Ba4F
MD5:	5A579BEDAE4757725F0777FA5D59D925
SHA1:	B26D9F7F6A195AF8B3F18A3E2A6D54696B4B5564
SHA-256:	642482D3F4564FA440CE19C6A3C23A7FAEF74B04A53DD679065678EFD36AE601
SHA-512:	E58B7820ACADC5C0060CDADA05AA62A576B18D407AC949CE06A437B71FCDBF74B1C29ACC976DBC4B676490B5CB27BB1FB6A47166251294C00B14871391A4DC76
Malicious:	false
Preview:	...@IXOS.@.....@'._Y.@.....@.....@.....@.....@.....@......&.{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}..FlowTracker,.WIS1DC4B5CF7D8A44A99CDFF7A5DD359A38_2_30.MSI.@.....@.....@.....@........&.{6480B60F-D404-4E1F-B8A6-D4A8D8E57662}.....@.....@.....@.....@.......@.....@.....@.......@......FlowTracker......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files.....File: [1]....ProcessComponents".Updating component registration.....&.{46BF110B-0B75-4F7B-9684-0AF9A8F6EBDE}&.{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}.@......&.{8ADB46B6-81E8-4F9A-A97F-D847BB0392F0}&.{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}.@......&.{14268BF5-48E8-465B-8745-4C47694EA767}&.{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}.@......&.{D59A9269-E6CF-4EFB-B652-B4DD5F7072A9}&.{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}.@......&.{2AE9BF2B-5EB2-49FF-91FA-E13A0560F1A4}&.{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}.@......&.{2DDAE21A-CFC8-42A6-95D8-2E3502CE2672}&.{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}.@......&.{44D60BF4-A4AA-4391-8A

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\Chinese.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	19208
Entropy (8bit):	6.21852968192164
Encrypted:	false
SSDEEP:	384:YhAlyHMDF4JEhzQloRI71EYzZLtW6a0zx8HlxDudaU/DMsqHXvMZ6g2H:YhOAsF4JZloRI71hZLt78Hl1uMU/DMso
MD5:	F27BA317BA207239593EBD33B2170EA8
SHA1:	B008264388098D982D9FC66F78573FBBFA78E68B
SHA-256:	950977544F7D18E31A0698FD3A12AE99E96DE8F78CC36B7BF1C462A6C88760C4
SHA-512:	FAF6FE85353B5EE7886B403F35CE9027ECAB08BDFFD60C07CEBEDD77C9B9DB301C606BEBEA8CF6F65211EE46CFB48FF077733AB2B16276453C3637773B0111CA
Malicious:	false
Preview:	<?xml version="1.0" ?>..<root>.. <FileVersion>0.5</FileVersion>.. <Date>..</Date>.. <Time>..</Time>...<Description>..</Description>...<Summary>..</Summary>...<Location>..</Location>...<Delete>..</Delete>...<MaxVelocityAngle>......</MaxVelocityAngle>...<Year>.</Year>...<Month>.</Month>...<Day>.</Day>...<Hour>..</Hour>...<Minute>..</Minute>...<Second>.</Second>...<Years>..</Years>...<Months>..</Months>...<Days>..</Days>...<Hours>..</Hours>...<Minutes>..</Minutes>...<Seconds>.</Seconds>...<January>..</January>...<February>..</February>...<March>..</March>...<April>..</April>...<May>..</May>...<June>..</June>...<July>..</July>...<August>..</August>...<September>..</September>...<October>..</October>...<November>...</November>...<December>...</December>.....<FlowExportStartTitle>SonTek.....</FlowExportStartTitle>...<AboutFlowTrackerSoftwareTitle>..So

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\English.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (1876), with CRLF line terminators
Category:	dropped
Size (bytes):	58396
Entropy (8bit):	5.0935266368683365
Encrypted:	false
SSDEEP:	768:sV0DRbWVqKsuQSrHGvszUXLkMbEEFPmHmuVsJohrQDfKQSjRKYQ55iHnngTsDHQ4:XbWVbQOGdbkGmH6erQDfKMCtKKr
MD5:	71C6D6863F33050283B960035F8C186A
SHA1:	127112FB8EA9E378C8715E657BE7FBE29DF14D08
SHA-256:	9A43A6B1E09FBF9F9323924C1E0A13F8FE9ECC021B03C4AA40075508BA17C20C
SHA-512:	E857FB64816F465546A96B3E90BE3FBA4AD25A50FE12ED26FEEB91A97BBC546AD63A97BD8CE423B5F5E835FB6EE02DE82464B67F4B5F6C6921DC932409615F84
Malicious:	false
Preview:	<?xml version="1.0" ?>..<root>.. <FileVersion>0.5</FileVersion>...<StartTitle>Welcome to SonTek's FlowPack software</StartTitle>...<StartDescription>FlowPack stores your stage, velocity and discharge measurements and generates Velocity-Index rating reports.</StartDescription>...<StartSelectTasks>Select one of the following actions:</StartSelectTasks>...<OpenExistingRating>Open an Existing Rating</OpenExistingRating>...<CreateNewFolderDescription>Folders are used to store rating files...Folders should be labelled with the general location of the measurement sites...For example: Amazon River or North Stream</CreateNewFolderDescription>...<CreateNewRatingDescription>Rating files store measurement data and rating information. This action will automatically open the new rating...Ratings should be labelled after a specific measurement site. Ratings should be created under a suitable folder for good file management...For example: Site 1 or A403 (Main St)</CreateNewRatingDescription>...<OpenE

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\French.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (595), with CRLF line terminators
Category:	dropped
Size (bytes):	20064
Entropy (8bit):	5.266719614248311
Encrypted:	false
SSDEEP:	384:2HpMor+YvcEssDUoUG8N6V8kFZNreDtiHnYJwmoz3bXpGENyDB5KhHRvcK9wVHH:2JxrOgDHUE8sN6iHnYJHo3bXpGENyDBv
MD5:	4BB626693B6A793F0EB30D9F28C26C57
SHA1:	38E9C99DB8F9D0CEB19A3CBF84211ABFFC2B0936
SHA-256:	1CA4AE15528C64EB31BC8836830C877CEBDAA50310A991C56228C652702DE762
SHA-512:	2CE11F9759D6A5B4907F710112D24FACEA54E73EC9B71331739FC62724D85F4D86CE8DAF92FC6427399A7ACCB73C2D8FB5352CE6AD4EEC497B3C7174C3D4424D
Malicious:	false
Preview:	<?xml version="1.0" ?>..<root>.. <FileVersion>0.5</FileVersion>.. <Date>Date</Date>.. <Time>Temps</Time>...<Description>Description</Description>...<Summary>R.sum.</Summary>...<Location>Endroit </Location>...<Delete>Effacement</Delete>...<MaxVelocityAngle>Angle Max de Vit</MaxVelocityAngle>...<Year>Ann.e</Year>...<Month>Mois</Month>...<Day>Jour</Day>...<Hour>Heure</Hour>...<Minute>Minute</Minute>...<Second>Second</Second>...<Years>Ann.es</Years>...<Months>Mois</Months>...<Days>Jours</Days>...<Hours>Heures</Hours>...<Minutes>Minutes</Minutes>...<Seconds>Secondes</Seconds>...<January>Janvier</January>...<February>F.vrier</February>...<March>Mars</March>...<April>Avril</April>...<May>Peut</May>...<June>Juin</June>...<July>Juillet</July>...<August>Ao.t</August>...<September>Septembre</September>...<October>Octobre</October>...<November>Novembre</November>...<December>D.cembre</December>.....<FlowExportStartTitle>Le FlowTracker de SonTek</FlowExportStartTitle>...<AboutFlowTrackerS

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\German.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (621), with CRLF line terminators
Category:	dropped
Size (bytes):	20415
Entropy (8bit):	5.237746390859078
Encrypted:	false
SSDEEP:	384:s69HsAXMwZiSPeiessxrDiTpAfthkiSJnWydI05qmMyHlOMffmyZ8HD4VhkemKWR:s69Hl/ZiSPei8xrDiTpAYiSJnWlmMyHw
MD5:	4BC5D9C7D0ECB0305E89175E0C51CD91
SHA1:	415FCE2FB1FC0CE3EC86111420AC2B474FB700F6
SHA-256:	03F6BCBDF5D6817FEDD88F5DCEFDDFC6766AEB2564C3BD067AF1C32EE59DCA6F
SHA-512:	42ED89B42EFB19479ED4B452803BEB34A7601E8026108B196946E178D7BBFF2B73B795F911F5D5DCB107504AD44783CED2F32338E70D002C164B83B7109C6C05
Malicious:	false
Preview:	<?xml version="1.0" ?>..<root>.. <FileVersion>0.5</FileVersion>.. <Date>Datum</Date>.. <Time>Zeit</Time>...<Description>Beschreibung</Description>...<Summary>Zusammenfassung</Summary>...<Location>Ort</Location>...<Delete>L.schen</Delete>...<MaxVelocityAngle>max Geschwindigkeitswinkel</MaxVelocityAngle>...<Year>Jahr</Year>...<Month>Monat</Month>...<Day>Tag</Day>...<Hour>Stunde</Hour>...<Minute>Minute</Minute>...<Second>Sekunde</Second>...<Years>Jahre</Years>...<Months>Monate</Months>...<Days>Tage</Days>...<Hours>Stunden</Hours>...<Minutes>Minuten</Minutes>...<Seconds>Sekunden</Seconds>...<January>J.nner</January>...<February>Februar</February>...<March>M.rz</March>...<April>April</April>...<May>Mai</May>...<June>Juni</June>....<July>Juli</July>...<August>August</August>...<September>September</September>...<October>Oktober</October>...<November>November</November>...<December>Dezember</December>.....<FlowExportStartTitle>SonTek`s FlowTracker</FlowExportStartTitle>...<AboutFlowTrac

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\Italian.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (624), with CRLF line terminators
Category:	dropped
Size (bytes):	20081
Entropy (8bit):	5.192176735335862
Encrypted:	false
SSDEEP:	384:zgcCdMpaQoLG9YJqoDUcRmrMaXLXJgpU5yaM+7CyHlrG9XK+wrbNMqs8knHsvPOe:Ve4anZDUcMrBXVkUCyHlrCJEbNMqs8kG
MD5:	08EEFD0F546119ED27D8FDD9FAB8C983
SHA1:	F5232A8E27413BC96F6CC2ED0972292F2DCA1D33
SHA-256:	1F87761325FD6DACC3FC0F77283593E6BCAF6119B762947C4DD24BE0D3D3E36C
SHA-512:	C3E54D2739F42C7A4578411A082AB5F599879D88A98580EE004A912D462E8B929AC727B37F651AA3A37FCBDE7437BB6CC3806489510C988C87CB265DE716A2EE
Malicious:	false
Preview:	<?xml version="1.0" ?>..<root>.. <FileVersion>0.5</FileVersion>.. <Date>Data</Date>.. <Time>Orario</Time>...<Description>Descrizione</Description>...<Summary>Informazioni generali</Summary>...<Location>Progressiva</Location>...<Delete>Cancella</Delete>...<MaxVelocityAngle>Angolo Massima Velocit.</MaxVelocityAngle>...<Year>Anno</Year>...<Month>Mese</Month>...<Day>Giorno</Day>...<Hour>Ora</Hour>...<Minute>Minuto</Minute>...<Second>Secondo</Second>...<Years>Anni</Years>...<Months>Mesi</Months>...<Days>Giorni</Days>...<Hours>Ore</Hours>...<Minutes>Minuti</Minutes>...<Seconds>Secondi</Seconds>...<January>Gennaio</January>...<February>Febbraio</February>...<March>Marzo</March>...<April>Aprile</April>...<May>Maggio</May>...<June>Giugno</June>...<July>Luglio</July>...<August>Agosto</August>...<September>Settembre</September>...<October>Ottobre</October>...<November>Novembre</November>...<December>Dicembre</December>.....<FlowExportStartTitle>SonTek FlowTracker</FlowExportStartTitle>...<Abo

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\Japanese.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	22537
Entropy (8bit):	6.053816514809545
Encrypted:	false
SSDEEP:	384:cXBxrMAoL1W44m7S7cH7xuIyfCQVCxCxIiHnhNuCvQySySRomuOLlHvvPnaShw:c7Bos7cH7mfwxXiHnh0CvJSDWmuOLlH6
MD5:	C9591BA13BE6BC48E46E116ADFE40B44
SHA1:	38F960DCB4DF878421F35B2E7DAFF17C28555DB8
SHA-256:	7AFC391E08C0860212DFAE7C93B2274485A300F6AAFA75A248F09E147E1E6C53
SHA-512:	B5B9FAA1A39D81D569CD15F31926D6803EEC8332C67E0770BA43C55F946435C13FC2ECEDEDE377B250472353E71C47A1B8ADFA8ECFAC139AED48DB1B21EFF253
Malicious:	false
Preview:	<?xml version="1.0" ?>..<root>.. <FileVersion>0.5</FileVersion>.. <Date>..</Date>...<Time>..</Time>...<Description>..</Description>...<Summary>..</Summary>...<Location>..</Location>...<Delete>..</Delete>...<MaxVelocityAngle>.....</MaxVelocityAngle>...<Year>.</Year>...<Month>.</Month>...<Day>.</Day>...<Hour>.</Hour>...<Minute>.</Minute>...<Second>.</Second>...<Years>.</Years>...<Months>.</Months>...<Days>.</Days>...<Hours>.</Hours>...<Minutes>.</Minutes>...<Seconds>.</Seconds>...<January>1.</January>...<February>2.</February>...<March>3.</March>...<April>4.</April>...<May>5.</May>...<June>6.</June>...<July>7.</July>...<August>8.</August>...<September>9.</September>...<October>10.</October>...<November>11.</November>...<December>12.</December>.....<FlowExportStartTitle>Sontek.........</FlowExportStartTitle>...<AboutFlowTrackerSoftwareTitle>Sontek..............

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\MultiLanguage.Dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	5.516603930890568
Encrypted:	false
SSDEEP:	384:Rv05TBwF/Fb4H+AfV78tt7l39MTTgvsKmqDRQnaZzjQ+SZkLc0RaPV23riL7euZx:JaTBwy4MumQA+SZewPVySiRdVtagHe
MD5:	4A7B09278208B0E56787F64988174EB4
SHA1:	E8EDDA89A3A58008B24B9E1CE77C4C24A8A786B9
SHA-256:	168A30DC51B7EBC2E355C03CB301835897840E20B4BC35020E692966BD5276D7
SHA-512:	14B66764B82A34F4B197E5B634962766996B5EF5BFD477A9F12219CA1EEE5E6F9F72A43CF762B8BFCBB0A649B8EAFF66492A359340DDF6051378FEDC49F66E01
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@}.........._S......_C.....).s...../......_@....._R....._V....Rich...........................PE..L.....IH...........!.....p...P..............................................................................................t...(...................................0...............................@...@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\Portuguese.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (608), with CRLF line terminators
Category:	dropped
Size (bytes):	20609
Entropy (8bit):	5.303316610476192
Encrypted:	false
SSDEEP:	384:Lt+pM8Bn0/lMDqqei6Y2jRczrf52xWiHnBND/yt0UCjPNx8eH3vNLl5lH:LtqpBn7Dqqx2KzrUIiHnA0UCjPNx8eHr
MD5:	028565F0658C80C2F46BCA507D1E2C8C
SHA1:	E60086E517C785D224968D0E1DB079037F39AEF4
SHA-256:	C1085F81888467ADC610840302864B3C80DF3A0DFB34EF4D9CA27D53D10FC40C
SHA-512:	A350EFC8BB40C83DB3E2A494A1E1D2A9CEC2F8390D69D009C64984883DBCE83F9BB5BB84BD60AA6DCDA5D823ACB065E2664D07039D29C4EABF4740614A81581C
Malicious:	false
Preview:	<?xml version="1.0" ?>..<root>.. <FileVersion>0.5</FileVersion>.. <Date>Data</Date>.. <Time>Hora</Time>...<Description>Descri..o</Description>...<Summary>Resumo</Summary>...<Location>Local</Location>...<Delete>Deletar</Delete>...<MaxVelocityAngle>.ngulo M.ximo da Velocidade</MaxVelocityAngle>...<Year>Ano</Year>...<Month>M.s</Month>...<Day>Dia</Day>...<Hour>Hora</Hour>...<Minute>Minuto</Minute>...<Second>Segundo</Second>...<Years>Anos</Years>...<Months>Meses</Months>...<Days>Dias</Days>...<Hours>Horas</Hours>...<Minutes>Minutos</Minutes>...<Seconds>Segundos</Seconds>...<January>Janeiro</January>...<February>Fevereiro</February>...<March>Mar.o</March>...<April>Abril</April>...<May>Maio</May>...<June>Junho</June>...<July>Julho</July>...<August>Agosto</August>...<September>Setembro</September>...<October>Outubro</October>...<November>Novembro</November>...<December>Dezembro</December>.....<FlowExportStartTitle>SonTek FlowTracker</FlowExportStartTitle>...<AboutFlowTrackerSoftwareTi

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\Spanish.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (512), with CRLF line terminators
Category:	dropped
Size (bytes):	20204
Entropy (8bit):	5.16426909038956
Encrypted:	false
SSDEEP:	384:f/ewCMClSbIXgWDUoJNpzY+3yuIjLxbnXqiHn6tFPii1Xc1tT7WXHIvLin5m4:f/eZ5lSOnDHJLY+iu456iHn2PNXc1tTw
MD5:	C2F6E6C551D56675957DD674BFB1D9E0
SHA1:	5AAE5824822D6F300FD51DB0C8ECD823D008369E
SHA-256:	F6F1A2AFBA70576DEB5DD8BA9AD960A90C02622D0D832E0E070213B1B68BF28A
SHA-512:	09A67AD92C6A978B26A90DB6CFC9E275142EFFB987BB352A61A24695784F1A20B2128DF8276AD56B784228ABFFC20CC3A44445BD7079B463800D76F434A965C3
Malicious:	false
Preview:	<?xml version="1.0" ?>..<root>...<FileVersion>0.5</FileVersion>.. <Date>Fecha</Date>.. <Time>Hora</Time>...<Description>Descripcion</Description>...<Summary>Resumen</Summary>...<Location>Punto de aforo</Location>...<Delete>Borrar</Delete>...<MaxVelocityAngle>Angulo velocidad max</MaxVelocityAngle>...<Year>A.o</Year>...<Month>Mes</Month>...<Day>Dia</Day>...<Hour>Hora</Hour>...<Minute>Minuto</Minute>...<Second>Segundo</Second>...<Years>A.os</Years>...<Months>Meses</Months>...<Days>Dias</Days>...<Hours>Horas</Hours>...<Minutes>Minutos</Minutes>...<Seconds>Segundos</Seconds>...<January>Enero</January>...<February>Febrero</February>...<March>Marzo</March>...<April>Abril</April>...<May>Mayo</May>...<June>Junio</June>...<July>Julio</July>...<August>Agosto</August>...<September>Septiembre</September>...<October>Octubre</October>...<November>Noviembre</November>...<December>Diciembre</December>...<FlowExportStartTitle>Flowtracker de Sontek</FlowExportStartTitle>...<AboutFlowTrackerSoftwareT

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Base.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	307200
Entropy (8bit):	6.20233098972016
Encrypted:	false
SSDEEP:	6144:aB0Wc4iTKimSC6OIvEnSOATwizYtsdhfSRS3AS1LG8SNaBD6I:aB0W5uq6OIvERvI
MD5:	69E90E05DC57D1C96AF7099C45E28B11
SHA1:	E7FC7A89E17BC79EE77CB96CAE4123301C78CA23
SHA-256:	06ABA67859E8ACBB6C46F92F75EF894D2E8BE3BBD3E29CD7BA3DB41276A1DF30
SHA-512:	A1CBB37CD1C8FAEE9D404D1BDC14D51AC3186351A22FD198F53B09D4047313118BF750621E54DE47725AC19E85DC4DFFC010C7E2BBB11E82146C877D5DBB54D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.m.............2}x.......}.....2}~......\......^.............2}n.....2}m.....2}y.....2}......2}{.....Rich............PE..L....8.F...........!................................................................*z..............................0x......(h...............................p.. A.. ...................................@............................................text............................... ..`.rdata..............................@..@.data...xY.......P..................@....rsrc...............................@..@.reloc..JM...p...P...`..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Communications.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	5.838746413839895
Encrypted:	false
SSDEEP:	3072:t3a0/Z1coGpCAsDiiqwEhlV1S/4bH2Lv2OA6nGCO5L:s04oGL1iqhatT2OA6nG
MD5:	8FAB2BD31B0D0E5F6BA9A834B1F92FFA
SHA1:	DE84D754C473250066FB6511FBE66C25B820824C
SHA-256:	0BF654A62D5C031256B24F90C9EE48470591AD7C157D7F41DA336DB714EE087F
SHA-512:	FBE72B9BE2754703E694BE316D2D77335FD1218EF61AE58FD1825272A0938D02B49A5BF47EE26F796B3B30E769D08A062EE2FA13748CD8BF2CDFC239D77263E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ g.ZA..ZA..ZA..}.r.^A...w.YA..}.d.WA..}.t.]A..NV.YA..ZA..A..NT.KA..}.g.BA..}.s.[A..}.u.[A..}.q.[A..RichZA..........PE..L....8.F...........!.....0...0......,(.......@...............................p.......Y..............................`...................W...................@......`C...............................W..@............@..(............................text....,.......0.................. ..`.rdata...c...@...p...@..............@..@.data....(.......0..................@....rsrc....W.......`..................@..@.reloc...#...@...0...@..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Graphics.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	638976
Entropy (8bit):	6.209582735880321
Encrypted:	false
SSDEEP:	12288:pDtfKXE/NrR4QRdgFcasHKD2et61k5YsYf:pBf0mgFcit6WM
MD5:	9F07E9F80968E1F4CDDC30594550BC39
SHA1:	2FB97CD38D0284AD0DD4EC8F9530F87A145832E4
SHA-256:	9BA801E7D0322376664256E199FCCCB61C7ABBA20C3A533D2D0639CFC66369DE
SHA-512:	B21E04CBACD67F9A2FA3DB6BE9B72B335773709F6B1BF5318EC05D1EBB4C2EFDB0D408B3E4B899EB52CF5495385C811A0B6B362768BE7D418292132D79EE0F81
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................-...../...../...../.....E.....E............/...../...../...../.....Rich....................PE..L....8.F...........!.....0...................@.......................................................................................................................E..................................@............@..d............................text............0.................. ..`.rdata.......@.......@..............@..@.data...4.... ....... ..............@....rsrc...............................@..@.reloc..~...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUI.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	667648
Entropy (8bit):	6.199120036182562
Encrypted:	false
SSDEEP:	12288:hLILvbrVkUuj9XMVMMmdzI1eho3vGSmUbJVIsABo:hLILvb5ju58VM/zI1eho3vG4v
MD5:	1D35FA36BE232DD95EEFEC02B050A1D2
SHA1:	F2D0239883B18925BF80DA52B5E745A177C5C649
SHA-256:	74988FA4C278BA80315C4C5F22C5E4CFC863BA040F9816AAD7156B434502BA2D
SHA-512:	9F3F642C261105EEE5B9F3AB407B191EE52816BC2D402D86A94962E9E03822971014425CED7FB14390B1DA9BC285B7D316FEF5D76A6425FD563C391F1E0B3C73
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v1...b...b...b.ifb...b.kub...b.keb...b.kcb...bz.Gb...b...b..bz.Eb...b.kvb...b.kbb...b.kdb...b.k`b...bRich...b................PE..L...@9.F...........!.....@...................P...............................p......................................Pt.......U..........p........................r..@V..............................0...@............P...............................text....=.......@.................. ..`.rdata...%...P...0...P..............@..@.data...L{.......@..................@....rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUtils.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393216
Entropy (8bit):	6.19072532341754
Encrypted:	false
SSDEEP:	6144:cM0AZB6yEUceyxcJHbdhZFpof+8TKGauZd7nrjZcfhrOAyhuGEOUv:t2UPpofluGauj7nrnx2v
MD5:	2A382FB9BD90D77CD079AC56973CBFF8
SHA1:	6B968C0A8C1B736BCBB0B01D0E7135A23E368000
SHA-256:	D6A03181DD4921ACEF5692E1016ACE9CD0EE9C79DFC42274816CF89CFE40F75E
SHA-512:	CEEDA642821DB0537BB05D169FFFC1520E04D76AAA54E3A8A545C29309C270994A39592FBD54EE1655F4E229AFE1E700E583CFA9975AAB2FB0920423F22703AE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.L..m...m...m.O.....m.......m.......m.......m...2...m...0...m...l...m.......m.......m.......m.......m.Rich..m.........................PE..L....8.F...........!.........0.......r........................................................................................................................<E......................................@...............4............................text...\........................... ..`.rdata..............................@..@.data...LF.......@..................@....rsrc...............................@..@.reloc..~a.......p..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommunications.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.09790982282442
Encrypted:	false
SSDEEP:	3072:gs6Lg4nQZzMNc1jM6w9z1A71yTSStR0eR6XL6NmJ7H7nKHl5eqj+COAWApmGTF/P:Fvl9jMRbtR0YIql5b+COAWAoK
MD5:	2AFB684DED354EB0ACF6CB9855CBEA7E
SHA1:	CB70DD8D88AB7D2B961FE2F5604E4083B4FA7CEC
SHA-256:	EEFBE8D69B2095988629FDC2FBF6B516DB7C32442E01226382B8FD7B7BBDD389
SHA-512:	9B72DAD091CBCB57ADA504E57BFED76CE117F3E311B609077A9BCDF624E141F8B88CAED8F6B508B47B2D95877527625F1223C50DE90C94DE5B25B6E76DEB90F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.-w#.C$#.C$#.C$.L=$ .C$.N.$-.C$.N>$$.C$.N8$'.C$...$ .C$...$..C$#.B$..C$.N-$8.C$.N9$".C$.N?$".C$.N;$".C$Rich#.C$........................PE..L....8.F...........!.....P..........!/.......`......................................r................................................@...\|......................T0...b..................................@............`...............................text....I.......P.................. ..`.rdata.......`.......`..............@..@.data....=.......@..................@....rsrc....\|...@.......@..............@..@.reloc...9.......@..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDTP.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	483328
Entropy (8bit):	6.40938050848366
Encrypted:	false
SSDEEP:	6144:MAwOWxa0l7v3bkFHl1/fDdkKmq71AFmjYVFN6sFyio2HWFWu69XOHQ/rhFP1nZtt:vtWxa0l7YnswR/JlQEQaDodCJBVUDd
MD5:	5E0A2F8140FD8E8FC6312DB36A567410
SHA1:	8638498B51C197FA1777106CE37435CCBA862BDA
SHA-256:	90FA6A759519EF00085B850B339CD13C41874F91DB9AA4EDA503AF2877D986D6
SHA-512:	1AE2BF5E5145D55A9921D128581804D912A797D243A0C31544550554945A580DCDC293373D6B52E7071CF54815EE9E981EF9B023B120B7E8746242C764FCE220
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q..............[......2Y......2Y......2Y..........................2Y..6...2Y......2Y......2Y......Rich....................PE..L....8.F...........!.....P..........*%.......`...............................`.......K...............................#......`...........$f......................0R...b..................................@............`...............................text....I.......P.................. ..`.rdata.......`.......`..............@..@.data...<O...0...P...0..............@....rsrc...$f.......p..................@..@.reloc...f.......p..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonData.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	651264
Entropy (8bit):	6.305804975760177
Encrypted:	false
SSDEEP:	12288:LbobSc8UkuMV/fUWTX5YcT6pCPEbih6OkNOTa+IUnBd956+IxS:LbobSc8UkH+WTX5YcT6pCPEbih6OkkT3
MD5:	25716517ED048186D2A683576572BE0D
SHA1:	E0A891308082DE95CA3238049C3FA90A7FD4F3E0
SHA-256:	A4B0A3FD7153832CFFD82A46405879D3B5FA6437F54955623879B008883C39B8
SHA-512:	37DB540CCB125A35E462BA83DC0DE24A29DF8B99CE34359917ACBEA8E8258C590EF0BF7952BAE3DBC2726DAAF252EF0D49BE490D89E5EE1198004187BEA8253C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._..Q_..Q_..Q. .Q\..Qx".QQ..Qx".QX..Qx".Q[..Q..QZ..Q..QP..Q_..Q...Qx".Qt..Qx".Q^..Qx".Q^..Qx".Q^..QRich_..Q........................PE..L....8.F...........!..... ..........q........0......................................................................`j.......Y..........hW...................`...s..`3..................................@............0...............................text............ .................. ..`.rdata...;...0...@...0..............@..@.data...,....p.......p..............@....rsrc...hW.......`..................@..@.reloc......`.......`..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataBrowser.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	339968
Entropy (8bit):	5.7863184367263285
Encrypted:	false
SSDEEP:	6144:vJKqt5rCBWLWKH8mP2chISvgEDnfOAxLPNK7Txtp7vJezqB+:vPGBWQchISv7I7Mi+
MD5:	DA515C682FC82661ECFB32BCD864B8BD
SHA1:	FC3CD0D0CD3FDCB9B41AC0E6D9B26670B99A730F
SHA-256:	DE17455A176FBDE4A93E56B84D1E9E6799B32CE5C95F6CD51A55276F68110C4F
SHA-512:	55E0877C9C3E9FE35B0A24C26A0A0958B845C421AD997181F4BA5C103FD53A35DEE7E7DBA27918A0D06E0D05E0352BEDFC01619010E11C85A1477FCEDB1F5AB6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3^..]...]...].s9#...]..;0...]..; ...]..;&...].'.....].'.....]...\...]..;3...]..;'...]..;!...]..;%...].Rich..].........................PE..L...J9.F...........!.....p..........1O.......................................0......tJ...............................&......$........`...C.......................2..................................H...@............................................text...lk.......p.................. ..`.rdata..............................@..@.data....*...0...0...0..............@....rsrc....C...`...P...`..............@..@.reloc..`s..........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataControls.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	397312
Entropy (8bit):	5.887975696689572
Encrypted:	false
SSDEEP:	6144:QVoHRVOG9OSbPfE5zyvw26ssvMVOAMEa8muAB6CDhtZZDK:QVoPOG9fXE5zYw2yvXtZZDK
MD5:	4F2B0F1ECA84D6C1609735BF364B8F56
SHA1:	9088A89C3D08122834EAB09D6878AECDBFD09EFF
SHA-256:	8E844ED14D35C098653283A70040ADE3E97F87F7F17D644B33278EEEB98AA312
SHA-512:	C6134D0731ECE51762D345886F114D9690DFC122235572C660281732F0E6DFE86F2D87910D3CFD82BC0E90732975AC926E33C7DC2D0B8A5DD735B5645359C801
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}..B9.f.9.f.9.f..y..=.f..{..7.f..{..?.f..{..=.f...9.=.f...;.(.f.9.g...f..{..'.f..{..8.f..{..8.f..{..8.f.Rich9.f.........................PE..L...V9.F...........!......................... ............................... ..............................................d........`..H-......................LF.. %...............................T..@............ ...............................text...\|........................... ..`.rdata..n.... ....... ..............@..@.data....P.......P..................@....rsrc...H-...`...0...P..............@..@.reloc.............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataExport.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	303104
Entropy (8bit):	5.906201359834735
Encrypted:	false
SSDEEP:	6144:UXohT/L1eGi0Kg970Pk4VfDOA7ZJtdrHHdtJHl:fhDkAKI0PZtJHl
MD5:	B6A36CC7B5FDB482CE326939FA9AE706
SHA1:	34D4BE98BF2CF0A6E4868C5D9ECE9AEE07425E07
SHA-256:	10FB467A7494CE143313CEFAB330FBF6319A0382FC40DD87F8D27A63849DF094
SHA-512:	C1A82F3B8604FE203825F95CD134327067F9C971975CFC5EB7F820EF6F0630E4AB65C1955B5F2060B1987BAF2CBC3BA44926589EADDA8ED9696FC87823CD3839
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........vP.g%P.g%P.g%.e.%R.g%wg.%].g%wg.%U.g%wg.%T.g%..8%R.g%..:%A.g%P.f%_.g%wg.%H.g%wg.%Q.g%wg.%Q.g%wg.%Q.g%RichP.g%................PE..L....9.F...........!.....`...0......a4.......p......................................h.......................................0........0...%...................`...+..`t..............................p...@............p..$............................text...,R.......`.................. ..`.rdata.......p.......p..............@..@.data...0)....... ..................@....rsrc....%...0...0... ..............@..@.reloc..vN...`...P...P..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataLib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	5.797059640317112
Encrypted:	false
SSDEEP:	3072:vnup0EaIaT/NMkOL/doWFIGvxZYMIickbMCuqCEVEXxElOAlLa8DyYfCvdTa9jfw:2p0Lxsd3FHFulEVVlOAA8DyY6vdmJyD
MD5:	E29356BFBB25D21051690214BE809F08
SHA1:	08B08883F7B109B6714E5E8269D23D615AE7E393
SHA-256:	DE08DFE45F73E7BCABC59CF6795DB102CE2C441DB3342AA2BB8788A0CBDCAEF7
SHA-512:	A08538F29C369DB406639084327354A4F8EE5AD90253887E4AEADD8F04D7DA197A2F437732D5FC518C5C75BE9DF0E35A7E51190CBC389889C60273EEA1846021
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d..7..7..7IZ.7..7.X.7..7.X.7..7.X.7..7...7..7...7..7..7C..7.X.7..7.X.7..7.X.7..7.X.7..7Rich..7........................PE..L....8.F...........!.....p..........1\...............................................J...............................................@.......................`...%......................................@...............P............................text...\|g.......p.................. ..`.rdata...w..........................@..@.data....0.......0..................@....rsrc........@... ...0..............@..@.reloc..N/...`...0...P..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataProcessing.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	684032
Entropy (8bit):	6.136963094564791
Encrypted:	false
SSDEEP:	12288:LEsHpVuVlu9OKEHWhSWxUYHX7OPyCRknA0:LfHpVuT2EHW3UkrOqqkn
MD5:	BC6F5A02A651A620DF56CDD72638A0F6
SHA1:	FD0AED20F0ABE24F7570EA759646D219C0C27CE0
SHA-256:	62779BC0EB4E707D1120976DF080EC300722838FE13948CB1F2269188776D752
SHA-512:	134E27E1C301B6CAE28799E23822701CB09AB8FE8B49061E3824927D6D56E21BB0C64BE668E3BC9101CB79A1B1B8E533077670E7EF50CC35FB766591EB4FA6E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aZg.%;..%;..%;....w.&;....d.+;....t.";....r.!;...4V.!;...4T.7;......&;..%;..I:....g..;....s.$;....u.$;....q.$;..Rich%;..................PE..L...-9.F...........!.................n..............................................=-..............................@c.......D.......................................................................D..@............................................text............................... ..`.rdata..............................@..@.data........p.......p..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataUI.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	835584
Entropy (8bit):	6.171404545506733
Encrypted:	false
SSDEEP:	12288:IlrBGwHqswKmxtjTUzTVFSYM4+kxP73KRWykkwTd3xDEQoq2:IlrBGFswKmxtjTUzTOYM4+kxAWh//e
MD5:	7B04058AC75418EC01775015D51E81EE
SHA1:	D5F8FEBEEAA5F48BE16C15A460E82BE8AF99168D
SHA-256:	C5FDAB346E5040529FCB6DC733B6D9CDE53071692E0E779B41E6FB7955233B75
SHA-512:	5D5DE47AEEF55DCAAD3AAE69693F02FBCA573242D7ACB8F00FD619D8E55E683E5A10FF4B78116A7A34EAFF6FAAA1D00C9D3C29345619242145537EE656BC6710
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.uN@.&N@.&N@.&..&K@.&i..&@@.&i..&H@.&i..&J@.&.O.&J@.&.O.&]@.&N@.&.A.&i..&f@.&i..&O@.&i..&O@.&i..&O@.&RichN@.&........PE..L...-9.F...........!.................................................................4...............................l.......O..................................0...................................(...@...............T............................text............................... ..`.rdata..X...........................@..@.data...T{...p.......p..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDiag.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	258048
Entropy (8bit):	6.0343694556862735
Encrypted:	false
SSDEEP:	6144:Ss+s71F1dKNHp9G5p1iXnMrkYo/VlrW6mhLOgAGD:SsLxFwSRiXD/PbmP
MD5:	EE68F9C89B3A0D8C3D0E8DB2F47AEB78
SHA1:	1A76D5DE1452C1165FA30A3E48C5B231204405CD
SHA-256:	BFC100A397320E8484A3523C37C057675DDA9E353B7F16931CBC26EF7E5FFF8F
SHA-512:	70F39DC626E9F1CF619E8BCA23A9071B0CCB8973C777F243C1A3CE7300FB3BB057955AF6712F82CDD48ED97FA32E4B875AE8F0669BBBCEA85ADE76620A8E05CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........j...j...j....@..n...MB..g...MB..o...MB..n.....h.....y...j...{...MB..H...MB..k...MB..k...MB..k...Richj...........PE..L....9.F...........!.........P.......k...............................................7.............................. )......H........`..\|2...................... +..`...................................@...............0............................text...l........................... ..`.rdata.............................@..@.data....!...0... ...0..............@....rsrc...\|2...`...@...P..............@..@.reloc.."Q.......`..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	659456
Entropy (8bit):	6.2012280955223575
Encrypted:	false
SSDEEP:	12288:ds9EW60JlPGqXYrsQsW94Aa59tB2vfYBKrCnYKhPEEsJqgQK+2EBdNAo/b7irY74:ds9EW60TSfYYTOPEETgQDlYo9
MD5:	06C01A5F40D1074D8E0633ED8F0C6F6D
SHA1:	72E170AF8EB7F49852FA1B32813126BF7A3F7A16
SHA-256:	902FA6E0B75A36B76DF8DE33E70F5221E58DEAF5DA51C20C90D9243E214941B9
SHA-512:	6DDF8224A3ED1EA5687D417B8672452F8BCE916E9410C576FC7406032D86200A6C61F0AEFB5F342CCE88C012BE1914A17B4476F5D1F004A980C113A54692EA8B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+..x..x..xt..x..x.,.x..x.,.x..x.,.x..x ..x..x ..x..x..x*.x.,.x..x.,.x..x.,.x..x.,.x..xRich..x................PE..L....9.F...........!.....`...................p............................... ......t................................................`...........................g..Ps..............................x...@............p...............................text...LW.......`.................. ..`.rdata..8%...p...0...p..............@..@.data...............................@....rsrc........`...0...P..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	5.782346598358851
Encrypted:	false
SSDEEP:	3072:BAL1y9ftFjo7Ie9Lrm6nxhZZSwJB7OA9mfwblw:eBWFjQIuL9tZjB7OA9Swxw
MD5:	01C78600161546ECB25C7078BE2924DA
SHA1:	33CA96F3FB61DEBBF650205414CCEAB91469E811
SHA-256:	FEE28832CF2C7AB27FA89D9C8659AFB72B1FF8196DBE678595373BF10B800D16
SHA-512:	83B68EF5084CBB4D01846AEB8C332D7F11B36BC1E03CCDF977A87F31EA01AE9D2C8F00FF9EA73430FEEFDB147294CFA0BE253BF6705154955B8D62E0A12CDAD7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v.j...j...j....Gf.k...MEu.g...MEe.o...MEc.n.....G.i.....E.g...j.......MEv.\|...MEb.k...MEd.k...ME`.k...Richj...........PE..L....8.F...........!..... ..........1........0...............................@......J....................................................C...........................2...............................E..@............0..`............................text............ .................. ..`.rdata...]...0...`...0..............@..@.data....'.......0..................@....rsrc....C.......P..................@..@.reloc...".......0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScriptLib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	5.351498893762198
Encrypted:	false
SSDEEP:	1536:Q3oYa/Vfnxlo21yp7i+tNzOS/SrNOAjSoPy7Lr1YthdKeu1jW95IY1IGqdNeqN:Qo/1xzyRiyzOa2NOAjSGocCvd0q
MD5:	D3855857A2ACB38260667E82E4EDA805
SHA1:	CB1A50761198879E14BABE4000A77367AA520560
SHA-256:	0E20B3C6BE85765A602A5C065F099B9F01DFF46E5D63802109931193CF2C65F0
SHA-512:	C6B1D9ABEDCB0F744E658C0ED86737DE51DE7725F7D8215C4C577332C9BBD79BF963E04DD8DA20FED540E15AF6225B6116A2D05C6D4C9B66C030BB838DEC8028
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+.G.E.G.E.G.E.`y>.E.E..{;.F.E.`y(.J.E.`y8.B.E.....E.E.....J.E.G.D..E.`y+.W.E.`y?.F.E.`y9.F.E.`y=.F.E.RichG.E.........PE..L...^9.F...........!.........`.........................................................................................................$........................... ...................................@............................................text...m........................... ..`.rdata...(.......0..................@..@.data...............................@....rsrc...$...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonUsb.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.81015113497449
Encrypted:	false
SSDEEP:	3072:wA6P0GmumM2YSPM8Sdcwhmnz0lOAq7meSu:VdBumM2hr4hDlOAqRN
MD5:	43C23AEF78D46574B38B7153BD74EE30
SHA1:	30DC4BA5BC97508F85D0635BE12AD3F88B64D612
SHA-256:	0C259DA1CC20F83C13D41580665FF1F27C525B1DC0753562513572BE189E4FF2
SHA-512:	56B8BF6D75080C1983CFF38BAF7DCB533FA92E6C9702CB910F2C720A2AE768BF816C696A376F8E54D9007898D0530E5EBFE9DB8E949DD516F2AF54A8EB9D7BB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X..X..X.....X.."...X.....X..vW..X..vW..X..X..pX.....X.....X.....X.....X.....X..Rich.X..................PE..L....8.F...........!.................................................................?..............................p.......l".......`.. ;......................p...................................h...@...............@............................text............................... ..`.rdata..%?.......@..................@..@.data.... ...0.......0..............@....rsrc... ;...`...@...@..............@..@.reloc..v".......0..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\UI.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	634880
Entropy (8bit):	6.16088430715694
Encrypted:	false
SSDEEP:	12288:0jCfjFAtBA/78QmbkpoVz4PIY1WvtHe2kO:pAtBIgQikWVz4PIY1ide2
MD5:	4ED3AE7034CD182BA951FB9492AD6629
SHA1:	BD0487E7246619328DE811AFC9683A35164F1BDB
SHA-256:	52300FB1694A48489B8B7ACB9CAD8C5667EBE64DB7AA35E54C19D6422F6CCC29
SHA-512:	65E5322EB9F50CEA26A848373F1B01A231D73EC71B4CAE3C0D52F0ACBEEC9B9A8A4A0422FF8ED2E8695BEAA5E0BEC168C248B074F421F9179286A2E3C07339B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................o...........................;......;.......................................Rich...........................PE..L....8.F...........!.....p...0.......$...............................................................................5......t...........0.......................$...................................h...@............................................text....i.......p.................. ..`.rdata..A...........................@..@.data.......@.......@..............@....rsrc...0...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\YsiPlatform.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	401408
Entropy (8bit):	5.966360980636349
Encrypted:	false
SSDEEP:	6144:V/jg4+BajS0y+vBsCc8cdiRUtHvOAzaQYMx+mua/:NgkjSP+5RcPiRiqa
MD5:	E0FD3C09209F0F787F404DF5791591A3
SHA1:	7CC373BE04486248031C562B6CEFFB0420AFE2BD
SHA-256:	9CB4EAF8F865B916F526748D92EC2CA1FDD591BD2E0F6D64CD2282F4F96589E3
SHA-512:	2BCF5CFD4AFBC84344125A0C83D233C5ABE6E4F106EC910C1675C0AC1283789D80FBA111918763C022554547B782DEC1876C910760DF579A1050D96D41F23056
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........l...?...?...?bs.?...?.q.?...?.q.?.?6..?...?6..?.?...?,..?.q.?..?.q.?...?.q.?...?.q.?...?.q.?...?Rich...?........PE..L....9.F...........!................A........................................0.......................................................P...v.......................A.. ................................S..@............................................text............................... ..`.rdata..:...........................@..@.data....V.......P..................@....rsrc....v...P.......@..............@..@.reloc...T.......`..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\ADV.def

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8289
Entropy (8bit):	4.439326516117064
Encrypted:	false
SSDEEP:	96:QVaM1iX9aYfMGBGeXVzN05LB0Y/9uowxEftd2c9ck37r3O:QUM1iXi8X+Y6Vdmk37TO
MD5:	C3994A4BCA1FFA077865B224F60EB19E
SHA1:	D2802F4DDD0FAB5AFF1115042F1FD42F049F3369
SHA-256:	D002D68CCA14A2772EBEF20B1F8FBE7B9BFFADEA84994E29D8B74E6BB8D090F3
SHA-512:	10E2BACAFDF60FDF0FD89678EF07F1CD7390301F9BBFB7B451BBCBD4AD2E2C7FDEBBADBA743221E091D9BE35CE9502AA09AD53DEC7D20459F59EB29E0C95A8FA
Malicious:	false
Preview:	Structure DruckConfiguration {.. char SerNum[10];.. double F0; // Frequency of Druck/Paros sampling board.. double X;.. double Y;.. double T0;.. double D0;.. double DTslope;.. double K[24];..} ....// Structure SystemConfigProbe..Structure SystemConfigProbe..{...byte.SoftwareVersion;...byte.DspSoftwareVersion;...char SystemType; // 0-10MHz, 5cm 1-10MHz, 10cm 2-OCEAN...char SensorOrientation; // 0-down; 1-up; 2-side ...char CompassInstalled; // 0-No; 1-Yes ...char RecorderInstalled; // 0-No; 1-Yes ...char TemperatureInstalled; // 0-No; 1-Yes ...char PressureInstalled; // 0-No; 1-Yes ...long PressScale; // nano bar per count ...long PressOffset; // micro bar ...short CompassOffset; // Degress to East of Nor

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\ADV6600.def

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5483
Entropy (8bit):	3.526853234763775
Encrypted:	false
SSDEEP:	48:bXEX+LoYvyX9mQv8tuFmnlKP/FIGEjNaWYZni22xcfQkuvtF57e/F57uX5wU7K:bf6X98tKmlINyJ0nJAvleNluX5wb
MD5:	2A26D6C9C2DFAF8C5F1EA6091F154720
SHA1:	421C128D686F762DF11A45C36FD43AD3D074F596
SHA-256:	53C4F411B62C8FE1011DB07A0A0CF80B6A3A0F242DC9FF81F9373693FBBC5AFC
SHA-512:	50FB729585436DE3FFF51AB69CFE1433552CCA46E1AF7FA0009B780BBB28A73E47FEF18AF568A2016C03919A3642700C92E097191CA3D87870FC333C0662F963
Malicious:	false
Preview:	....// Structure SysConf..Structure SysConf..{.. BYTE SoftwareVersion ; // Ver number of ADCM firmware .. BYTE DspSoftwareVersion ; // Ver number of DSP firmware .. char BoardRevision ; // Electronics board revision .. char SerialNumber[10] ; // Sensor serial number .. char NumberOfBeams ; // 2, 3, or 4 .. char BeamGeometry ; // 0- 2 Beams; 1- 3 Beams .. char SensorOrientation ; // 0-down; 1-up; 2-side .. short XformMat[16] ; // From Beam to XYZ veloc. .. short CompassOffset ; // Degress to East of North .. long PressScale ; // Nanobar per count .. long PressOffset ; // Microbar .. short PressScale_2 ;

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\Argonaut.def

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8316
Entropy (8bit):	3.6989261677196468
Encrypted:	false
SSDEEP:	96:zp+xIzyaH1vewJjXL8zRBSxrqI+LUIesNMmnDPqgCf/K7r4q6KbGMZ5qfQx:6Iz7H1vemfEuxezKTwDPqgCK7IMZ5q4x
MD5:	C7DD88DB9B41479D57D7630D58859F2D
SHA1:	D94F5F7602F6F0CBCCA630B5A03A8D4519BB41F9
SHA-256:	BE5F20D9D4400BC30C847D5262B785F27CEFABDE05096FCA3ACC2A8263EBAE94
SHA-512:	B44C5332FCD46DEE5C2919DB4708C355C9177825C4828F2743892D43B83F12C45D4F49971D6DE35792DA3E3A9C4421BECC397B962F6EE6558ADA2593B8A62D41
Malicious:	false
Preview:	Structure Conf {.. char ConfigType; // Type 0x40 .. char ConfigVer; // Version 0x02 .. short Nbytes; // Bytes in configuration .. DateTime ConfigTime; // Date created or last modified .. BYTE SoftwareVersion; // Ver number of ADCM firmware .. BYTE DspSoftwareVersion; // Ver number of DSP firmware .. char BoardRevision; // Electronics board revision .. char SerialNumber[10]; // Sensor serial number .. char SystemType; // Low Nibble: 0-3MHz 1-1.5MHz .. char NumberOfBeams; // 2, 3, or 4 .. char BeamGeometry; // 0- 2 Beams; 1- 3 Beams .. short SlantAngle; // in 0.1 deg .. char SensorOrientation; // 0-down; 1-up; 2-side .. char CompassInsta

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\ArgonautADV.def

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8255
Entropy (8bit):	3.9118903952848068
Encrypted:	false
SSDEEP:	96:xp+xIzyaH1vewJjXL8z6TxrKI+LUDesNMmnD0qgC3/K7r4q6KbaPVhQcS:MIz7H1vemfEKxOz1TwD0qgCy7aS
MD5:	D6FA92228B7311BCC8409D6BA9CFB715
SHA1:	56C68177FEB6C74E14954255A7A166EF38E8FBFA
SHA-256:	2D651113347FA284879E5699AD61A3AA2095F3FA343D1C0BEBBB417B6146BE78
SHA-512:	B9005BBD609F7731AACD1E5EBAE85B1B7A130CACA6D2816B522338CA88689891C2163B8713A424105A45FE76948292E175C4E3CC3406B2A44F212CFADE7F794B
Malicious:	false
Preview:	Structure Conf {.. char ConfigType; // Type 0x40 .. char ConfigVer; // Version 0x02 .. short Nbytes; // Bytes in configuration .. DateTime ConfigTime; // Date created or last modified .. BYTE SoftwareVersion; // Ver number of ADCM firmware .. BYTE DspSoftwareVersion; // Ver number of DSP firmware .. char BoardRevision; // Electronics board revision .. char SerialNumber[10]; // Sensor serial number .. char SystemType; // Low Nibble: 0-3MHz 1-1.5MHz .. char NumberOfBeams; // 2, 3, or 4 .. char BeamGeometry; // 0- 2 Beams; 1- 3 Beams .. short SlantAngle; // in 0.1 deg .. char SensorOrientation; // 0-down; 1-up; 2-side .. char CompassInstal

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\DVL.def

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6787
Entropy (8bit):	3.717662329623051
Encrypted:	false
SSDEEP:	96:xp+dIzyaH1vewJjXL8zWBSxrqIjUIesNMmnDPqpyUs//7r4q6Kb8:CIz7H1vemfErxepTwDPq4F7S
MD5:	8FAFB51988D272281F3EE10219106621
SHA1:	3D4B17C13789322A5241EB8192622E50467D744D
SHA-256:	DD61B3DD3D97A406E701B17749F9A95975906E460F00BB569C556E7794980C33
SHA-512:	D056E43AE6C3C87ABF545897E2AF90F4B46990F39112DE062D23AE069017B79D0A0332FCDED429525C002DD775AA6B9EFC79731573D3C2E27DEFC70A3BFB5D40
Malicious:	false
Preview:	Structure Conf {.. char ConfigType; // Type 0x40 .. char ConfigVer; // Version 0x02 .. short Nbytes; // Bytes in configuration .. DateTime ConfigTime; // Date created or last modified .. BYTE SoftwareVersion; // Ver number of ADCM firmware .. BYTE DspSoftwareVersion; // Ver number of DSP firmware .. char BoardRevision; // Electronics board revision .. char SerialNumber[10]; // Sensor serial number .. char SystemType; // Low Nibble: 0-3MHz 1-1.5MHz .. char NumberOfBeams; // 2, 3, or 4 .. char BeamGeometry; // 0- 2 Beams; 1- 3 Beams .. short SlantAngle; // in 0.1 deg .. char SensorOrientation; // 0-down; 1-up; 2-side .. char CompassInstalled;

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\FlowTracker.def

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7957
Entropy (8bit):	3.789901603126659
Encrypted:	false
SSDEEP:	96:gp+xBzyaH1lewJjXL83xSxlqQd6MRNMmnYCfeqgyRX/E7rMdMGBGeXVDR:ZBz7H1lemfbxcZwrfeqg/74W8XDR
MD5:	B8D81E55C38F9381D408ABBA2FB4C2DF
SHA1:	73F591B99219597F27950330DE7250B0D0F708EB
SHA-256:	7C250AFB82617A5BAB9D87BA3535F86157610C62CDB985993586BDE0C391B4CC
SHA-512:	BF421F6729591912347BF484C4E0FB3647B3C8723877BE9B7003FDCD30F329BC813539921727856CBD2B23CC099F44A052F862A7ACCDA0A798486C13AF1F4851
Malicious:	false
Preview:	Structure AdcmConf {.. char ConfigType; // Type 0x40 .. char ConfigVer; // Version 0x02 .. short Nbytes; // Bytes in configuration .. DateTime ConfigTime; // Date created or last modified .. BYTE FirmwareVersion; // Ver number of ADCM firmware .. BYTE DspFirmwareVersion; // Ver number of DSP firmware .. char BoardRevision; // Electronics board revision .. FixedString SerialNumber[10]; // Sensor serial number .. char AdcmType; // Low Nibble: 0-3MHz 1-1.5MHz .. char NumberOfBeams; // 2, 3, or 4 .. char BeamGeometry; // 0- 2 Beams; 1- 3 Beams .. short SlantAngle; // in 0.1 deg .. char SensorOrientation; // 0-down; 1-up; 2-side .. char Com

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\FlowTracker.yts

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10746
Entropy (8bit):	4.785511126494217
Encrypted:	false
SSDEEP:	192:Hor0geMdH0hXPzSfNh0CQj69mWiknDle9pStIrMk/:HBgeMdHsG1VmyD4pIIrMk/
MD5:	33D7CD5FBA415370E118F7939EF6F1A6
SHA1:	6CAD823F5E48D90E341310C13B7E534A48E9E5B3
SHA-256:	6A4B4BBD6BE972AF62689C94215C4CA2B92959DFE2DA82A4FA47BA40846E72A5
SHA-512:	7FC1BA02D99AF4C6C936E65D042CB1F40026B7A190E471882ED15C827A801D6EC661DCF2ED22DC943CE0F9856F879257FCD2DDDFB4086CCCB57A86E32F5F06F3
Malicious:	false
Preview:	// YTS syntax..//.Array..//. - 2 or more dimensional arrays are not allowed use only 1 dimension..// Structures..//. - [embed] attribute before the struct keyword means that the structure will be used within other structures and not by itself..........struct SystemInformation {...// AdcmConf...char....ConfigType;......char....ConfigVer;......short....Nbytes;.......Time64....ConfigTime;......BYTE....FirmwareVersion;.....BYTE....DspFirmwareVersion;....char....BoardRevision;...// 1 Electronics board revision ...char....SerialNumber[10];..// 10 Sensor serial number ...char....AdcmType;....// 1 Frequency: 0=10,1=5,2=16 MHz ...char....NumberOfBeams;...// 1 2, 3, or 4 ...char....BeamGeometry;...// 1 0- 2 Beams; 1- 3 Beams ...short(deg * 0.1).SlantAngle;....// 2 in 0.1 deg ...char....SensorOrientation;..// 1 0-down; 1-up; 2-side ...char....CompassInstalled;..// 1 0-No; 1-Yes ...char....RecorderInst

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\SontekDrivers.Dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	5.516603930890568
Encrypted:	false
SSDEEP:	384:Rv05TBwF/Fb4H+AfV78tt7l39MTTgvsKmqDRQnaZzjQ+SZkLc0RaPV23riL7euZx:JaTBwy4MumQA+SZewPVySiRdVtagHe
MD5:	4A7B09278208B0E56787F64988174EB4
SHA1:	E8EDDA89A3A58008B24B9E1CE77C4C24A8A786B9
SHA-256:	168A30DC51B7EBC2E355C03CB301835897840E20B4BC35020E692966BD5276D7
SHA-512:	14B66764B82A34F4B197E5B634962766996B5EF5BFD477A9F12219CA1EEE5E6F9F72A43CF762B8BFCBB0A649B8EAFF66492A359340DDF6051378FEDC49F66E01
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@}.........._S......_C.....).s...../......_@....._R....._V....Rich...........................PE..L.....IH...........!.....p...P..............................................................................................t...(...................................0...............................@...@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\WaveDummy.def

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2172
Entropy (8bit):	4.66432435891816
Encrypted:	false
SSDEEP:	48:ot6m1TWSy7JqZM0gHxQMQmr0RTJ53E2enUGvhLS:OV1TWfJxRdYgU
MD5:	4E9E26F373CA7FFE045A9F33D55563FE
SHA1:	3F011DB2853FAD38E999E95C7390ABEAD7D8D1B1
SHA-256:	639BCE4A54EC4495C7B9547271C83460F761DBAB0FD792F7A7FEE7D43B910543
SHA-512:	907742EB079497911D2FFF3937A6EB638B920A07FB557661433724F9666E24669152341000FDAD9003ABC97E86AE0D6C762DAA0D272F06EC5A7748716F910532
Malicious:	false
Preview:	Structure Conf {...char Type;......// Type 0x40 ...char Ver;......// Version 0x02 ...short Nbytes;......// Bytes in configuration ...BYTE.CompassInstalled;...// 0-No; 1-Yes ...BYTE.RecorderInstalled; // 0-No; 1-Yes ...BYTE.TempInstalled; // 0-No; 1-Yes ...BYTE.PressInstalled; // 0-No; 1-Yes ...BYTE.CtdSensorInstalled; // MicroCat CTD Installed ...BYTE.WavesInstalled;..} ....Structure Oper {...char Type;......// Type 0x41 ...char Ver;......// Version 0x02 ...short Nbytes;......// Bytes in configuration ...char.SerialNumber[10];...char AdpType;.....// 0-3; 1-1.5; 2-750; 3-500; 4-250;5-1000;6-5000; ...char.NumberOfBeams;......// 2 or 3 or 4...char.BeamGeometry; // 0- 2 Beams; 1- 3 Beams; 2- 4 Beams, 1 Vertical ; 3- 4 Beams, Janus...short.SlantAngle;

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\_param.def

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24656
Entropy (8bit):	4.685258825908092
Encrypted:	false
SSDEEP:	192:2LgjBWOmSW0N7tf+SwxS9bV12rl3jTAFEKWOdfqeChRKvquUFXn4XvNJrYMY32I/:2LiBWOmq7tkSeOrqiUNYrnoQDhT5qlFz
MD5:	EC0F121014B6B52148C53D69ADDAD33E
SHA1:	2A86D22B7E4523C23471AFA9EFBB5D097D1F208B
SHA-256:	BEB715530C962C0029FDD9DF71F8B86685E09B6436A2F6954369C12B4990134D
SHA-512:	7514EC4E85ED5468A2D87C2A4DD4B917744630F090DCE30BEE0004A43F8DFFFF3AE65455A79656928F01651E017C72F9B6B998AC63A5400F095C034555F9410A
Malicious:	false
Preview:	;============================================================================..; File: _param.def..; Last modified: May 28, 2004 (nc)..;..;.Table to convert from parm type or sensor type to name..;..; (NC)File used for conversion of Ecoww.par entries to ZenoCompatible names..;..;..Column.Description..;..;..0..YSI official sensor ID..;..1..Parameter name..;..2..- RESERVED ("")..;..3..Parameter unit..;..4..- RESERVED ("")..;..5..Short name (9 chars or less) used in 6200 sensor record..;..6..- RESERVED ("")..;..7..Num decimal places..;..;-------------------Version 5.00 ------------------------------------------..; Revision Log:..; .03/27/06.- Renamed Param #194 from Flourescence(%FR) to Chlorophyll(RFU)..; .05/28/04.- Added BGA sensors (214-217) ..; .05/28/04.- Changed Optical DO designation from "DO+" to "ODO" ..;..; .05/28/04.- Added TSS- (514-516) and Cl2 (210) ..;.05/05/04.- Added parameters for TSS+ calcs..;.04/06/04.- Changed PAR units from none to uMoles &..;

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\_units.def

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3309
Entropy (8bit):	4.819926804900787
Encrypted:	false
SSDEEP:	96:Pe18Pgg2P/UPCgXPfZWm+OLawakrYVS7CwCPuX+C04a0C+UPe4Z+8zY:PkRgWJgXPfZWmzLXa68S7ZtX+CvaR+UM
MD5:	FF8B8639365E46A25840FA8C97CED7B4
SHA1:	C0B95EC9C2089A716C5081E6A1FDE591CAEB3A73
SHA-256:	01D2FE7494BFD254D44CA9FB6C4E31DE0C6ADB5F8C8AB1AE08F888F4BD5CF01E
SHA-512:	6F02E8E49EEB8E80DC4F696E65E7F97E7022ABDCC55D32371B2716CD603838877CF04B0983DEDE17115390E6FDEBF79FA181A986B82743EF2339AD68636EFAA1
Malicious:	false
Preview:	[m/s]..LongName=meters/second..EnglishUnit=ft/s..BaseUnit=..Multiplier=1..Offset=0..MetricUnit=..Precision=2..[mm/s]..Name=mm/s..LongName=millimeter/second..Multiplier=1000..BaseUnit=m/s..Offset=0..EnglishUnit=ft/s..Precision=2..MetricUnit=..[m]..LongName=meter..BaseUnit=..Multiplier=1..Offset=0..EnglishUnit=ft..MetricUnit=..Precision=2..Alias=meters..[cm]..LongName=centimeter..BaseUnit=m..Multiplier=100..Offset=0..EnglishUnit=inch..Precision=2..MetricUnit=..[mm]..LongName=millimeter..BaseUnit=m..Multiplier=1000..Offset=0..EnglishUnit=inch..Precision=2..MetricUnit=..[ft]..LongName=foot..BaseUnit=m..Multiplier=3.28084..Offset=0..EnglishUnit=..MetricUnit=m..Precision=2..[inch]..LongName=inch..BaseUnit=m..Multiplier=39.37007874..Offset=0..EnglishUnit=..MetricUnit=cm..Precision=2..[yard]..LongName=yard..BaseUnit=m..Multiplier=1.093613298..Offset=0..EnglishUnit=..MetricUnit=m..Precision=2..[C]..LongName=deg C..BaseUnit=..Multiplier=1..Offset=0..EnglishUnit=F..MetricUnit=..Precision=2..[F]..

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Drivers2\drivers2.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	5331
Entropy (8bit):	5.402182010954385
Encrypted:	false
SSDEEP:	96:LQzOuxdnsAxC1o4ehphPoIk1EaemHwrRrx7usRsjZMzMPwTz6X+3HRAZVmmhWMiH:MzDxhlC3aoIwEaemHwrRrIs/oPwTGXi/
MD5:	972BF05E306B2697A25EED97FCCD0846
SHA1:	E9B6EEC2A91B70FA179416C3759893AB0FE20109
SHA-256:	ACE18354AB4BBDC4B375B7986CBEB908703B1ECE39BC49DE4D60D1E5493633AF
SHA-512:	BAF4C65783F65D34312597385AE33D8E481D874363414F09A6AE3FE16DF7DAAF0605F0CC375812B4EA9DCB5AA0BAC7D0267FBB61A63C3106B2406B3326214A8B
Malicious:	false
Preview:	[{178057DB-0984-4EDF-AA19-D707204827F2}]..Type=Realtime..CLSID={178057DB-0984-4EDF-AA19-D707204827F2}..InstrumentType=ADV..[{C35DADCD-C5E1-44AD-B7FB-D73DD822BEEF}]..Type=FileImport..CLSID={C35DADCD-C5E1-44AD-B7FB-D73DD822BEEF}..InstrumentType=ADV..Extensions=adv..[{BF9D2AF6-4159-42AD-8DC3-A39400D8CC38}]..Type=Realtime..CLSID={BF9D2AF6-4159-42AD-8DC3-A39400D8CC38}..InstrumentType=Argonaut..[{ACD8E7DC-07FA-46B3-9218-068892D19BC5}]..Type=FileImport..CLSID={ACD8E7DC-07FA-46B3-9218-068892D19BC5}..InstrumentType=Argonaut..Extensions=arg..[{632631AC-D7ED-404A-9C93-4C3C72370B79}]..Type=Realtime..CLSID={632631AC-D7ED-404A-9C93-4C3C72370B79}..InstrumentType=ArgonautADV..[{D1C64B69-3B61-4B30-BC7C-78297F73E0C8}]..Type=FileImport..CLSID={D1C64B69-3B61-4B30-BC7C-78297F73E0C8}..InstrumentType=ArgonautADV..Extensions=arg..[{F80279A6-5955-4730-8F98-676295D73718}]..Type=FileImport..CLSID={F80279A6-5955-4730-8F98-676295D73718}..InstrumentType=FlowTracker..Extensions=arg..[{F80279A6-5955-4730-8F98-676295D

C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS1DC4B5CF7D8A44A99CDFF7A5DD359A38_2_30.MSI

Download File

Process:	C:\Users\user\Desktop\FlowTracker_Setup.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 0, Number of Characters: 0, Security: -1, Create Time/Date: Mon Jul 3 20:32:19 2006, Last Printed: Mon Jul 3 20:32:19 2006, Name of Creating Application: Wise for Windows Installer 5.2 - Professional Edition, Last Saved Time/Date: Mon Mar 23 21:42:13 2009, Title: APPNAME, Subject: APPNAME, Author: SonTek/YSI Inc., Template: ;1033, Last Saved By: SonTekRD, Revision Number: {6480B60F-D404-4E1F-B8A6-D4A8D8E57662}, Number of Pages: 200, Number of Words: 2
Category:	dropped
Size (bytes):	26413568
Entropy (8bit):	7.987530549946486
Encrypted:	false
SSDEEP:	393216:ACm39VVlR+jnX5q1wXwKK+AMCW2GxEOSyE+0avLT6GV9rtOjlr/vvAdaXJO:Ah39V7R+7ge7K+NPM+06LT5AlLYd
MD5:	E936C4D09CCDA7AA94D7475EE4FFFFEB
SHA1:	EE02E16754FC457F6D1C1CF2175532B51C00BECE
SHA-256:	65299669DB7C5304BE603B0EC14C7EC2B5963FBEC19AB3ECA19AB8654076CB49
SHA-512:	76A9D859A06B11E62F8C16BC5792040B9D3466EED7706122F152D8B0EF63ED12A1823B78C9F29C0E66A8F6390E47435C8D056D512EAA34B2773784A21105FDDF
Malicious:	false
Preview:	......................>.........................................................................../...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...{...\|...}...~...........................................................................................................................Re..............................Ke...F.............................................................................. ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Program Files (x86)\SonTek\FlowTracker\AppSettings.conf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	5923
Entropy (8bit):	4.812400097988931
Encrypted:	false
SSDEEP:	48:gE8daTBTPaT2TJTcTTcYMTcITc1TcSTbTBTITRTyTrTMTFTsTVT4TbTsTc8TNYTj:bqe5+9Pln8g05Oeihrm
MD5:	00890ACEB3ADD6E3DA60C2A6804B87AF
SHA1:	546E13ACC486A7333477E562C6982CD26D8B96F5
SHA-256:	1EB7110278DF6E7B748770D201FC16A46EA74F616B6796AA17F332FC09557F8E
SHA-512:	BF9A9C580C0F1B487F39125A6057BF19FFF2AAE509E7DC8F7B30C96B2BD5B8E17A3FF2D08896530CD842B1A7D0F84C5CA1A3984F6334A5FC20DB5A85646D7B91
Malicious:	false
Preview:	....}\|.......Units$....}\|.......UnitSystem......Columns$....}\|..Z....SampleNumber$....}\|.......DisplayUnit...Decimals......SampleTime$....}\|.......DisplayUnit...Decimals......StationNumber$....}\|.......DisplayUnit...Decimals......UseData$....}\|.......DisplayUnit...Decimals......Location1$....}\|.......DisplayUnit..m..Decimals......Location2$....}\|.......DisplayUnit..m..Decimals......WaterDepth$....}\|.......DisplayUnit..m..Decimals......MeasurementDepth$....}\|.......DisplayUnit..m..Decimals......IceDepth$....}\|.......DisplayUnit..m..Decimals......Method$....}\|.......DisplayUnit...Decimals......CorrectionFactor$....}\|.......DisplayUnit...Decimals......NumberOfLags$....}\|.......DisplayUnit...Decimals......Lags[0]$....}\|.......DisplayUnit...Decimals......Lags[1]$....}\|.......DisplayUnit...Decimals......Lags[2]$....}\|.......DisplayUnit...Decimals......Lags[3]$....}\|.......DisplayUnit...Decimals......Lags[4]$....}\|.......DisplayUnit...Decimals......Lags[5]$....}\|.......DisplayUnit...Decimals.

C:\Program Files (x86)\SonTek\FlowTracker\DemoData.wad

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	25146
Entropy (8bit):	5.249510621123513
Encrypted:	false
SSDEEP:	384:np/bynaObhrSFR/iWt5O3obdKRM2zFiEQ3N76AvrSQ6yA+:p/mnnbhBN3wdKu+iEQ3EAv+JB+
MD5:	98233D292EC083590DE6F6CC44734A49
SHA1:	09D457C367AB6B8274FEAB998BA8F8D065D50ED7
SHA-256:	7311D052B5AC3F0181A496D8C42BE88CA899201A3C62EB50AEC6D4CB0B6EBF54
SHA-512:	6BCD0C480084565EE6DAD562F00C5439901597ACD22DD45504B3ABE0C3B9DDA8D71807CDC3B68680B2A6EB81A2FB2751CF0AA9A2E4F588D7CD9089B3D4926F0B
Malicious:	false
Preview:	@.`.....%..,..EP63.......P......................\|...............................a...............A.@...............2.......................'NLL..................B...D............92.2.d..................(.......03353611...............................................................................................................................................................................................d...................P63.Y.................@.......@...P.....(.d......................................................................?.(......q=.............."...S{@..L=3.D...<....(.. .......C.........d.(.P...@.......LJJ............R....(3..... .}.f....(..F.2.........(....4.3...'....(..D.....\|~I....(..H............(..g.V...}......(....-.3........(".H...+........(U.L.4.....p....(v.y......}F....(.......}......(......".~......(......).~./....(s.....9~.}.....(4.m.:..~..l....(....0.3...%....(d.........o....(....>....~>....(..\|............(......8.\|. ....(^...F.0...

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Quick Start Guide.Chinese.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.4, 2 pages
Category:	dropped
Size (bytes):	198688
Entropy (8bit):	7.95746554784009
Encrypted:	false
SSDEEP:	3072:gIKKQ15NHLLVlAHFOPscr9mX+8T9vHiTEbB2F3ba+RXTCBHfUGSRt34OIq:gvnNdiHFgr9mO8T96ABEOyelJO54O7
MD5:	7881EA8CDE7E93D227E0E710194FDB62
SHA1:	EBC447B702727603ED6E793607F285373D28FC35
SHA-256:	7C31D3B35124BE1D996CBD2EBC2309373A88B2A7FFBF6421304B40B19846C3B8
SHA-512:	86E23186DD588D0764C4F7F237FD7259094D34E03DB7996DE695CB48CD80A0EC67513491F82B18ED433DD3259638A97FB24C685CFE1AC2D00EE7FD9051AF7678
Malicious:	false
Preview:	%PDF-1.4.%......10 0 obj <</Linearized 1/L 198688/O 14/E 183603/N 2/T 198441/H [ 1396 310]>>.endobj. ..xref..10 55..0000000016 00000 n..0000001706 00000 n..0000001396 00000 n..0000001799 00000 n..0000001928 00000 n..0000002120 00000 n..0000002144 00000 n..0000002350 00000 n..0000002667 00000 n..0000002756 00000 n..0000003947 00000 n..0000004272 00000 n..0000004569 00000 n..0000004839 00000 n..0000007296 00000 n..0000007339 00000 n..0000007381 00000 n..0000007415 00000 n..0000007543 00000 n..0000007673 00000 n..0000008260 00000 n..0000008336 00000 n..0000012465 00000 n..0000012896 00000 n..0000013047 00000 n..0000013286 00000 n..0000017301 00000 n..0000021760 00000 n..0000025508 00000 n..0000028889 00000 n..0000029332 00000 n..0000031614 00000 n..0000034751 00000 n..0000037967 00000 n..0000038137 00000 n..0000038372 00000 n..0000111096 00000 n..0000111286 00000 n..0000111515 00000 n..0000118589 00000 n..0000142359 00000 n..0000145028 00000 n..0000145080 00000 n..0000145280

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Quick Start Guide.English.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 2 pages
Category:	dropped
Size (bytes):	205750
Entropy (8bit):	7.960020323619898
Encrypted:	false
SSDEEP:	3072:kKVBTKAfhSqllFHMP2JUUg5eBqN/iNbRJXE6OYDE1YI1QY45pG2yKbT:1J3i2utFN/ifxEZDYP5Y2ysT
MD5:	B1E04A245C85F6D40F410F319FAA4DED
SHA1:	BAAEB33937CDB555E00B5D6E8E13371FB29A3429
SHA-256:	489B10B8D3DB930B04F7DCC5FE75D7CA749F1B053CB64A1B36A9D20F434DC543
SHA-512:	B45A18B196536DBBFB6CD5B172555A10FAF14D6C952E633CBD81F71CC0F8B15E58750C4A9A668FCBCE2D88303F426145BADBB1C55726D68FA5DA9D19F80C7AFC
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 38 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 34 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 12 0 R/F4 14 0 R/F5 19 0 R>>/XObject<</Image9 9 0 R/Image10 10 0 R/Meta24 24 0 R/Image25 25 0 R/Image26 26 0 R/Meta27 27 0 R/Meta28 28 0 R/Image30 30 0 R/Meta31 31 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 7862>>..stream..x..]Y...~W...<V;F...kwB.:g4..g........}...=U,.;..q.K.........u......D^H$...w..U..w.?/.lu......EY...._<...?e...-.....^....<9.#E..........O.P.K......o.....\|............B.G..g2X.......y...H.,.....e.L..i...-...G....u...9...1.{..KL...p.W...2.LC..<.C..Q.vR.x..x....?a..\|.J...J.H.....0.BG".bE....d.y^..gZ.e...ji.....a"E.....#%. D

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Quick Start Guide.French.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 2 pages
Category:	dropped
Size (bytes):	209701
Entropy (8bit):	7.970317218775828
Encrypted:	false
SSDEEP:	3072:64QBTK34YNhtj6gOODAnql7Fi5eBqN/4NbRaGQmlh3Dtc+cT5/vVV9hoyKbP:64nFJYJFN/4faG/hk/D9OysP
MD5:	171D40E35C9AD9CA586B1805CFDC380A
SHA1:	5937BF07ED2A012963750E2730E6B144119B085A
SHA-256:	D6265C25D860BCEA3AAC3164156284CB7A0EEE5E265A57C9124A726C55BE3A9E
SHA-512:	399CBACFD0D1B647E9454D55CF9B3985AAEB6D63102DE0D23450F248E02B64936050AE1BCBF4F2309CD3E6ECA2DA6E058B4CF3AE5177549105BE6564DE6CA39F
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) >>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 33 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 13 0 R/F4 15 0 R/F5 20 0 R>>/XObject<</Image9 9 0 R/Image11 11 0 R/Image12 12 0 R/Meta25 25 0 R/Image26 26 0 R/Image27 27 0 R/Image28 28 0 R/Image29 29 0 R/Meta30 30 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 8687>>..stream..x..=..Fr..?..A..B....:...Z.Lj. .......>.FS..~.~......9..p...q..+.%5.YYWVV.x...O^%Q..E....GI....(K.u".w.f..Q...>.....W.\=MW.~%W..Pqv..+y._..=~...\|...$.:S....AH...`.4^.q...6.B/"...J.e.a....i..<.I.V1.....u.F....`."7..\|........Xg.Ha...<...'_l...^..6I.5..a.Y...v.0;.$...:.....8~.=J.uV....U........?z....U.U$.2R....z....p...\|E..s..I..B....k....D.3..W..8..e...q...8....%...U.....T......

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Quick Start Guide.German.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 2 pages
Category:	dropped
Size (bytes):	220546
Entropy (8bit):	7.956928958669955
Encrypted:	false
SSDEEP:	6144:eCmYwdfhGYvOHF1FN/4fB6r+itdR+YysUDSWW7d:ejtdoY2l/N/iB6MX/W7d
MD5:	AFAF5650314FB3FF324DB7AA076C6E84
SHA1:	AE793D6D88EE47CC420E4719EF0DF63E34CEFB24
SHA-256:	0981D3FA9497BDBAF0C17DFFF4D43764EA0095E7B711C1C616635BFA0CDBBC16
SHA-512:	9827C2D03349E46060D1495B52892C3F7507178BB6210D713562D6777CC89C2C34B794C7D79F06F443B9AB4AF11D467F2F4267AA8E16F839F38108C6A636A792
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) >>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 33 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 13 0 R/F4 15 0 R/F5 20 0 R>>/XObject<</Image9 9 0 R/Image10 10 0 R/Image12 12 0 R/Meta25 25 0 R/Image26 26 0 R/Image27 27 0 R/Image28 28 0 R/Image29 29 0 R/Meta30 30 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 7982>>..stream..x..=.r.8...?..xjr"R.mjj..v'}..t...M.A......IK:.k.i.h..%..OyX.$%.BJ..U3;..@.$..$@....'._. ].<8.x...!...1.......t..I.l..O..[....Y...X..K..G,\....N.{..k@....$.:N:L.V...:...g.:.#.....<.]..d-...4.v..R...Z.....O.a......+.6.E...6......6..q.D..<@....ow.V...>...~......@.].$..q.S....... ..,...''DB...u..0.X..o.~.j..NJ.I.N...A.#.X..k`...0..'..u*...k.....A...F.!:....5J.<.Wup\|.....a'...nsu.....(Z.75..

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Quick Start Guide.Italian.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 2 pages
Category:	dropped
Size (bytes):	204558
Entropy (8bit):	7.9702892244849295
Encrypted:	false
SSDEEP:	6144:MPCaItLkItA6TuzFN/4fDS+sZNOnDYphn8ysb:MPwkIa6EN/i29ZNYYphnE
MD5:	868562F15925634BD349FC460C5E8ADE
SHA1:	FC095F3C2A09C97BC981D3936237380B7BBEB40B
SHA-256:	5160A5255F370BEC85D22B558569DED192337CD562917B9461973D78D4C264D2
SHA-512:	345CE6C9D913E1F2E5DEAD8F846F0AD8E6D4257EED679EB4EE8077B523030F0BCEEE0E5E9E0EE03CC4E6D886A257AE3DE883950277F903E957F4AA6F1167AC54
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) >>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 33 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 13 0 R/F4 15 0 R/F5 20 0 R>>/XObject<</Image9 9 0 R/Image10 10 0 R/Image12 12 0 R/Meta25 25 0 R/Image26 26 0 R/Image27 27 0 R/Image28 28 0 R/Image29 29 0 R/Meta30 30 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 7576>>..stream..x..=..8v..?.Q.5....%.r..;=..Nv..n..y.H..e%Q...Z.~.~.~.~A.....HJv..........pp..../^. ].Q........?.(..q.......0x...\|.....7......E..$....B..w.../_..t....').iz.i....,..0x...0.@..'....a.,e..JSj..-.8.UH.w^.d....t _.Co.Y.F.2.h...D.d...Uq.'0.e.....~.+..<....0..T...E.......Re.E-.\..Y...R.YP./_<....C.-U..\|..H#.....5.")%...e.....r.#..c...v.'..e*...E.f..L.4.t).U.}...m...71...a..?.....D.+....7.@%<....(

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Quick Start Guide.Japanese.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.4, 2 pages
Category:	dropped
Size (bytes):	293080
Entropy (8bit):	7.977591591639185
Encrypted:	false
SSDEEP:	6144:7v5lphhSnPCKwrE5GFfOtXuf8wopWK9uDE79XuL8Gj5KXe:7x3hsPmcuhK9u6X3GjMXe
MD5:	81AD8A2034C1538AFF21AD3CE46D9224
SHA1:	2620228EAF3C142375BA303E8DC6261E87736CDC
SHA-256:	07E44ADB8EF2F9A6289EC051FC921BE8397AC2D733B3CA8A709BFB5B9C32F649
SHA-512:	232FC71BFB2AD138C6255AC9FB35711A5711BE33ECAB9C1D629A25A000923D7B5DDBE15CD4A774207331C007403ABA9D7E2D457C827A5F817CF0BD992D75BF94
Malicious:	false
Preview:	%PDF-1.4.%......9 0 obj <</Linearized 1/L 293080/O 12/E 277969/N 2/T 292854/H [ 1396 295]>>.endobj. ..xref..9 55..0000000016 00000 n..0000001691 00000 n..0000001396 00000 n..0000001768 00000 n..0000001946 00000 n..0000002294 00000 n..0000002370 00000 n..0000002667 00000 n..0000004764 00000 n..0000005034 00000 n..0000005273 00000 n..0000005315 00000 n..0000005358 00000 n..0000005801 00000 n..0000006232 00000 n..0000006817 00000 n..0000006948 00000 n..0000007078 00000 n..0000007112 00000 n..0000007156 00000 n..0000011364 00000 n..0000011500 00000 n..0000011996 00000 n..0000016067 00000 n..0000020580 00000 n..0000024317 00000 n..0000027900 00000 n..0000030287 00000 n..0000033506 00000 n..0000036742 00000 n..0000060021 00000 n..0000062690 00000 n..0000155029 00000 n..0000155323 00000 n..0000155496 00000 n..0000162568 00000 n..0000162797 00000 n..0000162987 00000 n..0000238309 00000 n..0000238558 00000 n..0000238802 00000 n..0000239163 00000 n..0000239363 00000 n..0000239415 0

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Quick Start Guide.Portuguese.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 2 pages
Category:	dropped
Size (bytes):	237131
Entropy (8bit):	7.982287950572343
Encrypted:	false
SSDEEP:	6144:90EKgm2NYIsFNFN/HfKROZqjDFlyOzyst:9TJNYIsVN//mOZOQOOo
MD5:	FB89913980FD7357233D816230EBC4CB
SHA1:	6AFE2410F794064601612D09CE480977D21D3084
SHA-256:	B75F6B84F4B3BA46FFE94C4BD8D8545D4A1140C2019E204084FA44DF82C36605
SHA-512:	307C675A796C924FCA747441AA8FA2849A0E39CEB508233786C5625C475205EDCF684B1D558B43983D8E5C4AB01A0102101442F3375D322CFDA5567A8D106CBD
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) >>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 33 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 12 0 R/F4 14 0 R/F5 19 0 R>>/XObject<</Image9 9 0 R/Image10 10 0 R/Meta24 24 0 R/Image25 25 0 R/Image26 26 0 R/Image27 27 0 R/Image28 28 0 R/Meta29 29 0 R/Image32 32 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 7499>>..stream..x..]K..7......z`.2I.kw....!...Gm.A.C.....R=.0.i~..:..`O./{....w23....c?..J2..F..E..w.?.D..R._......D..........;...._..j....{j.gz!.!..._...._..%.\|t....F5.W.{......=..}.......TN.Q..N.0...='.8...^>...l.y~k.....S....$.x..;j.(...n.......Z......T<).D{/..v.......0!$.i..I.!..D..w^2..2\|).P.FH.J...."0SP". .... ..........4..`.....C..]..Wg."...Z....."?.........[^........2..v..f.R..\|.}.H...

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Quick Start Guide.Spanish.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 2 pages
Category:	dropped
Size (bytes):	186696
Entropy (8bit):	7.979180805285423
Encrypted:	false
SSDEEP:	3072:YBTKAVhSqllFHMP2lsLx5eBqN/YVgMjgWyrF5AZ7D4Zu8MyKbyw4bThq:+P3i2l0XFN/kgdN2Z7TdysqI
MD5:	35A6D8BEA1A31FA7599F64E3EAE0488E
SHA1:	095B70F6B3C05DAE3AE9EB574EDFDFACB1801AA7
SHA-256:	A282CF2F84B20FF5A8AEDF5BDA7D383EE303FF52A09AFFC291EA0A0BD080C4AF
SHA-512:	892F3A3BE40397F56A5BA15D7E222C5A90DE18E9401DFCC77EF3173AD5249BDCE5D677D4003C61F3B523089206207BF6FFE182D74FDD3D26141F22E2E323EF00
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) >>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 32 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 12 0 R/F4 14 0 R/F5 19 0 R>>/XObject<</Image9 9 0 R/Image10 10 0 R/Meta24 24 0 R/Image25 25 0 R/Image26 26 0 R/Meta27 27 0 R/Meta28 28 0 R/Image30 30 0 R/Image31 31 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 7888>>..stream..x..]K..6..+B......D.\|.n..<v.f$..=H{`WQ...z.#......[.......e.$...j..3...Y...D....?.y....J.^.^....W...."?Z.@._.rs.........Z<.x.@/.t..............._...@~.....(n .Z<p...Y.P=..}Bl..F........1J....9Z.c.M/..?v6..^k.....S...t...@.....Ki...H+..@..../7.U...zA._&......J...2Ji..eJ.'Pi.h@?I.....#....H....L.q..\|. s.*nM!.e....A`X...k.{]>..kh..d...q.w..g."W.^...6W...^...5.UP.7....W.g...7g.B..>.

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Release Notes (FWv3.1 SWv2.10).pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.4, 13 pages
Category:	dropped
Size (bytes):	205785
Entropy (8bit):	7.825000096859457
Encrypted:	false
SSDEEP:	6144:YiDkME3wX+cyjsZ4u58Z/W/+W27XuAIOms:Yi4PAyW4u5MMZ2TuArx
MD5:	9CEE03C1DE3BF25B9E834552E2F9FD93
SHA1:	6DBFBF3272D00BC3F6A64B22A0D0AA674D56440A
SHA-256:	64A329C152833E8E7FF842F85BBD53256B489F218DD116210EE6A54E295F52D2
SHA-512:	ABEF55987B2A7DF28AC172F1D695347D22EE80F37DCF51647D14FD8DBA8E7D57BA0E89EF873DB5A8FCEA3CC43194207DCF62CF674CD8962548255C6067D54B1C
Malicious:	false
Preview:	%PDF-1.4.%......157 0 obj <</Linearized 1/L 205785/O 160/E 63654/N 15/T 202597/H [ 1456 700]>>.endobj. ..xref..157 58..0000000016 00000 n..0000002156 00000 n..0000001456 00000 n..0000002257 00000 n..0000002599 00000 n..0000002723 00000 n..0000002847 00000 n..0000002971 00000 n..0000003095 00000 n..0000003218 00000 n..0000003341 00000 n..0000003464 00000 n..0000003587 00000 n..0000003710 00000 n..0000003833 00000 n..0000003956 00000 n..0000004079 00000 n..0000004203 00000 n..0000004327 00000 n..0000004451 00000 n..0000004575 00000 n..0000004699 00000 n..0000004822 00000 n..0000005054 00000 n..0000005131 00000 n..0000005437 00000 n..0000005683 00000 n..0000005923 00000 n..0000006145 00000 n..0000006910 00000 n..0000007463 00000 n..0000007596 00000 n..0000008111 00000 n..0000008724 00000 n..0000008989 00000 n..0000009025 00000 n..0000009632 00000 n..0000010314 00000 n..0000010857 00000 n..0000011302 00000 n..0000011558 00000 n..0000011962 00000 n..0000012554 00000 n..0000012928

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Release Notes (FWv3.2 SWv2.11).pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.4, 3 pages
Category:	dropped
Size (bytes):	47137
Entropy (8bit):	7.4812811353425985
Encrypted:	false
SSDEEP:	768:d8AYQRf9+tTdIOsJ6NGilCxaRYB4LClNrCzgBJQdJ+DLMCdE1JKbY7y:4YxaolNWsS+0egy
MD5:	CED8B7B5D984567121E4CB1F265B35B0
SHA1:	4A14A0C55DCEE1EEE6BB02799DFD33071B35AAFC
SHA-256:	914407FA0FD4ECA6CBDEA2B9C6B07B0E591F81E786DD7A5C0CA0ED77CD357184
SHA-512:	70122D0561F9E318C01E3D07142C470255B9FB2C913F882391764EBBC5DC5FCF67D96A73FA7BB0FB7574E0F72CA361E3B2FAC2226B8B04F260F34E76D57B4779
Malicious:	false
Preview:	%PDF-1.4.%......26 0 obj <</Linearized 1/L 47137/O 29/E 29173/N 3/T 46570/H [ 1156 290]>>.endobj. ..xref..26 43..0000000016 00000 n..0000001446 00000 n..0000001156 00000 n..0000001542 00000 n..0000001792 00000 n..0000001943 00000 n..0000002108 00000 n..0000002230 00000 n..0000002352 00000 n..0000002474 00000 n..0000002596 00000 n..0000002717 00000 n..0000002838 00000 n..0000002960 00000 n..0000003168 00000 n..0000003244 00000 n..0000003549 00000 n..0000003794 00000 n..0000004033 00000 n..0000004254 00000 n..0000004384 00000 n..0000004796 00000 n..0000005319 00000 n..0000005756 00000 n..0000006333 00000 n..0000006367 00000 n..0000006893 00000 n..0000007120 00000 n..0000007757 00000 n..0000008333 00000 n..0000008919 00000 n..0000009235 00000 n..0000009467 00000 n..0000010125 00000 n..0000010533 00000 n..0000010788 00000 n..0000011398 00000 n..0000011966 00000 n..0000012497 00000 n..0000015166 00000 n..0000022660 00000 n..0000022889 00000 n..0000023087 00000 n..trailer..<<

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Release Notes (FWv3.7 SWv2.30).pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 3 pages
Category:	dropped
Size (bytes):	150749
Entropy (8bit):	7.896078148750026
Encrypted:	false
SSDEEP:	3072:6UCf7i3qmW38sTDef58nCSgxs104j5VX6Bi7m3UIUDq:6U33qm2PDQ+CSgx404T6H
MD5:	8C33731693180EB6F00A45AF7A1749FC
SHA1:	6476C2A730BEA7570E138EB6555349BC3F94E704
SHA-256:	E8EBEBE5BC0464BACF595EB45C54CDDCBABA82A3862ACA7F2E2DEF8D20CBA16E
SHA-512:	9CE8A93B0CACD63444478E5772847254168584727D9D7329D3C7CB77A2BD84DFCF509B87933F191B9A06BF75503844AC9C561BB6D3039C8E252F8D68B1328DF5
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) >>..endobj..2 0 obj..<</Type/Pages/Count 3/Kids[ 3 0 R 40 0 R 50 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 9 0 R/F4 11 0 R/F5 17 0 R/F6 20 0 R/F7 32 0 R>>/XObject<</Image37 37 0 R/Image38 38 0 R/Image39 39 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/Annots[ 16 0 R 19 0 R 25 0 R 26 0 R 27 0 R 28 0 R 29 0 R 30 0 R 31 0 R] /MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 4010>>..stream..x..[[o...~7.../.....^x+..IZ..=..>...>..e..H......YR......,jgvw.....^^...s?..vyy.Y..q......U.K.esy..{..//>zl..........C<....`..~...).R_%C"..i..\.....g.w[....?.....Y.X._.z1..3.Q..M..E...._...,..5...78..#..A.b$..9'.I.).......T.6.Q8..._..~......>y..4..e...!E=_.....q..j...F~.Y<>.\c#B.K.. ..`H..0 ...8..:.....+;.B.b.#.?....FA h...?.a..iy..}.0..r...1...NQrz.....Y-..L....Go$.q.

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Technical Manual.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 126 pages
Category:	dropped
Size (bytes):	2020544
Entropy (8bit):	7.924963858339301
Encrypted:	false
SSDEEP:	49152:uk5crgVmv+zm0ZZKLsVZVCRRWydFJCq/8N+X1OqYUe:uJrBWzxZZssXERRWOcq/4+FON
MD5:	4403827FAA92F9970ABA644F2393414F
SHA1:	A0E0ABF77DE22D39503FFD28E4BC5C0348093AB6
SHA-256:	BE6791FBF886717608D48CD7C2CD4191EDCE59E14ECFFC66F863CFA769A36154
SHA-512:	55D96FBDA4D41A67857DB86F50BA14BFB9509258C689CD8BB41B4BEDA9CB2977EB62FAD6220877BC220C298AE6AD23F45C66C889F804FA5AFD819F58C6FD173B
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /Outlines 974 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 126/Kids[ 3 0 R 23 0 R 32 0 R 40 0 R 46 0 R 72 0 R 74 0 R 119 0 R 165 0 R 200 0 R 202 0 R 210 0 R 218 0 R 231 0 R 233 0 R 257 0 R 273 0 R 283 0 R 293 0 R 295 0 R 300 0 R 305 0 R 308 0 R 313 0 R 318 0 R 325 0 R 333 0 R 337 0 R 344 0 R 348 0 R 362 0 R 371 0 R 375 0 R 377 0 R 381 0 R 384 0 R 394 0 R 407 0 R 421 0 R 430 0 R 438 0 R 449 0 R 460 0 R 470 0 R 487 0 R 504 0 R 517 0 R 519 0 R 527 0 R 530 0 R 533 0 R 538 0 R 551 0 R 563 0 R 576 0 R 584 0 R 589 0 R 595 0 R 597 0 R 602 0 R 610 0 R 622 0 R 626 0 R 630 0 R 634 0 R 642 0 R 650 0 R 654 0 R 663 0 R 670 0 R 672 0 R 679 0 R 683 0 R 690 0 R 693 0 R 696 0 R 703 0 R 708 0 R 712 0 R 717 0 R 721 0 R 724 0 R 726 0 R 729 0 R 732 0 R 740 0 R 747 0 R 753 0 R 757 0 R 763 0 R 771 0 R 776 0 R 781 0 R 787 0 R 791 0 R 793 0 R 798 0 R 807 0 R 813 0 R 815 0 R 817 0 R 821 0 R 825 0 R 832 0 R 837 0 R 839 0 R 887 0 R 895 0 R 898 0 R 90

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Users Manual.Chinese.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.6, 45 pages
Category:	dropped
Size (bytes):	845130
Entropy (8bit):	7.755971977948527
Encrypted:	false
SSDEEP:	12288:coPERBatO7J1N4a7Ao+VOGh15ZTjq3IXFjLcCP2PdQG672qVv8T5wqd5cahhS/ji:yRFd4a7Ao+0ynTj9Pgjhpw+5cX/ji
MD5:	3982DDF78F0E1C5D98B194C662B96C5A
SHA1:	BAE73FC58BF5FAAD4111C9024B7F285017CEE1F2
SHA-256:	C3816ED730C3E442F01879AA521EDF09AEA9D692D3B29324600D31961DEFA8F8
SHA-512:	EB090B845597E2763F162C9BD10A2367FF6BC826D048902C12712E60E95D886A3F1A865BADB7F4D43123624578163D706095D8C92E6DE5B49F9B94183B087769
Malicious:	false
Preview:	%PDF-1.6.%......3831 0 obj.<</Linearized 1/L 845130/O 3834/E 248805/N 38/T 768461/H [ 1244 2518]>>.endobj. ..xref..3831 46..0000000016 00000 n..0000004006 00000 n..0000004344 00000 n..0000004534 00000 n..0000004969 00000 n..0000004998 00000 n..0000005150 00000 n..0000005606 00000 n..0000005720 00000 n..0000005855 00000 n..0000005894 00000 n..0000005945 00000 n..0000006169 00000 n..0000010366 00000 n..0000010445 00000 n..0000010492 00000 n..0000012787 00000 n..0000012922 00000 n..0000014726 00000 n..0000015170 00000 n..0000015307 00000 n..0000015537 00000 n..0000015853 00000 n..0000017031 00000 n..0000017899 00000 n..0000020594 00000 n..0000153199 00000 n..0000153439 00000 n..0000153714 00000 n..0000214119 00000 n..0000214359 00000 n..0000214672 00000 n..0000214798 00000 n..0000219256 00000 n..0000219490 00000 n..0000219723 00000 n..0000219778 00000 n..0000229139 00000 n..0000229362 00000 n..0000248150 00000 n..0000248394 00000 n..0000248513 00000 n..0000248579 00000 n..000024877

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Users Manual.English.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 36 pages
Category:	dropped
Size (bytes):	823247
Entropy (8bit):	7.941078028854539
Encrypted:	false
SSDEEP:	12288:hPE0VR7U0Rf8PxMrhrZiZHQ919nbUQX+JHWUFP2sUkrauNh2IgSzJf7SxCM+yF78:REYRpqwXiZw9QQXCHHFnXNh/bfM7s9
MD5:	D8DF6E2FC2EAB92FC70EE20981700632
SHA1:	E39B3B80F58195708D880CECCD34ED3572A46359
SHA-256:	64A9CDE2FDB1FD3A5FD49264CF9DC506BC8263CFDABD6CA195FE0EE373988CD3
SHA-512:	37C10925EFD17744FE13E68D1E96FE6A0B8A90536128E42D887116938E639FB32D6C02A13D6AEBB3AF55E67CABB0F5BDA216779239EE3D958E88ABB414D68EB4
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /Outlines 331 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 36/Kids[ 3 0 R 28 0 R 39 0 R 79 0 R 81 0 R 92 0 R 99 0 R 108 0 R 115 0 R 123 0 R 146 0 R 156 0 R 164 0 R 186 0 R 203 0 R 218 0 R 222 0 R 225 0 R 228 0 R 242 0 R 249 0 R 256 0 R 258 0 R 268 0 R 280 0 R 284 0 R 286 0 R 290 0 R 296 0 R 300 0 R 302 0 R 308 0 R 312 0 R 321 0 R 323 0 R 327 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 9 0 R/F4 14 0 R/F5 17 0 R/F6 19 0 R/F7 24 0 R>>/XObject<</Image16 16 0 R/Image26 26 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 1931>>..stream..x..X[o...~7..0.........l.n.h.].[,.}`..4.L$...}.9CI...4.E.<..w.......V2).Plv.y!....2.2....//.[..../>G,....\|y..X...k.M...Y..)........?.z`..O@..I.L&.B....py...........ct.3C.\|..y.....3...1..BK...."1.>

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Users Manual.French.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 41 pages
Category:	dropped
Size (bytes):	1375160
Entropy (8bit):	7.950902149988061
Encrypted:	false
SSDEEP:	24576:uUkqpqwUpjJqfgaNdw6hKQ+7rXUeUapvZH1deHqyD/rVnY7zEMf/TMK:uRqUwUlsFdw6hiYeHv2qdPEpK
MD5:	3A9C0739FBE4ADB25FA58A6D0992F80A
SHA1:	09ED03D76DB9034579267CD97E72082BFBDC8595
SHA-256:	4FAF32A335D0AAF9E89C9467E85FA7F9481C141B2F96440CC0CFB43123695039
SHA-512:	3C134696D3D8801B7918B2E60DD0882C8D766DB30B3D9684A0FDE6EC1DE0E8FA6F36358DD57AE53C9F8DCC05429B1D639C21AFD696BF96CBD5F294E348737578
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /Outlines 212 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 41/Kids[ 3 0 R 31 0 R 41 0 R 78 0 R 80 0 R 93 0 R 98 0 R 105 0 R 110 0 R 115 0 R 120 0 R 122 0 R 131 0 R 133 0 R 135 0 R 142 0 R 145 0 R 148 0 R 151 0 R 153 0 R 156 0 R 158 0 R 160 0 R 162 0 R 164 0 R 166 0 R 168 0 R 170 0 R 179 0 R 181 0 R 184 0 R 186 0 R 190 0 R 192 0 R 194 0 R 196 0 R 200 0 R 202 0 R 204 0 R 207 0 R 209 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 9 0 R/F4 14 0 R/F5 17 0 R/F6 22 0 R/F7 26 0 R>>/XObject<</Image16 16 0 R/Image24 24 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.38 841.98] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 2358>>..stream..x..Y.n.6.}7...cwv,.N*....t0yXlb'.`.....4...eO......D..D[.M2.....b.SE.....t..........#..1b81..%...#J........Y..\.w\|..t..'.,..X.r.II..8\U....+.k......3%.T..i

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Users Manual.German.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 40 pages
Category:	dropped
Size (bytes):	1288554
Entropy (8bit):	7.941094741117574
Encrypted:	false
SSDEEP:	24576:KWZovpqNs58uA9CCS7xfSP7+KE7UHCfO/xUtzrL:KqovUNs58uQ/mfSPFE7tL
MD5:	1C19A088F65AFDA887ECEE6BA98C41F3
SHA1:	33FC8E269173F064DB8316D7CE1A55EE4EC71D05
SHA-256:	BD7A991999CFEB71248195CA1D482083D8F222B2FC18610D767DD0239E4046D3
SHA-512:	C328CA60F908760D05AF7525048DB0BE4B591111C3F5D5584C754B9CB7F4458426D8F060691558AFE3EF5F97415D1CCF066CCD0AB93A4D2E88F5EF74D6A39BF3
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /Outlines 271 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 40/Kids[ 3 0 R 21 0 R 27 0 R 64 0 R 66 0 R 87 0 R 94 0 R 102 0 R 109 0 R 111 0 R 117 0 R 121 0 R 133 0 R 137 0 R 142 0 R 153 0 R 161 0 R 166 0 R 174 0 R 177 0 R 181 0 R 184 0 R 191 0 R 197 0 R 200 0 R 204 0 R 209 0 R 221 0 R 223 0 R 227 0 R 231 0 R 236 0 R 239 0 R 242 0 R 246 0 R 249 0 R 253 0 R 260 0 R 266 0 R 268 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 9 0 R/F4 14 0 R/F5 17 0 R>>/XObject<</Image16 16 0 R/Image19 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.38 841.98] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 2132>>..stream..x..X.r.F...J.#.....k+...oUR...V..."G$V .`....=..{.g......$1.GdV..f....{p.p~vu...b&....3.0..A.4O.$....g,.......0.~...v~..d...K..y.f..u.T.)..5...._.u'..X.".*PZ!..yB../..??...I.<.j#

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Users Manual.Italian.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 36 pages
Category:	dropped
Size (bytes):	1309007
Entropy (8bit):	7.953525243644387
Encrypted:	false
SSDEEP:	24576:v3NJwVZLyUY0sh5cXHRoZrXa+4fbZsO7J3SH0Lgn4uJPU0Ay/tw9nuL9:PLwVZrY0LXxM94D9BJ07w9n69
MD5:	7CAEB5EA8164F1C8EE8693C04AA5D49F
SHA1:	A5E4B81BC8493E5E973DD22FC2BAC0C2DC58652E
SHA-256:	A80152E5E7CDA242658B379C2AFFC7A7F3FA929A5E34BD594C95C8F1D1CDE9B8
SHA-512:	321C47088870FEA113D39191C394C3A963A31528E5DB87EC6EA9FCE1468151546949A684408DA94278613B12BA3E02C083E1B52104DF55ACC9CCC6700D35E7CF
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /Outlines 215 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 36/Kids[ 3 0 R 31 0 R 42 0 R 80 0 R 82 0 R 87 0 R 93 0 R 104 0 R 116 0 R 122 0 R 127 0 R 129 0 R 137 0 R 144 0 R 149 0 R 152 0 R 155 0 R 158 0 R 164 0 R 166 0 R 169 0 R 173 0 R 176 0 R 178 0 R 181 0 R 185 0 R 187 0 R 190 0 R 192 0 R 197 0 R 199 0 R 201 0 R 203 0 R 205 0 R 207 0 R 212 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 9 0 R/F4 14 0 R/F5 17 0 R/F6 22 0 R/F7 26 0 R>>/XObject<</Image16 16 0 R/Image24 24 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 2297>>..stream..x..Y.n....7.w.K2X.s...0..f..mb7E...#.6.:......z.E..f(.)..da...?.G.p{\|tz..............1....Cn..G.<.....>e$.'......@......*....xA51..j...\|G....B.K...0......~<>....5.F.Z.B..N.O.M..R....b.\-os.......

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Users Manual.Japanese.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.6, 36 pages
Category:	dropped
Size (bytes):	839688
Entropy (8bit):	7.970541937035269
Encrypted:	false
SSDEEP:	12288:1gBAyYq3zErF63m58K2Y7cWhqmRIIgy1LMcB1ng/oGQbCLjcADW7Tjq3IXFjLcC4:iBG/rsW8KUQZgynyoZbo6Tj9PuFgC
MD5:	69BA82CDD328F13E843A2AFE9058EB7D
SHA1:	BB7274A4A91A3480CE4AAB2AB0BB1035818A394C
SHA-256:	81B89172A4200138931648AEDBA2164D72498A85703A04783C1E49FE93F1B926
SHA-512:	A8853B71BE089FE703B1A692EC5EE0A9EEB9AE815A983F814CA70B81C41C7C951339DDCCB9A9F95932160CDF18E214CACE719F1EC31AC50B7AEF904FDC9B5D68
Malicious:	false
Preview:	%PDF-1.6.%......216 0 obj.<</Metadata 213 0 R/AcroForm 261 0 R/Pages 208 0 R/Type/Catalog/PageLabels 206 0 R>>.endobj.213 0 obj.<</Subtype/XML/Length 3689/Type/Metadata>>stream..<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.0-c316 44.253921, Sun Oct 01 2006 17:14:39">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:pdf="http://ns.adobe.com/pdf/1.3/">. <pdf:Producer>Acrobat Elements 7.0.5 (Windows)</pdf:Producer>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>PScript5.dll Version 5.2.2</xap:CreatorTool>. <xap:ModifyDate>2009-03-23T10:16:39-07:00</xap:ModifyDate>. <xap:CreateDate>2009-03-21T12:57:56+04:30</xap:CreateDate>. <xap:MetadataDate>2009-03-23T10:16:39-07:00</xap:MetadataDate>. </rdf:Description>. <rdf:D

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Users Manual.Portuguese.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 34 pages
Category:	dropped
Size (bytes):	773837
Entropy (8bit):	7.9282781142243355
Encrypted:	false
SSDEEP:	12288:jrGJT0VgUcMMrhr1Z8f0o8J7j5bIvJyY4MHTUY9e3SOLml1qBo:jyZYg9LLZ8MfT6ywUYk3PLJo
MD5:	94D639295E368E32E1990E14FBF5E870
SHA1:	8C265F2E59BBA32AD597D6AF2DD107342EE66D38
SHA-256:	14ED2FE8B7D890BA870508E21AD2DEAAA51BA9776F6F3B9BEFB63868E02E1FC9
SHA-512:	67D6F247DD8BB9B55F12CF101F4A6775A59B206BA2FA13C82FAECF66A5F379A61E01C3D759E210F1F451A7F069FCA5B9BD012CE4553E29BAA066F6E67FE1774B
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /Outlines 358 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 34/Kids[ 3 0 R 23 0 R 29 0 R 73 0 R 75 0 R 90 0 R 103 0 R 123 0 R 130 0 R 140 0 R 162 0 R 170 0 R 178 0 R 205 0 R 224 0 R 247 0 R 251 0 R 254 0 R 257 0 R 271 0 R 278 0 R 287 0 R 295 0 R 307 0 R 311 0 R 315 0 R 320 0 R 323 0 R 331 0 R 335 0 R 345 0 R 350 0 R 353 0 R 355 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 9 0 R/F4 14 0 R/F5 17 0 R/F6 21 0 R>>/XObject<</Image16 16 0 R/Image19 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 2504>>..stream..x..YKo..........Eu7.M..........v....1..3...I.v.^....\|..o.-.TU7g.3.#...!....W...[...qv....(..2...K.t.....o.......@'....`....K.+........8.=<x.../..O....z...GV.&v.m....b.c.y..+.d..\ .OJ.R..Z.<.a..y.+R.u....L..HF..A..C.,I'

C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Users Manual.Spanish.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5, 34 pages
Category:	dropped
Size (bytes):	864991
Entropy (8bit):	7.942555671772601
Encrypted:	false
SSDEEP:	12288:8kA0VL7U0Rf8vMrhJaM77zxavk0k9IZoMSo4HWitBCIDP2IgXYcECdNIyK727f:8kAYLpqeB/b6oPo4HhB7DP/EYcdg2z
MD5:	648B53A0D3F6741DD91F03A71E4CD8D6
SHA1:	85ED18780D31D2310062D72BEDE7D018F444B413
SHA-256:	A7AD3A83A9E8F0C36C77443B4C03665A6F38877783EBCD672767C0ECE538E442
SHA-512:	36E068DB2E7FF51508E15BAB927C47A2568746D79D79F6C6A54BF24F1BAE12D764439742D5127FA3F172B4653775E4066617DD052B5359526DF8E208C2962898
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /Outlines 316 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 34/Kids[ 3 0 R 21 0 R 27 0 R 67 0 R 87 0 R 94 0 R 103 0 R 110 0 R 116 0 R 120 0 R 141 0 R 152 0 R 161 0 R 182 0 R 198 0 R 211 0 R 214 0 R 217 0 R 220 0 R 233 0 R 243 0 R 247 0 R 253 0 R 263 0 R 268 0 R 272 0 R 276 0 R 282 0 R 286 0 R 292 0 R 294 0 R 298 0 R 308 0 R 312 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 9 0 R/F4 14 0 R/F5 17 0 R>>/XObject<</Image16 16 0 R/Image19 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 2317>>..stream..x..Y_o.F..7..Ta...$...K....@.j.Er.4.........6..p..~....$..U.A........of7.-NO..9.I....9=.,.?..<.S.2...[<..$....;=..]......Et..LGW.g.f......s.-vF...c#."6.....AD...\.I.9}Xsz.oX3..%..C".)S.G.$.;..oNO~.W...y..a..f].li.O..\E.E....\|.i.K.

C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	633856
Entropy (8bit):	6.386520387416292
Encrypted:	false
SSDEEP:	6144:8mO7O76vE5RHdJwqCG8CRXa3Jh0sxHvVxwUJuqq8WxrHAOz+qSqcw:8mOi7yusG8CRAhBxHL+HJSG
MD5:	F2B4252F45413AA4644C1CCE16C8C811
SHA1:	5D040E762157D88483FF67D054B78A2774CC8E3A
SHA-256:	43508A6BEB19780C129CF576F547DFD3C25D71824375AC8B3B3B21C006CD8AA8
SHA-512:	52803FB387019756DEBD7AAF86081E138C817AB4B36275977F6BA2C46650D5C50A77D2AB17C51234C8391551EC6A3F177C38E3ECFA76C2DB4681AEB3E4DA4F26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=N.y/..y/..y/...`'.x/..g}$.X/..g}2../..^...z/......{/..y/..`...^...n/..g}5.+/..g}%.x/..g} .x/..Richy/..................PE..L...(..I.................^...J...............p....@.................................N...................................................$^..........................................................`#..@............p..@............................text...0\.......^.................. ..`.rdata.......p.......b..............@..@.data... }.......^..................@....rsrc...$^.......`...L..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SonTek\FlowTracker\GDIPlus.Dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1699840
Entropy (8bit):	6.819413862802164
Encrypted:	false
SSDEEP:	24576:d/mGbhdlhXGBbS31CW3+SwqbzUCimLBTlrBjXDh0DPO/QhZoYFa4900nMI/v:duGflhU611+IzUiT7VEd8NI
MD5:	E45281D9D5D6AA149843D6925A27A6C2
SHA1:	5E24EF7AC2F67741FC0008BC78FDDB65DDB5CC64
SHA-256:	4CFCF93FF349ACC86EDCFD3E0B3E67F783720F6FA770463CDEEAE9F5B378193F
SHA-512:	AE29E159C3D3F5E68FB95CFF565278A2A0F8366274C0059F6909CA92B0EFDD9FB9D7A673EEE3B2BB43A03696FDCDBDB2F46732E0C370C703A31E54922D03E862
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V..q8..q8..q8..R!..q8..q9..p8.Wm6..q8..Q3..q8..Q2..q8..R$.Oq8..R...q8..x...q8..R%..p8..R...q8.Rich.q8.................PE..L.....:...........!.....0...................@....bj................................e\|..................................jO..p...x....@.......................`..L...0...........................................\|.......(............................text...J$.......0.................. ..`.data........@.......@..............@...Shared.......0....... ..............@....rsrc........@... ...0..............@..@.reloc.......`.......P..............@..B...:8....x.:E......:O......:Z......:d......:n...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.ole32.dll.ADVAPI32.dll......................................................................................................................................................................................

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Accelerators\Global.acc

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	4.395503872254448
Encrypted:	false
SSDEEP:	24:kj8Hd1UXq8cHd1tQr0Hd1ejaNFHd14GCGMHd1zHd1pJm4J+Hd1la0a8Hd1la2aP:i8/Qvc/tQY/CWF/4GCGM/z/pJ3J+/lrm
MD5:	AA8DCF65DC764DB1D9E03ABF02F5711C
SHA1:	8C3918FA6D959A13C9DFA777098FEE2106208D9B
SHA-256:	AA3B80F6D4500CFE27F91E645E5230F8587B0425D7D2991B599B782545A79AED
SHA-512:	3125D57EEFE7E3E2240A12D021F395837BA15F16D22E740AA658C7C7908BA13A2550E90DA5F002BEFDDD8C8632C4223102242A7D1E175FB55639B0EB8C8A6938
Malicious:	false
Preview:	....}\|.......File.Open$....}\|.......@Caption..U.n.n.a.m.e.d..@Command..O.p.e.n.F.i.l.e..@Id..F.i.l.e...O.p.e.n..@State......ShortcutKey.O....File.Connect$....}\|.......@Caption..U.n.n.a.m.e.d..@Command..C.o.n.n.e.c.t..@Id..F.i.l.e...C.o.n.n.e.c.t..@State......ShortcutKey.D....AdminMode$....}\|.......@Caption..U.n.n.a.m.e.d..@Command..A.d.m.i.n.M.o.d.e..@Id..A.d.m.i.n.M.o.d.e..@State......ShortcutKey.A....CloseSession$....}\|.......@Caption..U.n.n.a.m.e.d..@Command..C.l.o.s.e.S.e.s.s.i.o.n..@Id..C.l.o.s.e.S.e.s.s.i.o.n..@State......ShortcutKey.s....Print$....}\|.......@Caption..U.n.n.a.m.e.d..@Command..P.r.i.n.t..@Id..P.r.i.n.t..@State......ShortcutKey.P....NextSession$....}\|.......@Caption..U.n.n.a.m.e.d..@Command..N.e.x.t.S.e.s.s.i.o.n..@Id..N.e.x.t.S.e.s.s.i.o.n..@State......ShortcutKey.u....ShowAppSettings$....}\|.......@Caption..U.n.n.a.m.e.d..@Command..S.h.o.w.A.p.p.S.e.t.t.i.n.g.s..@Id..S.h.o.w.A.p.p.S.e.t.t.i.n.g.s..@State......ShortcutKey.S....ShowApplication$....}\|.......@Caption..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\About.htm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2071
Entropy (8bit):	5.336953218446441
Encrypted:	false
SSDEEP:	48:IZPkvT3X8GLzefWXQrM/0/ltNFp+oHQrzNr6WnHrnnBp+ckjjZOp+ZG7vLTRHj0L:KcvTn5nJHsJfwDvxuix7vLlQL
MD5:	F19D95B46FA550E22965459EE5C916D9
SHA1:	370E8B42ACA90A487F5CAD0A62DC930CABD4BEE5
SHA-256:	AD2E7E5EC884BAB58893BC927069C18945A3329ED53428C005D01082F0AF69A1
SHA-512:	A88F2A635792C40495FFDF11B4752C76363AEC528341C1F45C9AD9D322BBC9C9187DB00B18412C1E9899D266A0109DD52487F2FE623CCBB1CA08E09EC8EA7F47
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<html>...<head>....<title></title>....<meta content="Microsoft Visual Studio.NET 7.0" name="GENERATOR">....<meta content="http://schemas.microsoft.com/intellisense/ie5" name="vs_targetSchema">....<LINK href="dlg.css" rel="stylesheet">....<script language="jscript" src="about.js"></script>....<script language="jscript" src="../scripts/xml.js"></script>...</head>...<body onload="OnLoadPage()" onunload="OnUnloadPage()" ms_positioning="GridLayout">......<XML ID="dsoRoot"></XML>....<XML ID="dsoApp"></XML>......<DIV id="divBody" style="TEXT-ALIGN: left" ms_positioning="FlowLayout" style="background-color: green">.....<table id="tblDialog" style="TEXT-ALIGN: left;" cols="1" border="0" bgcolor="white" cellpadding="0"......cellspacing="0">......<tr width="100%">.......<td valign="top" align="left" width="143">........<IMG alt="" src="images\wave-fade.jpg" border="0" vspace="0" hspace="0">.......</td>.......<td align="left" valign=

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\About.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	991
Entropy (8bit):	5.201872394447448
Encrypted:	false
SSDEEP:	24:0gy8Z486Hzd+wEoBt1quMooI0AShrLwRpRoagQFb:0IG8IkwEUzMNImjCJ
MD5:	699354399BAB9072A2754CB59E3AD677
SHA1:	E8C454C8D77FC9B0943B152166D3863F9C3B9D34
SHA-256:	F67DDEEF295C6E1ADE6E5CA539498B67BBA22C7078D846CF9EBE7BE5DBB99C18
SHA-512:	E1B7395B33D1FC81C222EBD81F10064EB60B25C8DCD6DCC3822160E1EDB1CC2AFB5116FA7F8EC3AA97ABA44FB14F0BAD7F95559038AED05BD0137A7147ED3A7B
Malicious:	false
Preview:	// OnLoadPage - called in Body on load (or at least must be)..var Host=window.external;..var Objects=Host.Objects;..var Variables=Host.Variables;..var Application=Objects("Application");..// var Window=Application.CurrentWindow;..// if(Window==null) {..//.window.alert("Failed to initialize dialog");..//.debugger..//.OnCancel();..// }....function OnLoadPage()..{...GetLanguageXML(Application.Settings);....//.window.alert(document.title);...Host.Caption=GetXMLText("AboutFlowTrackerSoftwareTitle");...Host.Resizable=false;......divApplicationName.innerText=Application.Name+" v"+Application.VersionString;.....divApplicationDate.innerText=Application.VersionDate;.....UpdateWindowSize();..}....function OnUnloadPage()..{....}....function UpdateWindowSize()..{...var Width=520;.. ...Host.Resize(Width,100);...var realHeight = document.body.scrollHeight;...var realWidth = document.body.scrollWidth;...Host.Resize(realWidth,realHeight);..}....function OnClose() {...Host.Close(false);..}..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\AppSettings.htm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5886
Entropy (8bit):	5.244890834389773
Encrypted:	false
SSDEEP:	96:KcvfEew6pU3yCLgk7CkLFMLV+dmdOm/tLLFTLHkLrTLrqik6NLLNLslin5dLSmdq:JEew6pU3yAgkGkLFuEdmdOm1LLFPHkL8
MD5:	9A8F8649B3DB939C05B1005BA816CC7F
SHA1:	30B075F59D9D7CD52DC549B36F3704D80D747576
SHA-256:	71D12E21567B7F64BFB9366008230F725E1DFE4BD60F0BB71EC720439400CD97
SHA-512:	F2C6313928E064091E8C9590AE1C7607CE37CAE54B9A461E9C00D290C8B9A06E1444797288B0807490C631AE62C4DFAC9E64C8CA9B330B629234FE4A46DAFF26
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<html>...<head>....<title></title>....<meta content="Microsoft Visual Studio.NET 7.0" name="GENERATOR">....<meta content="http://schemas.microsoft.com/intellisense/ie5" name="vs_targetSchema">....<LINK href="..\base.css" rel="stylesheet">....<LINK href="dlg.css" rel="stylesheet">....<script language="jscript" src="../scripts/common.js"></script>....<script language="jscript" src="../scripts/xml.js"></script>....<script language="jscript" src="../scripts/functions.js"></script>....<script language="jscript" src="AppSettings.js"></script>...</head>...<body onload="OnLoadPage();" onunload="OnUnloadPage();" scroll="no">......<XML ID="dsoRoot"></XML>....<XML ID="dsoApp"></XML>......<DIV id="divBody" style="WIDTH: 600px;HEIGHT: 600px" ms_positioning="FlowLayout">.....<table width="100%" style="height:100%" cols="2" border="0" cellpadding="0" align="left">......<tr>.......<td colspan="2">........<div class="TitleBar"><span DATASR

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\AppSettings.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5375
Entropy (8bit):	5.308604006372624
Encrypted:	false
SSDEEP:	96:+qU/ouUuDVDoyughsM0d/PW4gPAUAxWi1HDqmgA4/nvkI22m5:+qUo9OVfugetdj+FEWi1HD2A4/nvkp2I
MD5:	CC0D6592B0CD152008B2810AD9D75AA7
SHA1:	3F25E86EEF60BF2E89E3424D635E48E25C1CCBE0
SHA-256:	E31A4EAA39A3A28E2F6D9293F0D1C0B52CEB759C0FE3E2AF27059217D4FB72DC
SHA-512:	BEFF54F177E552D396AEB37BFC73FA3E049429F6AFE429D571D2C0A88F69FC97D148EC42D64FC96E466DFA6B9E7A4199A481A60B58FA9DE71D779DE24E84E430
Malicious:	false
Preview:	// OnLoadPage - called in Body on load (or at least must be)..var Host=window.external;..var Objects=Host.Objects;....var Application=Objects("Application");..var sLogoFilePath=Application.ReportPath+"logo.gif";....var CommonDialogs=Objects.CreateObject("UI.CommonDialogs");..var FileSystem=Objects.CreateObject("Scripting.FileSystemObject");.....var iLastSelected=0;....function OnCommand(str)..{...Application.Commander.Run(str);..}......function OnClickWatch()..{...var w=new ActiveXObject("SonDiag.SonWatch");...w.AddObject("DataSession",Session.Objects("DataSession"));...w.AddObject("AppSettings",Application.Settings);...w.ShowDialog(Application.hwnd);..}....function OnLoadPage() {..//.window.alert(document.title);...GetLanguageXML(Application.Settings);.....Host.Resizable=false;......UpdateImage();.....LoadControls();...UpdateWindowSize();..}....function UpdateImage()..{...var bImage=FileSystem.FileExists(sLogoFilePath);.....imageReportLogo.style.display=(bImage) ? "" : "NONE";.....ima

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\BatchExport.htm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2162
Entropy (8bit):	5.325644323202567
Encrypted:	false
SSDEEP:	48:IZPkvfEeSX8XkNJPLL+QQ0Ltw7HX0/Zt8b5OHQ3Tg9bNBOHQ3TQEqOHQ00L+uKvm:KcvfEew66PTL2EEb5wAobnwA8EqwLOBl
MD5:	6FA01E512B94AC203D3CC297F12EDF79
SHA1:	F7A2D33EA6E527490EC5587CB56282CF88067D09
SHA-256:	483FEC335523BDC33508992CA38FEE9E7DED71F2A52BE03FA6C3D34833540C10
SHA-512:	CE6A3639AAE61301B8C663528ECC0E39D8DFFB567DF8BA02ECBE12B2FFEEEBD4EDD2B8E2E9397A7549192F137D5E47FA7F817F8E428B5649863106365C712638
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<html>...<head>....<title></title>....<meta content="Microsoft Visual Studio.NET 7.0" name="GENERATOR">....<meta content="http://schemas.microsoft.com/intellisense/ie5" name="vs_targetSchema">....<LINK href="..\base.css" rel="stylesheet">....<LINK href="dlg.css" rel="stylesheet">....<script language="jscript" src="../scripts/common.js"></script>....<script language="jscript" src="../scripts/xml.js"></script>....<script language="jscript" src="../scripts/functions.js"></script>....<script language="jscript" src="BatchExport.js"></script>...</head>...<body onload="OnLoadPage();" onunload="OnUnloadPage();" scroll="no">......<XML ID="dsoRoot"></XML>....<XML ID="dsoApp"></XML>......<DIV id="divBody" ms_positioning="FlowLayout">.....<table width="100%" cols="2" border="0" cellpadding="0" align="left">......<tr style="display: ">.......<td colspan="2">........<div class="TitleBar"><span DATASRC="#dsoRoot" DATAFLD="SelectFilesToEx

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\BatchExport.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3452
Entropy (8bit):	5.248181895714137
Encrypted:	false
SSDEEP:	96:+aovTCgzN8EC0cTOccTgFs1/5Hdu2VmmShukG:+aovTkEHcTDcTos1Z428mShukG
MD5:	5A4ECE416295E09267C914EBC0C230CF
SHA1:	2A3614222A5F21D233AA3A101A4DC04249D56B01
SHA-256:	D3D842BA131A862C9AAA929D08862442F45A2D437F76106CF666F620E2707CA2
SHA-512:	0FD82BB743EB9278A2075F34A4B81F20E8B1DD09AAA9404B043E4CAC5A7454F7613E4A28077D83D5680F57326EDD5489C59DD558FF04C8336F3B667D440C6F38
Malicious:	false
Preview:	// OnLoadPage - called in Body on load (or at least must be)..var Host=window.external;..var Objects=Host.Objects;....var Application=Objects("Application");..var Settings=Application.Settings;....var PathsSettings=Settings.CreateNode("Paths");..var BatchSettings=PathsSettings.CreateNode("BatchProcessing");....var FileCollection=Objects("FileCollection");....var CommonDialogs=Objects.CreateObject("UI.CommonDialogs");....var FileSystem=Objects.CreateObject("Scripting.FileSystemObject");....function OnCommand(str)..{...Application.Commander.Run(str);..}......function OnClickWatch()..{...var w=Objects.CreateObject("SonDiag.SonWatch");...w.AddObject("Application",Objects("Application"));...w.ShowDialog(Application.hwnd);..}....function OnLoadPage() {...GetLanguageXML(Application.Settings);.....Host.Resizable=false;....//OnClickWatch();.....FillControls();...UpdateWindowSize();..}....function OnUnloadPage()..{.....}....function UpdateWindowSize()..{..//.debugger...var Width=500;.. ...Hos

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\Images\wave-fade.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 4.0", baseline, precision 8, 143x275, components 3
Category:	dropped
Size (bytes):	11440
Entropy (8bit):	7.7545096463836
Encrypted:	false
SSDEEP:	192:bbRx/MEkttYNwH5Xfa4fbux3L1vpeUD1puEBz4xtQ1+T+z7xnIeanEw35R4e4:BhME8YNwHdlfbCb7nJYEe7Q1+Sz7xIex
MD5:	8D6A93555DABE8D8BC9B117C8CE1C847
SHA1:	6EE4E845E81CB773420279B85F3B4F06D92D2F51
SHA-256:	C228EA332C88E3EF20169084384F33F8AF0143854040B03D1E0E4C8FED40D5BD
SHA-512:	041D2839134AD33AA62141A1593DC0C4E742B5228104EA2DD120DD0BA413D15BC62D78299072832BDCAD2D3DAFBF81336F93011EFB15285A0298F3C4778A2343
Malicious:	false
Preview:	......JFIF.....H.H.....\|Photoshop 3.0.8BIM.........H.......H......8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM...............B..........d...............JFIF.....H.H.....'File written by Adobe Photoshop. 4.0.....Adobe.d...................................................................................................................................................B.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...lf.-.\|../q.4./.#.....{.....).

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\QualitySettings.htm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6074
Entropy (8bit):	5.33962486535598
Encrypted:	false
SSDEEP:	96:KcvfEew6bsPcL3G3Qgb38R0b6kb0LbVVbIQbdrtJxrNbJxbdLbSGbSQbY2bO/bG/:JEew6bsP+23QM38R46I0XVBIcdJJx9Jp
MD5:	2DDD56F74DE068F132E2205EFA79D143
SHA1:	B9AC3666F7C7F9EB1442D857D0969AEB52AEF098
SHA-256:	635653D3DC443477B79DCB7AD552B80A8CEDF7FF13FB993C496ADE2286AA233D
SHA-512:	B5EF57984A0280DCBC3A41797CA6830D16EA6B979F8D992D7E8350748377D71421C5640DE299840432DAA5C340BAF1885405BB1164F3458680A089D4CC928C4F
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<html>...<head>....<title></title>....<meta content="Microsoft Visual Studio.NET 7.0" name="GENERATOR">....<meta content="http://schemas.microsoft.com/intellisense/ie5" name="vs_targetSchema">....<LINK href="..\base.css" rel="stylesheet">....<LINK href="dlg.css" rel="stylesheet">....<script language="jscript" src="../scripts/common.js"></script>....<script language="jscript" src="../scripts/xml.js"></script>....<script language="jscript" src="../scripts/functions.js"></script>....<script language="jscript" src="QualitySettings.js"></script>...</head>...<body onload="OnLoadPage();" onunload="OnUnloadPage();" scroll="no">......<XML ID="dsoRoot"></XML>....<XML ID="dsoApp"></XML>......<DIV id="divBody" style="WIDTH: 300px;" ms_positioning="FlowLayout">.....<table width="100%" cols="2" border="0" cellpadding="0" align="left">......<tr style="display: NONE">.......<td colspan="2">........<div class="TitleBar"><span DATASRC="#dso

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\QualitySettings.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3382
Entropy (8bit):	5.272719004824114
Encrypted:	false
SSDEEP:	96:+hD/I/oCgpbdzTgjFjm+yHVEmTgcdzTgjjU9+Ovfhd:+hD/IoLbdzTF51EmT3dzTfbvfhd
MD5:	2E41A981CCE834E4702281065F881377
SHA1:	AADCCE81989BF353882F91A84BBB12DBCB289B94
SHA-256:	BC1498670EA4DD8579B4C5BAC5CE22F6119FED4EA32E6CC14D72BBADA4838B2C
SHA-512:	C166086AE382C3942E5EE62E2AE902F792D59656086ED264548794F33CEFF95E28AD219F3E3294BCB6901381E1ECCD1842038E7A9FC715001EF4FBC92B58119C
Malicious:	false
Preview:	// OnLoadPage - called in Body on load (or at least must be)..var Host=window.external;..var Objects=Host.Objects;....var Application=Objects("Application");..var Settings=Application.Settings;..var QcSettings=Settings.CreateNode("Quality");..var nUnitSystem=Application.Processor.UnitSystem;..var VelocityConv=nUnitSystem ? 1.0 : 1.0/0.3048;....var iLastSelected=0;....function OnCommand(str)..{...Application.Commander.Run(str);..}......function OnClickWatch()..{...var w=Objects.CreateObject("SonDiag.SonWatch");...w.AddObject("Application",Objects("Application"));...w.ShowDialog(Application.hwnd);..}....function OnLoadPage() {...GetLanguageXML(Application.Settings);.....Host.Resizable=false;....//OnClickWatch();.....LoadText();...FillControls();...UpdateWindowSize();..}....function OnUnloadPage()..{.....}....function UpdateWindowSize()..{..//.debugger..//.Host.Resize(divBody.offsetWidth,divBody.offsetHeight);...var Width=300;.. ...Host.Resize(Width,100);...var realHeight = document.bo

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\RepairEdges.htm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5640
Entropy (8bit):	5.186271987643449
Encrypted:	false
SSDEEP:	96:KcvfEew6cPU+v0qL0zsAkTacTGgAXYqFzZJRTbJTdgSTxXYqLOibGb3LM:JEew6cPP0qL6pk+cSnXYqtDR/JJZNXYO
MD5:	D8D19B5915CF41D42B93E0F25A44F9C9
SHA1:	F4991703A3D52A9850A00F7715A43CB0D499718D
SHA-256:	86304186BAEF7D0F5BF4E5F1A78CB1B0CAFBA5E096CA3592187EA68D4BEC0C9E
SHA-512:	1AE54CEBB62F380635E02C7701AB14A3DE6D55836E766AAB1B788CF8D367A6D1CF357EAAB46923F4D6EA2E9881BEC1875616E7BFE13E632215DB8A0DE7C5E8DA
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<html>...<head>....<title></title>....<meta content="Microsoft Visual Studio.NET 7.0" name="GENERATOR">....<meta content="http://schemas.microsoft.com/intellisense/ie5" name="vs_targetSchema">....<LINK href="..\base.css" rel="stylesheet">....<LINK href="dlg.css" rel="stylesheet">....<script language="jscript" src="../scripts/common.js"></script>....<script language="jscript" src="../scripts/xml.js"></script>....<script language="jscript" src="../scripts/functions.js"></script>....<script language="jscript" src="RepairEdges.js"></script>...</head>...<body onload="OnLoadPage();" onunload="OnUnloadPage();" scroll="no">......<XML ID="dsoRoot"></XML>....<XML ID="dsoApp"></XML>......<DIV id="divBody" style="WIDTH: 720px;HEIGHT: 310px" ms_positioning="FlowLayout">.....<table width="100%" cols="2" border="0" cellpadding="0" align="left">......<tr valign="top">.......<td width="50%">........<div>.........<div class="TitleBar" DATAS

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\RepairEdges.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3147
Entropy (8bit):	5.223058771845396
Encrypted:	false
SSDEEP:	48:0IGPPHTs/NN7cuyVnSVw9t45pLRrkHW8ulZR0u5MvWN1qH2Xo0W6d5ubKu/cAt1:+Pg/ouUu99OWnqH2D0
MD5:	D081D8ACF3A6F6CC7A7124BDCF881B26
SHA1:	61A0829E2C41D4872FE9A7EA57AA4D80F69B228D
SHA-256:	CCE0EA1B50BA625286F59054BEA6FFB61850FF7E996BAFEFC01AFAD9E58476EE
SHA-512:	49AE09E81382AA0C3F0897F3DA3A516E244D4888AEB7E24A7AD482CF0599801014DC9BDAC4AFB37018788264402D93BA36CECF8531D83F3A11C79331023C7F5F
Malicious:	false
Preview:	// OnLoadPage - called in Body on load (or at least must be)..var Host=window.external;..var Objects=Host.Objects;....var Application=Objects("Application");..var Repairer=Application.Repairer;....var nStations=Repairer.NumberOfStations;..var LocationColumn=Repairer.LocationColumn;..var DepthColumn=Repairer.DepthColumn;..var CorrectionFactorColumn=Repairer.CorrectionFactorColumn;....var iLastSelected=0;....function OnCommand(str)..{...Application.Commander.Run(str);..}......function OnClickWatch()..{...var w=new ActiveXObject("SonDiag.SonWatch");...w.AddObject("DataSession",Session.Objects("DataSession"));...w.AddObject("AppSettings",Application.Settings);...w.ShowDialog(Application.hwnd);..}....function OnLoadPage() {..//.window.alert(document.title);...GetLanguageXML(Application.Settings);.....Host.Resizable=false;........LoadControls();...UpdateWindowSize();..}....function OnUnloadPage()..{.....}....function UpdateWindowSize()..{..//.debugger..//.Host.Resize(divBody.offsetWidth,divB

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Dialogs\dlg.css

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9017
Entropy (8bit):	4.980919954268827
Encrypted:	false
SSDEEP:	192:PO3Mz4FcWYJ3iqOGIZEkx7xolD3ox/7C3Ee4V:GAqEWNBG3o
MD5:	702FCF5F7F94AEE8C8B7F844D47D520D
SHA1:	759585E12C7794729D0007204263F4406A8FC68D
SHA-256:	344677E390B6EA9DDB822B7E1ED24C2DB55351B85E111D0F6504ADF9C9B8F2DA
SHA-512:	31EA9F44B133DBE1B9F13D0A90C5C4E3C7570E77B4B58F167A4791D32CC1B3E9E1FAD4990098C435D670A27F2DEF2CED534FD60D8636D42773D46EAA47441596
Malicious:	false
Preview:	body..{...padding-right: 0px;...padding-left: 0px;...padding-bottom: 0px;...margin: 0px;...overflow: visible;...cursor: auto;...color: windowtext;...border-top-style: none;...padding-top: 0px;...border-right-style: none;...border-left-style: none;...background-color: white;...text-align: center;...border-bottom-style: none;..}....TABLE..{...font-family:Sans-Serif;..}..........a:link...... { color: blue;...... ....text-decoration: none; }............a:visited..... { color: blue;...... ....text-decoration: none; }............a:active..... { color: blue;...... ....text-decoration: none; }............a:hover...... { color: blue;...... ....text-decoration: underline; }.....Term ..{...cursor :hand;...color : darkblue;..}.....PopupDefinition..{...border-right: #006699 thin solid;...border-top: #006699 thin solid;...padding-left: 5px;...font-size: xx-small;...border-left: #006699 thin solid;...border-bottom: #006699 thin solid;...font-family: Sans-Serif;...background-color: #ffffd0;..}

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Languages.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.120662862485328
Encrypted:	false
SSDEEP:	6:TMVDhphXaMcF4ZLAl+LCk7Knrj1RErdbiNPuLLSATTuLJMU+:TMRZcFULAl7k7Krj1REANPELLfuLu
MD5:	9E1C6FF15A04C8CB3C06E47161BF54F4
SHA1:	9509EA0043F71E6A8154AB8A0621F2B7BD10F1C8
SHA-256:	73A404263C2CA2E2B31317082CC7045DB336685A754893B97FF8DFCD8A79A296
SHA-512:	5762D3F6AF58D5E591FCC5977FEF456A9B04DBB23101FFB0E65ABBACCE1A262A910612AE6D91392869F904C7E1983D87546BBD0B1BC0F6B5805C424A0BEA3BCE
Malicious:	false
Preview:	<?xml version="1.0" ?>..<root>..<FileVersion>0.2</FileVersion>.....<Chinese>..</Chinese>...<English>English</English>...<French>Fran.ais</French>...<German>Deutsch</German>...<Italian>Italiano</Italian>...<Japanese>...</Japanese>...<Portuguese>Portugu.s (Br)</Portuguese>...<Spanish>Espa.ol</Spanish>....</root>..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Reports\Images\Fail.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 14 x 14
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	5.265366768159026
Encrypted:	false
SSDEEP:	12:4TfRRiQdQ2jR+1JaPJaS6f/eflgs9zUE7sXh3FtuRSKK/sHpe:+RRikQKnsS63eflu1tpKNJe
MD5:	E5E833A48167CAF7B68EBF149BF9CC6B
SHA1:	D62F848372A6DCE467F377C2438A1EFCFAD8656A
SHA-256:	F20867FB2F49CB098E47D66D91D60C92071EAABA9E6CF3EFAA8299642903F3A2
SHA-512:	1A13BF118C8329F7387A533443E7655C4988AFA504016562937108CD04072F098C38E7579C6363CFC6973A5DCBB9E19B00274E7ECE7C4A24DF4187A060544D9E
Malicious:	false
Preview:	GIF89a....................................................`..S..............~.............................L...........................%%...Y...44."".<<c...BB.55.AA.==.DD.II.::.MM.AA.FF.AA.RR.VV.FF.aa.[[.SS.GG.dd.dd.``.EE.YY.rr.mm.UU.{{.zy.qq.ee.ll..........{{tDDL........sKK.vv.jLL....oo....bb...PEE............nee\UU.........................................~}}.............................................................................................................................................................................................................................................................................................................................................................................................................................!.......,..............."..$U..\..I.(T....C..9Jl..B...+`...%..0?.$@.eG."y.....O..&........2@`.qF..8K&d.......&.1......"X.S..c......Y.0.p.&8....B.;a<...%B..d.4..G...".(.@...3x.....e.. \|.P`.).T..RgO.z. ...t@.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Reports\Images\Pass.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 14 x 14
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	5.535483891602877
Encrypted:	false
SSDEEP:	12:RFsNIgbr01ATet0hTpxp71vTFPLx7WkijGuyt8D1W6v0XDDE:RCi6TetCF1pPZf5yg8
MD5:	A92C02AD2ABDA6DA102422F6E724353A
SHA1:	39D68A19CB91E4A9FD24CFAC6BC430B01AD37E3C
SHA-256:	2155F51C2E4D072648A0205C73BCB81013A1EF7598A59449A2F3408AE8315468
SHA-512:	305F261E0EEAAA534CF8C99A3B7EFE95F2EC037A0378317FC5D113A0E0667E526F40CBCF2133057B411ECC350584DB403545F8DD701F3923C4EF6B3C91386D8F
Malicious:	false
Preview:	GIF89a.........................................."..q._.......t.(...g.$w..Y."t.)...D.&z.)..-..4..,..;..6..?..:..2...=.$].L.)P.,C.%X.2:. Q./].6Z.4].8a.;[.8\.95x -g.^.;[.9b.?U.7b.@d.Bb.Af.Ec.Ci.F].?j.Ip.Nu.Sq.PN.8w.WF.3S.=.U"~._k.Q..j..ei.Sr.Zv._w.`..r..vn.[..{u.b...w............1A,v.k......................#q...PqE.............R]N......\|}{................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,..............\.%..,[..\..M.'U. ..d..6F.Lq"....8..\|....;l.....9...hAcG.....`..K.+%N..q.E..r.t......Gl..B ..0.\....)..4..BC.?_L..S...%.Bd.P...( L.A.$............(.0.P.......2....$..cg..3kFP.p.. <...I....>.

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Reports\Images\Print.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	833
Entropy (8bit):	6.523218022078118
Encrypted:	false
SSDEEP:	12:HV26uFZ7PX2d0lenSXlXjlHOOlQp+2o8ZHdAJOKwJ5YzOF6b8r4di:HV2TXT2Oen2TlHOBpZHGsKwJ5IOMI6i
MD5:	D272E52F99C17CB512AF3224D7C9AFBE
SHA1:	95563575A06855D5FDEFB5A8DBF522D087120DBA
SHA-256:	20024D710A9D8370A8A5CD7C1B8D2BA237C4081FBCE46F58923B210F0C89C12E
SHA-512:	6E1479210198514A33C3882774DD87FCBA3DC396F75A07F1D497B53F4808D93DC51BDB74A5CB81E4568FB9A873D83E2A62CCE7147DC6440874FA40215A579DAD
Malicious:	false
Preview:	GIF89a................LLO......BBC.......................................................................................................................................................................................ppp```QQQ...............................................................................................................................................................!.....K.,............55................6411.1...566..6.+...+..3...5..$..$....0.(..(!.36...5/. #.......&.".."./../.."'..-..../..'..()*..0.D,$!<??B...@!.......@..!...a.`.......U.a..........y.1....<z... .I.....(...A....."..=.H..C(..5...JT...B..H.C)...X..`(..(M.D d........H......q6.."E.4.PD........A.".}.)q.".?......J.s&0b...C.$Q.@. .Bv....._.D, I..H."=r...........` .o#C\|,.....!=J.....X.=q....,...8.....xA6~.........&....;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Reports\Images\PrintPreview.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	846
Entropy (8bit):	6.751192056333031
Encrypted:	false
SSDEEP:	12:HqhX4vy7HSGJZIo58shvxD/vE7KrtssWh7bGPiSp63VJwBqvpZUdkuoW/87llQPj:HvPoOiEIKsWVbGPnU3V9v7U+uoWkMR1
MD5:	9645352FE0317D70AC86B3BB5926CE9A
SHA1:	208B0EA204A7B30AD56D66FC246C8A95FFC34265
SHA-256:	6D087E6EC1CC9B3D402CEA2FC2DF119DB0E3D878079A48315AC9BF111F5FC213
SHA-512:	741F4977CD76CF9B24654259D358311957D75D589DFF479627E7B385CA81C042E45DA17AD22116C45272CB212320E832469B9BE30FA300A7EC2E3BBA7391AED3
Malicious:	false
Preview:	GIF89a........}.........................\]......tx........fk..........v...............................................d................................................L..\|.............................................a..E....]..:.q]......................................................................................................................................................!.....S.,............O.OOG.BODP.....G...G#...#.#NG.P.....//33..&&.%N..O.*.B...D?(.5%.........(77.9#.?..%.......%8:'...O...3.;....ED..#EBD...!.!..... @.. z..EH1...=:L.`..."....$@.....<..C.. ...F.C.y.z.....M =...p....Q6....a..C.......'.8..A.$.!I.B.....7.<..d..";......!"..x....F.7.<11a-.!..P.A....5.........9B...%J.8..Ci..$X..... ...0i.A.....\........IQ.d...1Z.oA...'P&..= ......d.......].x.Q.8$.]@.p.0`. ......h..a'm...'pz......(...AAD .;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Reports\Summary.htm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with very long lines (1119), with CRLF line terminators
Category:	dropped
Size (bytes):	27309
Entropy (8bit):	5.142584203316861
Encrypted:	false
SSDEEP:	768:fw69GW2swS3NvxGKjiK2wiIfxti3X3NEwNRGfzjP:7GW2swS3NvxGKjiK2wiIfxti3X3NEwNU
MD5:	5054B33DC911BC5C1DE0657BCA5342D1
SHA1:	9909EE82777182FF3930E8F3650C0B0FAD13E377
SHA-256:	24D4A69F0960E870BA6B12B7E454CBBEA21097468CB53B95A4A670F453095EF2
SHA-512:	4C7FB621190118A50C2D63A9DBC815DAD14E470A6D669DA84741FDFCFD5C049FCD0B63A640FEBDB365033F0D547729396244FEBE2F09BD3EC13D13340901C885
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<html>...<head>....<title>System Report</title>....<meta content="Microsoft Visual Studio.NET 7.0" name="GENERATOR">....<meta content="http://schemas.microsoft.com/intellisense/ie5" name="vs_targetSchema">....<LINK href="reports.css" rel="stylesheet">....<script language="jscript" src="../scripts/common.js"></script>....<script language="jscript" src="../scripts/xml.js"></script>....<script language="jscript" src="../scripts/tables.js"></script>....<script language="jscript" src="Summary.js"></script>...</head>...<body style="BACKGROUND-COLOR: #ffffff" onload="OnLoadPage()" onunload="OnUnloadPage()" scroll="yes">......<XML ID="dsoRoot"></XML>....<XML ID="dsoApp"></XML>......<DIV id="divBody" style="WIDTH: 6.7in; HEIGHT: 9.4in" style="DISPLAY: NONE">.....<div>......<table id="SummaryPage" border="0" cellSpacing="5" cols="1" cellPadding="0" width="100%" style="BORDER: gray thin solid; ">.......<tr width="100%" valign="top" s

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Reports\Summary.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55341
Entropy (8bit):	5.446758143787182
Encrypted:	false
SSDEEP:	1536:fTfDTAZWUI+QtVTK209voN0kBCaSkCLz2pZBc:Q9voN0gSkgaO
MD5:	FFF43540C49F10FA16DE9DC49BFB239A
SHA1:	EB1348FFA4F40327FD0B0978E21F8E2ACE6DC028
SHA-256:	924629990AAE104613BDC7130269C12C5FAA5ECA452E18316E4F80B6FDEDB885
SHA-512:	C7B132A825EA2E7F151028839C0AEDF6B0736481E050F5AB13E0BFB17D80B203DEDF5975FC9268DBCA8E5F73CC9D76EA1E68FBEDBA45AFEC69CD61F916B0A69D
Malicious:	false
Preview:	// JScript source code......var Host=window.external;..var Objects=Host.Objects; ..var Application=Objects("Application");..var AdminMode=Application.AdminMode;..var Processor=Application.Processor;..var iActive=Application.ActiveSessionIndex;..var DataSession=Application.DataSession(iActive);....var AmpCheckFile=Application.AmpCheckFile(iActive);..var BeamCheckAnalyzer=Application.BeamCheckAnalyzer;......var Header;..var Setup;..var SystemInformation;....var FileSystem=Objects.CreateObject("Scripting.FileSystemObject");.....var QcSettings=null;....var AdvProbeConfiguration;..var ProbeNBeams;..var DischargeMethod;..var KeypadMode;....var kDischargeMidSection=0;..var kDischargeMeanSection=1;..var kDischargeJapan=2;......// Mounting rod settings..var colProcessing=Application.Settings.CreateNode("Processing");..var nWRodCorrectionType=colProcessing.GetItemValue("WRodCorrection",0);..var nCorrection =0;....var MountingCorrectionFirmware;......var StationTable;..var GaugeTable;....var nUni

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Reports\reports.css

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11873
Entropy (8bit):	4.95285292475223
Encrypted:	false
SSDEEP:	192:69yrn8S9EWDsM8EU/XDjEryUlQOQAqKFsynL5h0MltxWkOa1q6bPoxtfDW:xPUsWUltT5Lwk
MD5:	BBB04FC7601A99538F8BC6CE0F9E49FA
SHA1:	C46962BAB95F24EBF74545675ED7CEFA95A98AF2
SHA-256:	C3CB0FAD15DB324FD463119F0BCA2D7196C95C836BADA76D9EBEE3B44FCA08CF
SHA-512:	BA385D6CF396904884BBDBA7EEE646FD0B140E68029FB2596D466902A3EF7E747087EB5A7CC8CB883486C85C4A61E46D762C4B36303AEEE374CCDB7F8E5D26BF
Malicious:	false
Preview:	body..{...border-right: medium none;...border-top: medium none;...font-size: 8pt;...margin: 0px;...border-left: medium none;...color: black;...border-bottom: medium none;...font-family: 'Tahoma';...background-color:white;...text-align: center;...cursor: auto;...vertical-align: baseline;..}....a:link...... { color: blue;...... ....text-decoration: underline; }............a:visited..... { color: blue;...... ....text-decoration: underline; }............a:active..... { color: blue;...... ....text-decoration: underline; }............a:hover...... { color: blue;...... ....text-decoration: underline; }.....MainTitle..{...font-size:18pt;...text-align: left;...color: Black;..}.....BoxTitle..{...padding-left: 5px;...font-size:9pt;...color: darkblue;...text-align: left;..}.....RowTitle..{...padding-left: 5px;...font-size:9pt;...color: darkblue;...text-align: left;...border-right: gray 1px solid;...border-bottom: gray 1px solid;...vertical-align: top;..}.......DataTable..{...border-right:

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Scripts\common.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5375
Entropy (8bit):	5.250285825083762
Encrypted:	false
SSDEEP:	96:wbCrw1wWwpGp+SGEpywn2lmrbSpUwn2lrmQz5gRJWxgtdSMdsvtFbmOQZQcyyv:wbuelpyI2ArbSpUI29mc5HxgzQcZTtv
MD5:	8F85E6BB7ECC54FE16D0159896EDF5B6
SHA1:	285A77526AF8A6AB48AE0AA87BEE7DD9F6316E96
SHA-256:	9F4732B5CAACAECF98C91C1EAB2DADDD5E9BE2B06EB46B9B7474C6D25D9ABC5B
SHA-512:	18A62313CDD875E652759D0A15044A13414E06CB33A2B0F74F58CAB75C09744D47E536DA3A9D32D4AEFADA71D45E2DC7A92143B7B9F7B629ED1FAE8CFAEB8A58
Malicious:	false
Preview:	var Popups_oPopup = window.createPopup();....var decimal_point = ".";..//decimal_point = ",";....function ShowObject(name,object)..{...var w=Objects.CreateObject("SonDiag.SonWatch");...w.AddObject(name,object);...w.ShowDialog(0);..}....function ScreenLeft(elem) {...var val=elem.offsetLeft;...var elem=elem.parentElement;...while(elem!=null && elem!=document.body) {....val+=elem.offsetLeft;..//..window.alert(val);....elem=elem.parentElement;...}...val+=document.body.clientLeft;...val+=window.screenLeft;...return val;..}....function ScreenTop(elem) {...var val=elem.offsetTop;...var elem=elem.parentElement;...while(elem!=null && elem!=document.body) {....val+=elem.offsetTop;..//..window.alert(val);....elem=elem.parentElement;...}...val+=document.body.clientTop;...val+=window.screenTop;...return val;..}....function Popups_OnClick()..{...//debugger...var elem=window.event.srcElement;...var bGo=false;...while(elem!=null) {....var term=elem.getAttribute("term");....if(term) {.....bGo=true;....

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Scripts\equations.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2325
Entropy (8bit):	5.423574396421245
Encrypted:	false
SSDEEP:	48:kdoV2sJMqiUfHoEYCiUwTAYShlV1l3XHwDwZlawZlL:u0oswPFTAXhl7l3L
MD5:	1AAEFBBB88EB5C7F51C62354AEF9A793
SHA1:	6A75C316415CF81A629BEDEECE7E4C908B441B06
SHA-256:	B34EFFE6C9343FC03D6E12B3D658310B7548DD6CDDFD542B7432155131C9A3FA
SHA-512:	1B988F1B15BC7089490A898A9C71C94E0A6430B4AA1D34757DE8C97F08439D3126ED1045C7A47405C182680BBC9AEBC1A409E76987578434F50522EF25A5F438
Malicious:	false
Preview:	....function GetQuadraticEquationText(colQuadratic)..{...var sText="";...var sArea=GetXMLText("Area");...var sStage=GetXMLText("Stage");.....var dQuad1=colQuadratic.GetItemValue("Quad1",0.0);...var dQuad2=colQuadratic.GetItemValue("Quad2",0.0);...var dQuad3=colQuadratic.GetItemValue("Quad3",0.0);...sQuad1=NumberToString(dQuad1,10,3);...sQuad2=NumberToString(dQuad2,10,3);...sQuad3=NumberToString(dQuad3,10,3);.....sText=sArea+" = "+sQuad1+"("+sStage+" x "+sStage+") + "+sQuad2+" x "+sStage+" + "+sQuad3;.....return sText;..}....function GetPowerEquationText(colPower)..{...var sText="";...var sArea=GetXMLText("Area");...var sStage=GetXMLText("Stage");.....var dPower1=colPower.GetItemValue("Power1",0.0);...var dPower2=colPower.GetItemValue("Power2",0.0);...var dPower3=colPower.GetItemValue("Power3",0.0);...sPower1=NumberToString(dPower1,10,3);...sPower2=NumberToString(dPower2,10,3);...sPower3=NumberToString(dPower3,10,3);.....sText=sArea+" = ("+sPower1+" x ("+sStage+" - "+sPower2+"))^"+sPowe

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Scripts\errors.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1479
Entropy (8bit):	5.098826892698136
Encrypted:	false
SSDEEP:	24:1rl7mRespntCayRZ7UTs/QOaV9yWWYmdmWUpRmM6Zf+AWVnEgRio78Wm:1rlCTnt7yRZ7UT+QOaVCDdNUpRmPZm7y
MD5:	FDB5EC1A448467D466BAF7CF74794B0A
SHA1:	5C4BE3E0A7BD081AACD91F89E02C025C13166ACC
SHA-256:	CF2439C6265C1B7DAB159AE505F9A4FD4B88BAA8A8A1D576D25BDCE735F790DC
SHA-512:	97050D1132FAC81E74E66195A6BDA7E73BD8700363D10009029FD36913DC0D5D75A88442DDE1C81DFFA30A9CA8FB43EE43EC639E4E3BC4F20D70CF59C4AD273A
Malicious:	false
Preview:	..function GetErrorFormat(sErrorCode)..{...var text="unknown error code - "+sErrorCode;.... .var oXMLDoc=dsoRoot.XMLDocument;.. .var root=oXMLDoc.documentElement;....//.window.alert( "Test XML:\r\n" + root.xml );.....var errors=root.selectSingleNode("Errors");...var node=errors.selectSingleNode(sErrorCode);..//.window.alert(node.xml);..//.var attrib=node.attributes;..//.var text=attrib.getNamedItem("string").value;....//.displayTree(node);..//.window.alert(strDisplayTree);....//.window.alert(node.xml);.....var child=null;.....//.window.alert(node);......if(node!=null)....if(node.childNodes.length>0).....child=node.childNodes.item(0);..//.displayTree(child);...//.window.alert(child.data);.....if(child!=null)....text=child.data;.....return text;..}....function GetErrorMessage(sErrorCode,sParam1,sParam2,sParam3)..{...var sError="";.....if(sErrorCode=="")....return sError;......var sFormat=GetErrorFormat(sErrorCode);.....var s1="",s2=sFormat;.....var nInsert=s2.indexOf("%s",0);...if(nInser

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Scripts\functions.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2095
Entropy (8bit):	5.275385291638543
Encrypted:	false
SSDEEP:	48:mjDFBxpN2gRueTL6ozMW0+rjX3Qitzl4PZd2E92E1dR2EsaJ/04Wohpu:aBBJGKyXY737t+j2y2ob2mJ/7hpu
MD5:	B0C33B52652384634A5D1D9D86713F7F
SHA1:	DCCCAF05BA4EB304034C76E977CB6D1F21BF1293
SHA-256:	8914F64A7CC46A4D757DB858F3D4A102B37E9C51BD6E3AE11BCDA28686FC1B1F
SHA-512:	EF8876660B955C503BD7D31AE084D5E544FEA25A20FCA4141714F8CB53D3799151164F24FA195E058348F2A4AB50A38ADE8616D7B62B0D1BFE3C4322EC80781F
Malicious:	false
Preview:	function ShowSection(sSectionName,bShow)..{...ShowControl(sSectionName,bShow);.....var sDown=sSectionName+"Down";...ShowControl(sDown,!bShow);.....var sUp=sSectionName+"Up";...ShowControl(sUp,bShow);.....PageSettings.CreateNode("Sections").Item(sSectionName)=bShow;...UpdateLayout();..}....function GetSectionSettings(sSectionName)..{...var Sections=PageSettings.CreateNode("Sections");...var bShow=Sections.GetItemValue(sSectionName, true);...ShowSection(sSectionName,bShow);..}....function EditNotes(iIndex)..{..//.window.alert(iIndex);...var sCmd="EditSourceDataNotes "+PageName+" "+iIndex;...Application.Commander.Run(sCmd);..}....function EditDetails(iIndex)..{..//.window.alert(iIndex);...var sCmd="EditSourceDataDetails "+PageName+" "+iIndex;...Application.Commander.Run(sCmd);..}....function UseData(iIndex)..{..//.window.alert(iIndex);...var sCmd="UseSourceData "+PageName+" "+iIndex;...Application.Commander.Run(sCmd);..}....function DeleteData(iIndex)..{..//.window.alert(iIndex);...var sC

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Scripts\quality.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.328321365681353
Encrypted:	false
SSDEEP:	96:dcriTHf8/jPd0W3P8FnG+QzrpAzHSndESs:CrSHf8/jPd0W3UFG+arpAzHSndESs
MD5:	FA1F4C30A5A366F43DE0984EA86A939B
SHA1:	DE2B6DB0354E596099AE081B7CDA25C907DF213C
SHA-256:	FECB6842EC0EC251D878574F8FA0D1C137C270B80AC43F9E0000C47AAAC2767A
SHA-512:	F7A43F13250664FA77EF9543280AC8E79B4E543A36FEF8055B839B3300C8E980A270F8E779AEE2E34C03581C4D6E2B3A925E276798B282268A51EA22E9A4E8DC
Malicious:	false
Preview:	....function GetTotalQualityScore(node)..{...var AR2=node.GetItemValue("AdjustedR2",0.0);...if(AR2<0.0)....AR2=0.0;...var Qs=AR2100.0;.....var nodeQs=node.CreateNode("QualityScore");.....var dOc=nodeQs.GetItemValue("ObservationsCorr",1.0);...var dKs=nodeQs.GetItemValue("KolmogorovSmirnov",1.0);...var dHl=nodeQs.GetItemValue("HighLeverage",1.0);...Qs=QsdOcdKsdHl;.....return Qs;..}....function GetQualityRating(QS)..{...var sText=NumberToString(QS,10,1);//+"%";....//.var sText=NumberToString(QS,10,1)+"% (";..//.if(QS>=80)..//..sText+=GetXMLText("Excellent");..//.else if(QS>=60)..//..sText+=GetXMLText("Good");..//.else if(QS>=40)..//..sText+=GetXMLText("Fair");..//.else..//..sText+=GetXMLText("Poor");..//.sText+=")";......return sText;..}....function BuildQualityScoreTable(TableId,insertbefore,node)..{...var eTable=CreateTable(insertbefore,TableId,"ReportTable",3);...eTable.align="left";..//.eTable.border=2;.... .var tr=eTable.insertRow();.. .var td=tr.insertCell();.. .td.colSpan=3;..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Scripts\tables.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8046
Entropy (8bit):	5.221858761978299
Encrypted:	false
SSDEEP:	96:kxFgnaws1vDBr9XjxVukFq3nTiNjin1csfQDsmGjZx/PbPmGnJTUHCUGInMS1ruy:kxiaXvDBPFueYysf9b/TPrJqlMij
MD5:	E23D734BD0F38DB83D54D5196F9A9A10
SHA1:	A808EB95B17250B1AAC9125A632901B21551F178
SHA-256:	A28D4C1D87F2A41DC06EDB05328D246151CCCEF2C32A95EC38DE177F37C44EB7
SHA-512:	3C3981294DD9A790F9603E2B28D55AF201B994ED46BBFD53EA4E9A863A9965CEF3DB195B66047CA66C48637470EC0701BB60E726ED6CBBFDD1CC468C4268A3DD
Malicious:	false
Preview:	function CreateTable(insertbefore,TableId,classname,nColumns,bShowHeader)..{...var eTable=document.createElement("<TABLE id='"+TableId+"' class='"+classname+"' cellspacing='0' cellpadding='0' cols='"+nColumns+"' width='100%' align='center' >");...insertbefore.insertBefore(eTable);...return eTable;..}....function CreateStatisticsTable(collection,insertbefore,TableId)..{...var cParameters=collection.CreateNode("Parameters");...if(cParameters==null)....return;......//.ShowObject("Parameters",cParameters);.......var nc=cParameters.Count;...if(nc<=0)....return;.....var eTable=CreateTable(insertbefore,TableId,"StatisticsTable",3);..... .var tr=eTable.insertRow();.. .tr.className="SectionText";.. .tr.bgColor="moccasin";.. .tr.vAlign="top";.... .var td1=tr.insertCell();.. .td1.align="center";.. .td1.innerText="Variable";.... .var td2=tr.insertCell();.. .td2.align="center";.. .td2.innerText="Minimum";.... .var td3=tr.insertCell();.. .td3.align="center";.. .td3.innerText="Maximum";.. ....for(var

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Scripts\xml.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2871
Entropy (8bit):	5.248743622203844
Encrypted:	false
SSDEEP:	48:jIsBxz7zdCuOXV2Oa7Q6C2zjdquoaHTsFXYxKFm7F9YOanwxR3M2ue5RdFQzRS/L:c2xz7z2EoFU/3Ysu5ByR/
MD5:	1BCD17478C6C339AA411ACB58145A451
SHA1:	B2CF46752795EF5F4E98425F68C13E223B940158
SHA-256:	161434904AE20002F2657CFAB00D815060FF47D90F43DAAE3D9061B6E87B88A8
SHA-512:	580080DFC0CB2EF3DD36DB6B8D40AF9433440C53C890161F9D2CC558EBBF5E98CB3D5FD7D1A27C69C115348AA8FDE544072087EFFB296F815F4754225B6169CD
Malicious:	false
Preview:	function XMLTest()..{.. .var root;....var objXML = new ActiveXObject( "Microsoft.XMLDOM" );..objXML.loadXML( "<root>\r\n" +.. "<element1 attribute1='value1' attribute2='value2' />\r\n" +.. "<element1 attribute1='value3' />\r\n" +.. "<element2>ABC</element2>\r\n" +.. "</root>\r\n" );...root = objXML.documentElement;....//window.alert( "Test XML:\r\n" + root.xml );.....var node=root.selectSingleNode("element2");..//.var nodes=root.selectNodes( "element1" );....//.window.alert(node.childNodes.length);...var child=node.childNodes.item(0);...displayTree(child);......window.alert(child.data);....//.ShowObject("feedback",Feedback);..}....function GetLanguageXML(settings)..{...var colLanguage=settings.CreateNode("Language");...var sPath=colLanguage.GetItemValue("Path","");...var sSelected=colLanguage.GetItemValue("Current","English");...var sApplicationName=colLanguage.GetItemValue("ApplicationName","");...var sXML=sPath+sSelected+".x

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Toolbars\Standard.toolbar

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	6975
Entropy (8bit):	4.46375723921266
Encrypted:	false
SSDEEP:	96:ysY1pJNOtJyg4DH444HVJ0NOtJyg4Ds8LyNnqj3NbVh8S6DGpXT4gmSsIgkMuIEZ:zGpGKDH444HtKDtLpj4zDkMST
MD5:	0534EAE2EAE8745F09FB0506206E7CE1
SHA1:	EFD87C600613ED30C2A81C8B904E90AB775EB193
SHA-256:	21002EEE68A41B0A06B8B430C60E5341897351DA76D9E06BF1E9E2A82ADDB1E5
SHA-512:	A4EE9EE930D7091270C5B2E2AC10D80D988B7D51C85E14CE4CD4B808F2CDB2913F7D1BF8ACBB84B8B3B69B2C38F79E81457819AFD6A85E6B90A60B2564D13C47
Malicious:	false
Preview:	....}\|.......@Caption..S.t.a.n.d.a.r.d..@Command...@Id..S.t.a.n.d.a.r.d..@State......@Popup....&Open$....}\|.......@Caption..&.O.p.e.n..@Command..O.p.e.n.F.i.l.e..@Id..O.p.e.n..@State......@IconFileA>.................(.......(....... .................................................................................................................3333....33330....3333....33330.................................................................................................................................................&Save$....}\|.......@Caption..&.S.a.v.e..@Command..S.a.v.e.F.i.l.e..@Id..S.a.v.e..@State......@IconFileA>.................(.......(....... ................................................................................................................3.......3.......3.......3.......333333..3....3..0.......0.......0.......0.......0.......0.......................................................................................&Print$....}\|.......@Caption..&.P.r.i.n.t..@Command..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Flags\Chinese.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 30 x 20
Category:	dropped
Size (bytes):	632
Entropy (8bit):	5.617438740737044
Encrypted:	false
SSDEEP:	12:tIxo4ziWLfT89LqZ+1D62odvFk31XveJEw2veEF67a:tuo4ziqfT85p4XdtC0NaNF67a
MD5:	E12A8DBA07B9527595A0A9EDDB189ABE
SHA1:	5448150C76517D391D846D3CE1DAAD2241A30B8A
SHA-256:	8489CD86874C5C7B507AC748A786326EC6FED48235DDD42729FF28816B4E0030
SHA-512:	F57D272EA3DEC94B790AA8ED202038B8B40FC5EFCE26A664F48455F5BD52992B8282F20C2BBA45B62ACABBC309BC68A0FDE216B6443AEBAAEC51968A330428EB
Malicious:	false
Preview:	GIF89a............................................v..u..z..x..w..t..p..m..a..X..c..Y..+....)..(..e..3..d..W..Q..P..H..G..B..-..P..A..>../....)..(..'..$..>..:..4..1../....(....)..(..'..&..%..$..#..".....$..!.................&..%..$../..0..-..+..%..$..#..!../..,..+..!..2..(.........................................................................................................................,........@..UG......TG.699.6.9...............G9.....".9.......-..........-9D..?...(...JG-6....?.9....9"...JU.....-.........6.......6......d.....T."v..'"....q-.....1.G."..#,....Fs..%S.k.&G...$92.(F.,e.t.SM.@s.....%T.(]...V...;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Flags\English.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 30 x 20
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.785849732560837
Encrypted:	false
SSDEEP:	24:FuGvIYNZGxuEJIbdapNy52hOdfK8traCF:FXQYMuEJIbdapI5fdvrpF
MD5:	54BF7E69DC684C6B67156BEA72C89FD7
SHA1:	27A089BCADAA9051023871FC34A7182235D90460
SHA-256:	3EEC3CD64F4C7297396D24125BDCC8A23B50115323EA35C4B6EEC25F88B45232
SHA-512:	D5A6A375151B2E16550090819BBDF30C916072EC7212EAC5E8434868027988F4F95654F05EF979EA98F5F0BF2EA04B5779E9F331811B88CF4FEA70554F5F9DBE
Malicious:	false
Preview:	GIF89a..........................................................{..c.........s..k..c.........s..1Z....Z{.Rs.!J........s..k..c{.Zs.9Z.1R.Zs.Rk.!B..1{.....c{.1J..9..){.!s...{..s..)B..)..!{...k{.!9..1...s.........k..c..k.............................................{....Bc.9Z..1..).........c{.Zs.Jc..9..).......{..Jc.Jc.BZ.9R..1..)..!..{..s..{..BZ.9R.1J.)B.!9..1..)......k{.Zk.Zk.Rc.!9.!9..1..)..)..!..!......JZ...ks..........................................................................................................................................................................................................................................................................................................................................,........@........F. 5v$$r..Eu( T....'y.d...G.........(..B..G.D~..@...3.B.!R..9.v..@0..6H: .....Bn..@`...9...P.(....8..A.@.....].`I..j..Q;.m..R..%..J.7U.<.....Kk\|....X.."cX.a..H~.......a..T`bE....^.%N..Q.....

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Flags\French.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 30 x 20
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.668500482823013
Encrypted:	false
SSDEEP:	3:CCklVFnI9JgWs/lJllgh9zEruXXjZOrx0ag8gTfwXc7hkH07H7dCh6ptYAEpEn:FkljI9JRTh9zEruDcnfgTYXgkHC5iXBE
MD5:	D8E548E4839D817EA9FC56B80B1C9D92
SHA1:	384DE010F5DA1ED026BB7787D52D0D82CAEBA637
SHA-256:	29087AAFD975A618061A172033BB28F95D77910F58A7DAD83E19F50A7640594C
SHA-512:	FFC45D7BED804EDC539A795AB0D4E41CAA2735C1BBECC86C2F2C02AF9442903541262A7E72D54895293C8DB0368767E43CDF09AC92A38C8D8735D5406DC33693
Malicious:	false
Preview:	GIF89a..........................8..7..(..$...................................................................,........@.k.#.#..h..G...K......3Y.(.n..N@..(3:~.%..DFs..j.....v..v..rR....[....=.^.ytWr\|.g..xpzm..~..=yA.M.u..!.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Flags\German.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 30 x 20
Category:	dropped
Size (bytes):	363
Entropy (8bit):	5.918540505644111
Encrypted:	false
SSDEEP:	6:F9Rz9Yqc9bCT7+xy0lmo5qnHdbW5YcWC8mdmKUlMXRqZ/eed/n:TRxYry0MvMeHld3n
MD5:	9D5DD21CBDB0305F165B2522A88B1E67
SHA1:	29BD5AB90F3CE622CD6C1CFF237C2B9A81012EA9
SHA-256:	38DD6E46EA8821FAC1846AF18CC434DCD13F8AC956F0CA5E4292E854FFD226EE
SHA-512:	4013438E8132BBC61AB2F4DAD0687BC4F3449E05757A5C51F328831454E4EDDAF47E52B589B6837EB79053186AC05DDF3EAA1450384BE8ED46170549312B777B
Malicious:	false
Preview:	GIF89a............+..+..)..(..+..)..(..+..0..)..(.....*..0.....(..'./...(..(.....(..'..%..(..'..%..'..'..'..&..$..&..&..%..#.E..D..B.......................................................................,........@....pH,......8...9RX..,6..j.]..I..7.z.ncF...D....<}........#.........a._\^W..r......OK.L....Lh...~...m..i#.........[......`....b..............A.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Flags\Italian.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 30 x 20
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.4143244933679
Encrypted:	false
SSDEEP:	6:F9bt4PnMPkRguOAcvobzjuaET0sBbhct9skLjHsjn:TBWnMPkR7OA2ayaEIsNGz0
MD5:	9800736271213110E0082385153EFBA1
SHA1:	41DDBA88DE30C0BC3915ACF7FF245BE4F4FF4C5C
SHA-256:	0FEA332A4AFA8A39AA79A5C37E410CFAAFBAEC342423DD73AB1FC9622DED80A3
SHA-512:	A209195E0AA62C454DC63573737A6E443BB7F7B9D904C11FFF2D37890FD44A7B3342873E0631CD64B0284167C06F2BF310C5A9D8740C3BE8FF1570AC0E540102
Malicious:	false
Preview:	GIF89a........'....W.:.'...........(..'..)..)..(..'.V.:...S.5W.;Z.@.(..)..(.....................................V.;...........'..(.+.......................................................................,........@.Q@.pHL...r.$:Q.h.I==..c.y.f.[e......9<.........{:....~Y.r\|[x.z..}...Wv...U..aA.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Flags\Japanese.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 30 x 20
Category:	dropped
Size (bytes):	580
Entropy (8bit):	5.613134035059288
Encrypted:	false
SSDEEP:	12:19lzXCQfl5VEEZsvsQWLsL0yD4oSzMK1QaxPJE:NzXCQfhEGsqsAyIzBRE
MD5:	691D88C063B49561689457F36C4B734E
SHA1:	202E013296B1F65C5BACE5AEF8D4B7B385989FD3
SHA-256:	56A8E5E4B01887F5D2119E36EE9F6B3A3A79CD209C5614F43662A756F27A8177
SHA-512:	10F55561E4901482EF43974FFB8E92E1138FD8A0A85C80E2EF6D03F2990CDD6C822F740325D40879AB26C748CAB7C30150CC576E6AB7341B6DA3DFA86DA01E7A
Malicious:	false
Preview:	GIF89a...................................................................................................t..v.bI.aI.aD._B.Q1.Q0.D'.D'.0..,..,..)..(..(..(..'..'..&.....)..(..'..&..%..$..#.. ........!.. .................................................................................................................................................................................................,........@...GB............6.4..46)...FB.............'.#......'...<!........<...-.....<..60.....3.6<0............ ...*.............<=.W.R.`.A{u....0X.`(O.7#.6i...#.......;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Flags\Portuguese.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 30 x 20
Category:	dropped
Size (bytes):	1178
Entropy (8bit):	7.694880711110164
Encrypted:	false
SSDEEP:	24:FqsyqESvE7Can2T4dPbqAMm2ZDmWX/Od90z7Mb+fopw3gbWcmLmnM:F3PiCa2MdzqAS5vGd9KR4wQ27
MD5:	6FF5D4DFEB71B5F5BA22FED2E2E49283
SHA1:	B9193E5615B58DD682535C5083DB2087B960100C
SHA-256:	B40978D17DC734334C21D43A819EFBC12E2B64515D4D630D7DED5A637C5AF326
SHA-512:	0B65C5B19B372ED65F69BD671760D870C47A29712CF1957C128581623786903C82B981AAA05FF9042DD868A5A168E9C7F5007B09A3B4FBD27672B85519CEFBEB
Malicious:	false
Preview:	GIF89a...............................................................................................................................................................<................................ ..$..............\..2........4..............[.............C..E.....P.. ....$..P..$.....%..W..&..'.......)..c..........+~..~..\|..{.-{.hz.-w.-u./u.ss.zr..q.0p.0p..o..l.1k..k..f..e.3e}.d\|.d\|.c{.a.4_x.Ws.V.7S.8So.Sn.R.9P.9Pq.Pk.Ok.Oj.Nj.L.:J.;H.<H.<Hg.Gd.F.<Da.Da.C.=C`.C`.C`.C`.B`.A_.A_.?^.?].?].>.>>].>].>].>[.=\.=[.;Z.;X.:.?:Z.9Y.8.A8W.8V.7W.7W.7V.6V.6V.5.A5.R5.R5.Q5U.5T.5R.4.O4T.4T.4R.3S.3R.2.B2S.1.B/.C/P...C.O.-M.+.DK.).D(.D&.E$.F#.H#.G#.F#.F#.E".F".F".E!.H!.G!.F!.C!.B!.B!.B!.A .E .H .D .G .C..H..G..?..E..H..G..@..E..H..H..H..H..H..I..H..I..J..J..I..I..J..I..I..J..I..G...,........@....m.H......>+WN...J......(Z......D.;.+....(Q..7II..A.1LI.d.g...."C....L...f.%.....B.(.$q.%..'QpJ. ..XQ.H..\|.f.3.b....2..5.q..LQ..E..C..\-'.2. .A.'P..r.....&[..P2.dX.....@.M!E{...!......^.z.>..q.fm.Z.g

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Flags\Spanish.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 30 x 20
Category:	dropped
Size (bytes):	575
Entropy (8bit):	6.4661914148475566
Encrypted:	false
SSDEEP:	6:FGluAsJBDjGdgJnhTy3bJR1ugNej/8QIU0OoRINEhk/GBFWgBkbmbHi88+a4pojH:pT7jVJE3b1ug0T8QzUawkb2Cyaes4a
MD5:	4BC03DF38756897FCADF692B5DB15F72
SHA1:	536B88637625E2A4D417E0F9FF6E612D144F6417
SHA-256:	13A85CB607D2EF39A79B29096D095D373BD2BAF1C50DD028E500B1129BB51B98
SHA-512:	9DB9CD3BCC86A90AC5F4191B632BC0088F74A479D4FC9743F96994F3F9890C589055EF416F3D2E46D283FCB5F391238A2B8883045D4697C44375F884FF33E95A
Malicious:	false
Preview:	GIF89a................................p.......................O...............&.t..T.............................q..I...........q......]......T.........).Q.$....K..m.yJ......H..zQ.?..<...=..&.f..e..P..-...W......s...).lx.\|.lt..+......8.t..o..;...A.q.n..:..........t5I^d.............................................................................................................,........@...:........../F.PQM.N.....<.......'........1*..R#.6..........4L.....2BUK[T-...EX..>.)X)...........8AGA0...?"CIYDH.37(VZJ5;...9.,@`...)...XH.....!>dH.bECB.e....@.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Batch.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	856
Entropy (8bit):	6.793158718407731
Encrypted:	false
SSDEEP:	24:HU34d+XL2abbDwh9PeqiaWuWtuJDdP5SDB1:H5MKa/sh9P+luWtiP5S/
MD5:	FF8B9C98C1DE40C7FF03228739471527
SHA1:	C958C090F7EB94E0AC0FDB054289A33FF14B4375
SHA-256:	DBFA365CC209379DE0ECAD3CEC7AD3EC00A8102398F6BFBCFC24C90E69A11FBE
SHA-512:	5D9ED58C659552F800B7CFEECA3A2C9C8124D68BD7870ACE8F89362A47D8080D4A5EC698D4A66080764D4D19E0EADD7CBB5858758D063AC28922ABF92CFAB250
Malicious:	false
Preview:	GIF89a.....................................r.}b.h...>.D...I.I......'}&.....q.............=.%O.%q.G..X...i.0Y./I~...Q...........................................................`....V.K..n.......7.A..V..d..{..o..~.............p....a.....................................................................................................................................................!.....U.,.............R..........+........................R.............?.?@'...#.........R>EE8GN?.R...+.Q.......=/,$$.8>..>D..............%$5F...p!....H.....9...t.@....>hh.....1t.......(..(.#..!=....I...Pv.0e.!?z.;......(f.0.Y.!M...zC....D(.Q.i..=l..kC..'f\...B<...(.tHUvH^.1$....x\|=.cI.!.=.`.....2t@).#...q...:t...ER....F\.28.[BC.K<....C....s.f.V...:z.~B...%:.(...G.#....Y...F...@E...$?......'..".Gi.>..y~BE.F.0.nn[y...0.K...b@...h.%.\.@ .;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\BeamCheck.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	5.879800405554272
Encrypted:	false
SSDEEP:	24:HCEdU5ENYXIhL4xiWRWTuUrReAZBAOyatOsqZlWnjZn:HRdZxLKiWRWT1rR5ZBxyeGCnjZ
MD5:	E59964317EA7E17909752A8B2BF43996
SHA1:	D5206872214A0E2A3C65D918F416C057E0DE9404
SHA-256:	94389F1A4B671209C932A25DE6C0F266B0CA9E5B0CEC4951096E8B26E7CEF4E7
SHA-512:	BADC9B9B7119510E95960BAD1F4AB9A625DA470FA8D6A44046E98741C7FA0DF3E06C11B09C566B6C66DCA2DB25CED75EE9859C95BA2AA539CD7784FAC0136182
Malicious:	false
Preview:	GIF89a.........................................k..j..m..l..o..v..v...........................................................................................z...............................................{..&.%............... ..(..+..-..0..A..DyrQwqSvpT...ojXmhY...vsnvrruqqvssurrsppfddeccdbbcaab``~\|\|vttqoopnnommmkkljjkiijhhigghff......VUU...............................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,...............Hp`.;k..yS.....:.h..B..'....bF..=~l.....K.Di...,.l\|y2.=c......0@.d.R.. Cn.@Q.J.-^..r.'N.?@..!B$I.0e....M.F."..L.6a.,q...5@. ....P/..<)...7.....!+.4@.0$te.....T..B..8....*...4Z.la.B...

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\ConnectFlowTracker.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	1287
Entropy (8bit):	7.348545232789641
Encrypted:	false
SSDEEP:	24:HOcSEW7nOnXsc70Xx+OAsCID9nyFN+S2VVInYQ4LF1i:HOcI7n+8c7Yx+mLnA8lNFc
MD5:	D7B058F870D0241AC46C22200FFE31FF
SHA1:	BB58D9EDFCEE6F8AAEEB48931B27E922C1122C5A
SHA-256:	4609F8A2FEAF4BF986A9D39BE402BF17655E87CD3DF15F18EE7381F5AA4CF16B
SHA-512:	ABA088B9DC4E96067DAF3534491FFC7E2B11AA58A7DB31EBD171222F13D5BB43C6EE181B25CD4F54C644FF02DA9548832D50D2BC5B3E284DE68B82BF2DCF7ADE
Malicious:	false
Preview:	GIF89a.............KGJD?G..$GEJA@J..Z..?..............}=>.ss.ll....BBX??G##%...""#112--.++,778HHI??@...-: %7/18 &:......qrr...O..^..q.z.8..u\..h..l.!..;..n......m..y.'..6..B..J..c..h...e..c..../..m......j....hu....;~...................P..............................aaY__W...........uVVO...........yypiiaZZSMMG@@;..........}}tzzqqqioogcc\aaZ........w::6,,).........>>:PPKAA=22/............553............OON...............................z.8/..\|..t.....t.....s.[F...cJ.bH.^C.?-.=,.iG....I/....I(...............................................................................................................{{{wwwuuusssqqqooojjjiiigggeeeccc___SSSPPPLLLKKKCCC@@@===:::666444333111///---$$$.......................................................................................!.......,...............H...Y..*\...._.J1.(...\y.m.E...S.z5.%.....:z<...!?..0`..@...I..EhP...D...#.#T....;@...P....4.D..Ai.W.....A.O...a....#.......m..}..hI..1~...G.K.8....7....."...-J .R..;m.L..........Q....J

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Copy (2) of arrow-down.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 11 x 11
Category:	dropped
Size (bytes):	839
Entropy (8bit):	3.1779583377244665
Encrypted:	false
SSDEEP:	12:8ta/5XTggHY7Ddega/f4zgUTKt1l8X7NSwDlRp8w9Htmz0OxRaCnoM8SUNK73b8q:8kEGY7peHU2k7N7DRhoZNtwNKzb87M9
MD5:	CD48C05E220B66871AD1166B14089E27
SHA1:	EACE76EC37EA935B3BF080C84A6F7B850852F8B1
SHA-256:	7EC82A3F8ABD4213A98F9F193975F53162787AD425889B04F43E7D53CC5E1A6B
SHA-512:	73F5873E46D2455EB8601B85E0B1E6C03A898D4B7A519DD9CAB5D98B7ED7AB1C9D45B45F9231A869857FACE66469C39853841E4C284D36E667870150610C3B22
Malicious:	false
Preview:	GIF89a....................................................................................................................................3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f..............3..f.............3..f.........3..3.33.f3..3..3..33.33333f33.33.33.3f.3f33ff3f.3f.3f.3..3.33.f3..3..3..3..3.33.f3.3..3..3..3.33.f3..3..3..f..f.3f.ff..f..f..f3.f33f3ff3.f3.f3.ff.ff3fffff.ff.ff.f..f.3f.ff..f..f..f..f.3f.ff.f..f..f..f.3f.ff..f..f.......3..f.........3..33.3f.3..3.3..f..f3.ff.f..f.f......3..f.............3..f............3..f.............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f....3.f...........3..f.............3..f..............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f.............................................,..........,....HP`.....L.. ....3X...1b,...E...2<.`@.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Copy (2) of arrow-up.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 11 x 11
Category:	dropped
Size (bytes):	821
Entropy (8bit):	3.0231072197474
Encrypted:	false
SSDEEP:	12:8ta/5XTggHY7Ddega/f4zgUTKt1l8X7NSwDlRp8w9Htmz0OxRaCnoM8SUNK73b89:8kEGY7peHU2k7N7DRhoZNtwNKzb8SW
MD5:	051C373EDD336620927E513CA80BA1E9
SHA1:	739FC6C650B0E2E85DB2E5F158139087F293DB25
SHA-256:	B8636015641D2FD177331F8F81DD1D96F024E34D2FE3512F0ABE1A31FCB2F770
SHA-512:	F8720F4C5685901B2A70DEFC7CEFBCD66B19591A47C0A2C4F662151BE1C6BBD9534BC1DF487419C770312001853F5B24FD02EDD4F8F59DA18884E551109741C0
Malicious:	false
Preview:	GIF89a....................................................................................................................................3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f..............3..f.............3..f.........3..3.33.f3..3..3..33.33333f33.33.33.3f.3f33ff3f.3f.3f.3..3.33.f3..3..3..3..3.33.f3.3..3..3..3.33.f3..3..3..f..f.3f.ff..f..f..f3.f33f3ff3.f3.f3.ff.ff3fffff.ff.ff.f..f.3f.ff..f..f..f..f.3f.ff.f..f..f..f.3f.ff..f..f.......3..f.........3..33.3f.3..3.3..f..f3.ff.f..f.f......3..f.............3..f............3..f.............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f....3.f...........3..f.............3..f..............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f.............................................,...............H......*\.pa...!..H.a@.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Copy of arrow-down.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 11 x 11
Category:	dropped
Size (bytes):	836
Entropy (8bit):	3.155928168584783
Encrypted:	false
SSDEEP:	12:Fta/5XTggHY7Ddega/f4zgUTKt1l8X7NSwDlRp8w9Htmz0OxRaCnoM8SUNK73bEV:FkEGY7peHU2k7N7DRhoZNtwNKzbEqNpu
MD5:	7DB71D00F1ACBCF3E414C6EF446606F7
SHA1:	28108011701878DBBB525F16F8735866F6E29A77
SHA-256:	83C3F6F14AB17D7F5DBB0033D61ED88074F16ACDE3FC1AF4B9161C3237B5171B
SHA-512:	68D8C78518AF8B40DEE62D9018A51E5A8B506DBDBCA1D65AF2D9E558A62628037831A219112A48FF5BDECB2E65C1DAC76B575BF6EC1BE2DE2E7CAC897DAC3DE5
Malicious:	false
Preview:	GIF89a....................................................................................................................................3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f..............3..f.............3..f.........3..3.33.f3..3..3..33.33333f33.33.33.3f.3f33ff3f.3f.3f.3..3.33.f3..3..3..3..3.33.f3.3..3..3..3.33.f3..3..3..f..f.3f.ff..f..f..f3.f33f3ff3.f3.f3.ff.ff3fffff.ff.ff.f..f.3f.ff..f..f..f..f.3f.ff.f..f..f..f.3f.ff..f..f.......3..f.........3..33.3f.3..3.3..f..f3.ff.f..f.f......3..f.............3..f............3..f.............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f....3.f...........3..f.............3..f..............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f..............3..f.............3..f.........,..........)....Hp.t...+./!......(.!...*d.D..1....;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Copy of arrow-up.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 11 x 11
Category:	dropped
Size (bytes):	840
Entropy (8bit):	3.188540485744398
Encrypted:	false
SSDEEP:	24:FkEGY7peHU2k7N7DRhoZNtwNKzbEqNpsaO:6HU2k7N7YtG8EqNeB
MD5:	5FE0EC331A39678BAC5D99175BB01D8E
SHA1:	B509CAD86B1433DD87CF328CA2236BFBF9301253
SHA-256:	69F0774B4A48B91BE1EB504089B973F0C2765C5964EE74925A380F3AD9AD31DB
SHA-512:	2DF52A231867FDF50769DA27BE02BA385FB39F709BB1B60F43807449840B3286A0526F3CCDA5F2F4927E1565DE911F76C0CA602646766761C00DF00BA0DEEE8E
Malicious:	false
Preview:	GIF89a....................................................................................................................................3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f..............3..f.............3..f.........3..3.33.f3..3..3..33.33333f33.33.33.3f.3f33ff3f.3f.3f.3..3.33.f3..3..3..3..3.33.f3.3..3..3..3.33.f3..3..3..f..f.3f.ff..f..f..f3.f33f3ff3.f3.f3.ff.ff3fffff.ff.ff.f..f.3f.ff..f..f..f..f.3f.ff.f..f..f..f.3f.ff..f..f.......3..f.........3..33.3f.3..3.3..f..f3.ff.f..f.f......3..f.............3..f............3..f.............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f....3.f...........3..f.............3..f..............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f..............3..f.............3..f.........,..........-....H...x...K..!.t...\..b...JL..b....R..1..;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Delete.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	412
Entropy (8bit):	7.042823257937676
Encrypted:	false
SSDEEP:	12:HHEXeNPs1zpV7Ure0wIo4io5CEbrp1UZ9:HH8e4p1Urc2lG
MD5:	6D798B083BA17DA851B503852AE7B796
SHA1:	421E840D8741D863B9BDEAF00F77749F83D088EE
SHA-256:	29A2229FFE5A71CE84C2CCEC6B321AC2FEF8A66E9256A872704C0BB99CFCA7A9
SHA-512:	2E3E69A042A51F979BBAC7FCCF2D5658FB8D4BC8647615517F46DD7CC281C46442ED948C5E7646051E173F2192FD6BAA11DDEB2ACE17E67B7ABE2BC9C77D3B7F
Malicious:	false
Preview:	GIF89a....................................................Z).qE.5..2..f..................................!.......,............p.....a..x./f\.E\..^.l.....T\|3....)...$B.....I..5..H...F0.....y)^Y`...,..]...-....".3$`U:<.m.M..S.U/.v.....,....`.9].....m..Q..h#......27.?4...cee.Q....}.........c^.7.........83.........."...c.........J.0pc....x.D..a``..3..[pE.E...=......-\|..RA.X....!wB.....Q(..9]...(P ...;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\DeleteRow.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 18 x 18 x 24, image size 1008, cbSize 1062, bits offset 54
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	4.152289808685404
Encrypted:	false
SSDEEP:	12:Xj5GGGGGGGGGGGGGGG/QnGGGGpG/1K0gGGGpGG/OHjEGGqG/aC9nGG/8b3fGGG/U:uKCIDEbYfEjNWMINk1JXG
MD5:	8EDA4BCA425A3625E23F88440A729048
SHA1:	F0DC6A54A51CEC7AE993A237A9A0226E4454AACB
SHA-256:	FC71E445E6E2B302AB09FB05F8949C707F5CFDE25D57272435227D24CFE815A2
SHA-512:	A8E11F0F03A8CA15843F8E05EA89A22464699E5DF872BF09FC6416B15E8CD7C3626C088CE01A32D7C62CAA0476AB3BF391B4E06C6CB546017C9CC85384874FB7
Malicious:	false
Preview:	BM&.......6...(.......................................................................................................^if..................................................s.}...MQR.............................................. ..0( .....................6?8..........................djl*$,DFF...............NRRpwx.............................AEE Y]^.........pwx9:;...................................NKE0( dcj...Y^_000.........................................NKE000000@80D?F..........................................000@8@DFF...........................................\__@809:;9:;dc_....................................@@@@@@........@@@y..............................otu@@@@@@z...........zyu@@@y.......................otu@80@@@....................XQYx~...................@@@HIJ................................................qov.........................................................................................................................................................

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Edit.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 13 x 12
Category:	dropped
Size (bytes):	556
Entropy (8bit):	7.034440565025017
Encrypted:	false
SSDEEP:	12:EbaKX3KkRPrzYtx+1eGFv1aAfcL7Ytf5Xp3Ig0U:EbaKKuPMMvbM7YBZp3Ig0U
MD5:	E698708AC82174100BDE802D73AB73DE
SHA1:	B75D9DDB409196D0A89ADC54E99D58BDE61F7014
SHA-256:	16C3B5CFA88075415040B6542F4A8A92E61C7250FB6F6FA443F36A48AEFA671F
SHA-512:	CE17E64DFE5FC9F5DD65950DAA1BCB1A583015913A441920A4667E9D2E4AFF93B57BC7B8EF4F0EAB9C9025C8768816EDC6E58E02646E4B383DB8126693624AA9
Malicious:	false
Preview:	GIF89a............................................su~..............................................................jx.............f..clwG...\.=p........................S..j..................................................................................................................................$..WD.un......................................................!.....r.,............p6.+"$#.!p..8.hg.(5&.p,.qJ;.=..../p.Z\H..Gnl.p%pIU )-KVmkop.d\.?L@041iep.c:.>23*.jf..`<b9'YX...^QFDOBW..._E7CAM[...aTPNSR].......(.....@.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Firmware.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.603846783672272
Encrypted:	false
SSDEEP:	24:HEAcGVcdwn4iAm7Gf8XD2jUHDR1DseiKhy7Zc/me8+5jmd6tdZ9pc:HEmW2n4iA2GK2jUjR1DLBy7i//rjrtnc
MD5:	70FD11F76CA3F33A317FCA0E5F149865
SHA1:	B77A702166A46E88705577BB34EFCFC502DDE771
SHA-256:	AADCF27F6F9E36A0FF8FD492774D866708CEF34088DE74E42CCD90214CCBE2B1
SHA-512:	AD0F0D694DC24D96ED63884919330E9FD651E1ADE8B2699504273193F219D4A3DAF6C1FF003188D6E9ED031764BEEF2404B9D849E1DBD125506E518AA906C8C6
Malicious:	false
Preview:	GIF89a................KGJD?GHGI..$A@J.....Z..?..............}=>.ss.ll....BBX??D112778.....-:i.. %7/18:[. &:......=\.5P....X.+K.....@.>r....V......9...z.'..;.......Jcz.u.f....................,..%Up...[...~...................`......Z\"sv...qrr....sm.....x.c\..........bR6.{Z.............>.l....k3....m'..5..).P.s$.k...\|.......t..}.f.j...r.....w.1...{...:.+e.W..A.%O.-u._j.Hx.V...O..^..K..W.)m.;x.J..u\..l.!u.)~.8...k..e.$..F..f...d..../..k..m...j....;z................P......................................uiiacc\.........>>:AA=.........OON...............................8/..{..t..t....[F...cI.^C.?-.=,....iG.......I,......................................................wwwuuusssooojjjiiigggeeeccc___SSSPPPKKKBBB===:::666333///---$$$...........................!.......,...............HP..*\.$.r.Z....l!....=s......-n.p..../`..P.c.7y......./E^<.....2....J..?....D@G.A....P. ;..I.g.J.1`x..G.. =r.Q.....].8R....:r."...%,:.p..^.,Hp..F..3>N..V.[9o......J..O...b..@i.n.%.....

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Folders.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	594
Entropy (8bit):	6.670066190380071
Encrypted:	false
SSDEEP:	12:HDtXYGX9Rt3YtnwQF2Ds3xT2ayA0+WxuMMEX3bCov/79dzAlK:HJXPX9R+wQF8sPyCMF79dzAlK
MD5:	769244EE1EBEF25590D12BBC3511515B
SHA1:	3250955C26E956C2BE6DAAE75FEF0DEB16D3D845
SHA-256:	FD46DFD0CD4A5C2451A625C48985DDF360E72C0D092EFCEB4F4491742709D212
SHA-512:	CF8A1E143061624349C3112079A4228528CFC37F51CBAF84B519400838A1ECCBA766F67F491D00A0CFD1D612FE6360D660E26080F064D30475E62E7FF23401A2
Malicious:	false
Preview:	GIF89a................................................q......`...K.......7.A..V..d..{..~.........p....a.........................................................................................!.....'.,...........@AI.8.J%c.(.....R88..I$.y@.....r1h...W.4.L..&..Y......JK...........D.O_p.........n}FO....c....%y%.K....#..........B.M........."......Z..........]B..!........Q................B.........(1...C...&........`.R....d.H,...D.\|..\|......V&X......#%}p a....2p.0A..o...........(.......:..0a.......G.B....T.0...h..J..G..-x..01....T/X5p.K..j.l..S.........$..ha.....Q..E.,...A..;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Help.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	7.665376515488039
Encrypted:	false
SSDEEP:	24:HMLlfdfedilWNr4aB4bYYdCEMSEuRvA4YadbEMgDEMVaCuX0jaf5Hji:HMRlffmr4FblMaRv3YrMSHVo0jafd2
MD5:	AB3573755CC8BAD72EC54326493ACC08
SHA1:	3BD75D83991F0EF59CC0AD1033EE611CB79EFA62
SHA-256:	5BF081467AEF241F8C292C43E6289DA89EEA243F7FB91C9E67B0252AB28C6D6B
SHA-512:	FC4482991102829B4E34A12A7BFB531E8C811A30A14812A34A0A61E3F1DC327B3A689DDFB957A76D0297D4BB7F6DCE67A0551B61258B3E5BFE3007EBE2B23BC4
Malicious:	false
Preview:	GIF89a..........4h.............YWZ......YX`.......................Fe.......vy.......................lnt..._`cCm................&Z.,].;i.@l.Go.Z..Sy.a..w..y...............................Q. V."X.$Y.'].)_.,c.-d.-a.+]..d.,^.0f.0e.-^.2f.2g.4h.4g.5i.=j.@n.?l.Am.Mz.X..g..g....................................(_.+c.*]./g./e..d.0f.1f./b.3h.2h.5i.6j.8m.<o.Cp.Hv.Gw.P~.Nw.X..\..j.........................,l.5j.=l.L..f..{...............................<y.R..........................................................................s..q........bdf.........}........................................................................................qrp.................................................................................{zz.........................!.......,................AG&N[jp.4.R.{.#....../........@..E.8QA./."B.(.P.s#...SK .c....VJ17 .[...1E....5..V.N.+.....}....$..v..j.y.H.ha%.R..... ..+-(.+.E.D.U..P..K...&...J.+.......i1$T....\|..D.c..:}@.A...3..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\HelpDocument.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	6.035380200822454
Encrypted:	false
SSDEEP:	24:HV8P1eRkFoVlN2vLja2wqiUicljkFXmzf:HXCFoVl0vLaRIJeXmz
MD5:	6B50D513B630B8B10D890D069800EE84
SHA1:	2948A86A3CEA946964D568E34D9BB0BD70A70AB3
SHA-256:	A63CE77910CBB72971C84672CC7EB234BABF73FE497D03AA66B0054B43A4CDEF
SHA-512:	22122CCC56A946B0CABA6034584DA03D9E36A2367414BFE11FC025BC65C84798B336A788856E154713C3C103650D96E2FAEB3132267DC0DD6939045B2D61DD9B
Malicious:	false
Preview:	GIF89a.....................................................................................................................................................................................................................................................................................................................................................................................................................x..w..s..p..m..a..Z..E.................................................................................................................................................................................................................................................................................................................,........@......H....R*.Y.p!.)..6.......3f....F.j.L2r0.@..w,:.....jb.TsG...if.C.....M..j..@.Hi ].t.S.&L.PB0B..T.F.Q...KY>j....X.Df...A"..u0.].dI#DD..e.e/.Cy.n.B...IF.+^l...5...cf...h".3.....Q.TI)S...#`...a...Y..#.I.'

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Home.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	830
Entropy (8bit):	6.879287183992153
Encrypted:	false
SSDEEP:	12:HQrycT5xn+lNyEhG9R74MakcU8Fd2goyJrO6YEgp/FhfzVLOcjve2ls+o:HHi+GEkj7BPIFAwymK/TJvGv+o
MD5:	E459D7DD1556B2E2AEC95B3367A0F763
SHA1:	FB2ECB769322A26B7E826C901581761315A0D29E
SHA-256:	08F33451411F3A45421DF5A0F625E36E6B46E97817657429C14344F628AEAC8F
SHA-512:	5DE00041596579111FB2500FB4AEBA371AC569F59E4A063B9DB64E5EBEF69C9E974C6E705A7BD92E3F1D6DB520A004927C2B69AE1CFBF1357FBBAC1EEB89110E
Malicious:	false
Preview:	GIF89a.............................................tx.......fk..........v...................................................................................................................p.....a.........K..]..9.D.....:...Z).q].2..f...\|....................................................................................................................................!.....X.,.............8T..T.T9=..M...8...T8..;D>K.US.NQ9..U..KG.HA@?.PQ=U....<H.C.CGJL....?.G.A..IIQ.U...?...GIHRLB=..=E....K;FOM9..T.GH..GK1...MTU.......\|.`.H.(.!"...\.!..)Z........%QR.A..)2........@jsF.$J.,J.pI...F...1.B.6J......@.(...h..$&<HJci8.7j..a....#......=.\|..+.....R.P..B..7,,.KC...2..`..._.. x...,F...v..8..C.4.}a.E..%.Z...-@04.-.bqR..<..AC....%. ..m..,(.`..:........6Bx0........e.....,T0pA..A...........;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Information.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	789
Entropy (8bit):	6.6514729835026225
Encrypted:	false
SSDEEP:	12:Hoe4ROnqFf7g5JWgWjCwx68V4OF9/jWJK4ZS5SMtF9mzPv2iXmZq21nrv/E:HoxEn1Khjtx6wR/KJvsPtD0ePqCbs
MD5:	3F7A7D376FB51FDF6AE4B8FA216CF15E
SHA1:	1526B04309D9BCFE436658798474BEEF7D8EA12B
SHA-256:	ABE65D22443D551F1567A1F77DC1CBED3C677942E287BC570330AA35B4447B0A
SHA-512:	BF78F31D986185716CD59DF8480DBF0438AAD7FED8D519F8E0FFBA847EC483FAAA067FC6FEBB8FD4F2D136AA1525934C7D91219074B0450934567A30BA139CD7
Malicious:	false
Preview:	GIF89a.........Apm......................12cJM................ilo{.......+....*[.?I`...!N.$E.p........Si.17BR...H.>b.Ow.y.....Q........q..m......................Jdz..............................................................................///.............................................................................................................................................!.....Q.,............I...;MK.K.;....FI.EJ..1DIA.I=...%K........A..%H..).........I.N..I.=.A.& =9.=I;9/.N;..=.A...=007LI..9I.AA....9.91I.%.........?%7......Y.\|..y.q#................!b;Z.~X.A....o($.....%K.......,/....GI..Y.......#m..A.'I.P[..AbB..'p.-y.B..@..`qB....x........r,...F..-T$.`uP...[...E...W@......+^`.....+4@ q$.#..<.x....." \|.... 9.<.p"o..M2..}a.............._"......,h.:..;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\New.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	553
Entropy (8bit):	7.088075900753651
Encrypted:	false
SSDEEP:	12:HD2w9vZakf5WLeLY19YKKAAwQTwHz4mRqOov:HP7BWLeLO9YKKA0wH8mRqNv
MD5:	44AF166A1D9F249353DFA62101B81A4E
SHA1:	CF0AA8C881AB9516B415ECE406F8CF95082DA8B9
SHA-256:	6343DF022B40CC3C289CEDD76BD9BE44378FE7AA25B4F9667F5894088F0F22F9
SHA-512:	77158E35D5407D2B0C293D0818C61206D4E1B6CA8ED5B0732310FF826666C39E900BC98417EE7E446DD649AE1233EC34163B7490BC7BD8F7F19A7F242099AD6D
Malicious:	false
Preview:	GIF89a...................\].tx....fk.v....................................d..............................................L..\|..........................................................................!.....5.,...........@..%...D..0c..G.T..L....1.E.F!...tB..CR.p)/)....XD..x. F...233{,...LCz2}).'..^QB.0..F..)..&(..{a2..-.)".....-.R.+C,..""......-aD.q,.}%.........B.2....d.....-CR.1.+.......I.4.....s........ ...f$P.L 8..5(@.DH......A..TP..p..c... ...b..'..I.`e.05x.@...F.....ag.9..t...hQ..v..Q2g.=g.+...W=d..HJ..h.U.6.[.Y..)@...t..8...;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Open.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	818
Entropy (8bit):	6.359637495970845
Encrypted:	false
SSDEEP:	12:H06Zh5k2XSVDGX9ODHBRtmHujeZv4udUf3mbKUZBc3nAlYh:H0yfRXlX9gHBLmHseR4j3m3BPo
MD5:	FC071C23BF65655BA52B0FBF2FC61E66
SHA1:	15179B8737F156E3AB547798D54C74A54DDA05A5
SHA-256:	7FB02F09CB7EA744602F766F13269D917757E021BC6DC0DB07CF8FFE6C876671
SHA-512:	354DF36848BA7013A12AE136EA4EE84B0B6E3A7057E0124C3CF5259C8F96EA45B459EE87EB8FC1974FFDC96DA1F27027BAC8F8FF58A9E1EA4CE414790964C0F3
Malicious:	false
Preview:	GIF89a.........................r.}b.h...>.D...I.I......'}&...q.............=.%C.O.%q.G..X...i.0E{...Q.............................q......`...K.......7.A..V..d..{..~.........p....a...........................................................................................................................................................................................................!.....D.,............@@...@.A..@.!@!.............!........!..............@....!...........A.....?.......!A....!.!.........0...@......03:+6:0@.!...2..4D.=."D\|0Q#....0..x.. .0.~.hb....(L..@."./6.\......Rh.....(r.Dq.E..@-@..#..R/R........LH.B.......A....<n.......<Z...E..+.L$.;7...,.s....vE. .O...3FlD.c.,j&Z.B...)v..:8..C@Z.......`..LP..7.......V..dHV..8h......=$.J.Q...[.%.... .J.U........d...l..."U...@.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Properties.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	6.1788199617100545
Encrypted:	false
SSDEEP:	24:HIEyUDJaXJtw09OVM8kRp4Eco/FBBbuFcC2HWcvz2T+b5:Hd/Dn8oqLHV7kcTATS5
MD5:	B8B4E20F4E72CCA1A958C2FF4F3077CF
SHA1:	362DF62F191AA4643D2CE8AF531BB62F2DC68434
SHA-256:	0D0CD5A98AA00FF2F4777E313A136133390DF9C2D486CD596B9F5EC7BD38B9F0
SHA-512:	C5D0EC354EE85AC0BBE1527B81EB8EE811D831D0E23CB8136571D60CB43C8CBDD3ABB9092F9D25B03885E553CCCD4ACEFE58CC31FE7A0AF8D1379F47F6125664
Malicious:	false
Preview:	GIF89a..................................12c..........ilo{....+....*[.?I`...!N.4h.$E.p........1b.Si.17BR..MT_.H..B.>b.Ow.y.....Q......Y....q..m............j.......hij.n.-.......~.3..o..Jdz.............2.....K..j..........E..............................xyxmnm............UUI.....................t.).K.k..b.#h]R.i!R3'.oe.&.LGF....$...~.32.HG...................................qqqaaaRRRMMM@@@.................................................................................................................................................................................................................................................................................................................................................................................!.......,...............H....P...C. ....t......6j..!KC.$f...#I..(k....G:Jt.P..f.. R.....6S.X.D.$H<..c......(0.i..J..y....'.. ..$O..#.nm.....O"..#....P.6.:B . ....Di.,...........\W...}.D`.F..8tX....U.ed..b"...>

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Quality.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.865388205785003
Encrypted:	false
SSDEEP:	6:HmyQLuuwulaKeevxJcm7CwLA9UDClKCgaAt6LdYF0lnbhd6yksIf:Hm4qaKZvzzLCjgaIgde4d4HZ
MD5:	33287A20CEC353143E8AD5AC033FE59E
SHA1:	96042CC403ADDE8513C565695F136909BB017C20
SHA-256:	0C487B332126B74E80CD12A15ADE310CA74BE027D80F8741D68D59F451E488D9
SHA-512:	C7E287FDAF7E3B5E1AF63C585421BE2EDEA6E639AD8BDF516F43FD6B4B7D87C05FABEB2877AB612EF5782FAF91F07A5AA8249DFC9DAEB473D3944F61433A19C2
Malicious:	false
Preview:	GIF89a........................................._..O..?../...............oooOOO???...........................!.......,...........` .di.h.U.e.p,..%Y@..\|?.8.pH,......4:...B.....C*.2.Xbt!.Z.C.cP.6.T...E.r....P...J.E{`[..C...F.B.....x.n`..J..\.uCT..9.N.C.;d..EH.X.Cw...D..p.E.h.h........_=..?!.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\QuickStart.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	1368
Entropy (8bit):	7.613183869196794
Encrypted:	false
SSDEEP:	24:H/4sn4X9ReDFsWPw/Ljr0t/Veitu8f5eY9ePxTTx8x0HH8dmd+yZ3mwoPVA9Ix07:H/4s4GGL0NVlD59wx8iVw1wbP
MD5:	F20BE8B4413AAFB1ABB55DE3850C9082
SHA1:	22D48B0FA87EE9C3A2699D3D90511F36A146DE29
SHA-256:	947693D8DE77C44F396E88CADB4973CD83881F73031296E714A40D12F471A7E0
SHA-512:	A990159F9C5CBCE0551C5021D799427C8536194040E0FBA915518B9A739E513B70FDC818D20037945825C8686D2C1125549C4CEE3FCEA6F0300475DDBB203996
Malicious:	false
Preview:	GIF89a.....................................................................~....q...\|..}.....}.....}....k#1y{..{..{..{.......w..hz.................-............"y.'\|...)x......................)..'..0../..6..9..3w3M............1..6..:.Pj.............-X.9^.i..................;..8..B.2^.@s.@k........................L{.P\|.s.........x.............................Q.W........................X.y..........u..............-u.a..................................................o.3.............................E..y.................-....................................................@..l.....................................2.._.....................................................................................................!.......,...............f.+M.[A.i.'Q....HQ.5i....@.l....Q.{.......o.-.&.S.^...@Y......M.7e...z..%&.R.t@..7f.dz....2W..a K..C. ,.3..$d........$.1+p.1p..J5...].x.v,Z.......w..Y...;g..)T.J.s!B.d...MBu.]8K.

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Recorder.GIF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	6.926466267368178
Encrypted:	false
SSDEEP:	24:HSDOw5zyqWOTj4xB2MO4umLCqcTaPdzvCc1hQGlZ:HSNeqWOFkuvqcTWdz6oJ
MD5:	4C7F4E71A4B7E083A75FF5C1A02E4B30
SHA1:	BF09A98CDA3B5C86F2FA0C9A4E74FBDB8A79BB45
SHA-256:	0FBEC026F51173F605147CE7B82766B5005E6F321BC761220F783975A1B3FA1C
SHA-512:	E40388E12FBA476990502CEBC787D934EFC3B199C926EB01485C7C2BA65FC441DD89CA587BA2C49A410BCCC7EDFDF70D8B2814F4C662D55ED0EF50DE127E9703
Malicious:	false
Preview:	GIF89a................zw.............fb.da......IH.?>.mj.nk.ur.NL......w...........q34.56.44.PP.LL.VW.VW.[\.YZ.>>.TU..................ss..................................................................68.PT.PR.QS.Y[._a.%+.(..CI.........<D.=D.>E.......:D.FO.GP.HQ.gp.gp.^d.jr..........x.........g..h..h..i..j..k..l..o..s..t..t..u..w. y.!z.$\|.'~.2..<..=..?..@..\..]..e..s..t..v..}...........................................................................................................................................................................................................................................................................................................................................................................................!.......,...............H......*\.....B..G...+V...)G.YZb."....H.3!......X.A0..0mP...._.~...%..._.....N'.P.....,..`H...O.>rn.q...T@v..E.KV<bn..3Fn.H....p...S.>iX.G..5k.)s3.MI.().....P8..4.R!C...3..MU.0.be..!A

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Rename.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	277
Entropy (8bit):	5.852228739949182
Encrypted:	false
SSDEEP:	3:CEx/DU7nsatepDLL6juR//zylqrCvBM7d+H4V4hjB4XCqRs/Rew+7cKo1Wvk4BNi:Hq7sa01omX5rCZM7dHmzqMcNo1csac
MD5:	429B74EFBEB805B5D596B5C20B420250
SHA1:	53E9AE797AE7482028D548AB36475561D7564591
SHA-256:	5EF3F4714BAA1BBB2EE912AB1868087DF79188763DA70486684F0BB54E295134
SHA-512:	CBD3987F07293CEDD7CEBA3AA0D846D1F2360D5E19DDFFA75A72AD119AE0095F8106A967568E321EFADE2AE2F323D4A8928CA6C57FF9BEFD535A79F0EF14B405
Malicious:	false
Preview:	GIF89a............."".33.UU.ff.ww...................qod....................................................!.......,........... $.di.h....p,?...x..N.....$..BbQtL.L.A........T.>K.-.iU.....p...F..b.@....r.3.J".yk[..#]J..Yz[.p.N\|....".i.V...zpm...?}.{.n..q.K\|..#I..........!.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Screen.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 13 x 12
Category:	dropped
Size (bytes):	527
Entropy (8bit):	6.108726358094427
Encrypted:	false
SSDEEP:	6:EbAVcdwNfMaC3Kfyn+wRKowv2cpzh6S36gsnfY9xx39h6Igqd0kvTYQICGFa3jNa:Ebdq2RzeXJ6g2g9vNhCOvACGFijzMpq0
MD5:	D5CBC921B2AB69A7F0ACE9C6D251D2F9
SHA1:	1CBC87605B9C9D2A3D050DE307C8F5533D0F971A
SHA-256:	A2BCDADF5BE31CB5E33845C6BB4816E6B7B162F9E47BF13C381EFE794D03A735
SHA-512:	8A053641C926E21B67CFD3D7700E9C7FDB705E517072367577F12365C94649A5E6554DCCF495CBE8F34A16446352D31981B89DCE99FBA4C31F6E064AC950472C
Malicious:	false
Preview:	GIF89a......................................................St.Xz............s...........................:h.;b.Fi....u.............S."X.+_..a.5f.j....q}...........\."`.&a.&_.3k.e..j..j..k..s..n\|..............b.#e.s..\|.............f.......................................................................................................................................................!.....R.,..........l.PP....K....@C..1..P.'A.PB...P..5 .).PD.J(.L.P4...N...%...<-"#,/...>7MGHEF;O..9.=I0?.6..Q:!*..+.8..&.$.2.3...;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Smiley1.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 34 x 34
Category:	dropped
Size (bytes):	425
Entropy (8bit):	6.822057611985242
Encrypted:	false
SSDEEP:	6:zhQ9+Qk90zyzQmal67mMokalXW10S2BPG1w6H1qpu6QDQsxpfyZW0rATWKYW:zhQoQ3yU36mW10SYPG1w00pOD1xpfMsP
MD5:	3F245189B7875616F12E205928575187
SHA1:	F57E43CF9A935C753800D8EFEF3CE08C1AABCB97
SHA-256:	053B45AE748A9F95ACD9AF29B8480E07A01F0FCF27681C5652F6835F8FB1A3C7
SHA-512:	CF524EB8FE23B396352EE058FE26A9F07BC26E1CDA71B4FA73B56BBB734EB41EF3A62D5F446D24860ABF8C202CEEEFE332A2791D485CCD71DA94F427D04E4385
Malicious:	false
Preview:	GIF89a"."............. . '.'1.15.5:.:=.=?.?>.>6.6.................\|\|\|hhhNNN.................................!.......,....".".... #.di.h..l...Ut.A.{>S...N.....`....4I..T.J.v).Rr,..-3.4p.a%..h.4et...I.qe....e..LPB'=Y..4.e...\..'b.Z....ZPj#...Z..[.Z...&3.w..6&4..L4.....%.........Z.....Z.$.L.....L..&....w...%...w.....#.L..v[h..(\|.K........m.....%.............\9 Nb.9+........U.&.*..c<.E.$..D..!.x<...'..3j.x..HG...;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Smiley2.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 34 x 34
Category:	dropped
Size (bytes):	374
Entropy (8bit):	6.533807284892058
Encrypted:	false
SSDEEP:	6:5/VN0z5rklqLEjIOhEmk0Nt/KpPG6OQaqPnhenxRWVGvJpGEWe:5u1kkFyEmlt/aPG6OknhUwshpSe
MD5:	1E57811507832CD7925F6A1ECE80182D
SHA1:	E7E367AB4D73AE3C28B3B5FFBF4CC7B9025DBA4A
SHA-256:	CBB72C7FB1E4351095EB2996E3A49B9EB31186C36369AED73EDEC66C44AEBCF4
SHA-512:	02F09AE0D0683E9747C290ABA82153A5B8A75A0ECEBEC8E58C2C635424631F82544F1F21CE49E62458C07E6995A06EB4E561CF647560B4B89F5CFDB43D782FB0
Malicious:	false
Preview:	GIF89a"."............'..1..:..>..6.................\|\|\|hhhNNN................................................!.......,....".".....!.di.h..l...@4.,.{*N....N.h....`.......x@.J.v..>r....-3.4p.a%....4et..FJqe....e..LPB'=Y..4.e...\..'b.Z....ZPj#...Z..[.Z...&3.w..6&4..L4.....%....$..o.#..f..&..K?.?L..%......#..Z..;}.K.t.v.hzkm.qs0c.h.-UW..t...E.#I.=.....o4...&...q.3j..1E..;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Smiley3.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 34 x 34
Category:	dropped
Size (bytes):	374
Entropy (8bit):	6.486260325810852
Encrypted:	false
SSDEEP:	6:9LwA0z5rklqzQJ6Am2Fk0NtHBpPG6OQjPePnhenxRWVGvJpGEWe:9L01kkI62ltTPG6OLnhUwshpSe
MD5:	36C5E40EC4658C5D18BDBCF7A65F5CAC
SHA1:	65A45A59D72AAE36CC56B08876F1787F5BD5F4A9
SHA-256:	99430169C2D08EF78325BBD41D18358FCF06D69A51B60DFA23171ECE8C259315
SHA-512:	778D44B637B434B99EC73DA6EAFE17D30A64E9E7AF2643CD1574747C795AF754546C902C3C91D75FA500D26F05142F5FF9BFB1BEE61CA869E42697ECDFA268CB
Malicious:	false
Preview:	GIF89a".".....?..9.................................\|\|\|hhhNNN................................................!.......,....".".....!.di.h..l...@4.,.{*N....N.h...CaY0.....x@.J.vi.>r..M.-3.4p.a%....4et..FJqe....e..LPB'=Y..4.e...\..'b.Z....ZPj#...Z..[.Z...&3.w..6&4..L4.....%....$..o.#..f..&..K?.?L..%......#..Z..;}.K.t.v.hzkm.qs0c.h.-UW..t...E.#I.=.....o4...&...q.3j..1E..;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Thumbs.db

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.012827017449726
Encrypted:	false
SSDEEP:	1536:PSqhN0P3lOM7WA5J8zVRgHfao/sNt9CVm/Z9UARdR+i5uPTsXmVOFfrxqIqqRX7T:f036WpOcN+Y
MD5:	66FFA4C798AA4D6AC2E44DFC23E97910
SHA1:	FCD6B6A76069A3C9AEE3B93B3D6D6EC220B43194
SHA-256:	4B162F76C0D3F36D66EBB692665AEA8C022F592560DD2562C42579875D55EBE0
SHA-512:	843EA4EC0E5CE81F43DC1B0582AB0B43DC47330A26276F0A0131CFC777709ADA9A6E5209FB3EB6979D96716E1C01E5787885F1A8C105B2DC342C5F1A8A2B4781
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................(...#............................................... ...!..."...$...8...%...&...'...)...6...*...+...,...-......./...0...1...2...3...4...5...7...?...9...I...:...;...<...=...>...@...H...A...B...C...D...E...F...G...J...U...^...K...L...M...N...O...P...Q...R...S...T...V...]...W...X...Y...Z...[...\..._...g...n...`...a...b...c...d...e...f...h...u...i...j...k...l...m...o.......p...q...r...s...t...v.......w...x...y...z...

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\Tutorial.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	dropped
Size (bytes):	1316
Entropy (8bit):	7.7771065699166515
Encrypted:	false
SSDEEP:	24:HmGery0tmmys96Szj2J5QIQICHQcdmsbT880aABu0uH/GKLqu:H5wES32zQ9HQ2msb9DAw0Ceu
MD5:	01F5BEB686B206072FA8B2C44E2DB89D
SHA1:	0C89B59BBB58DDC4B39D2789299E6220BB918C5C
SHA-256:	BF9843E3B5579149E5204E4888B9765A86C0FB0F0896298D663E6E756176BF55
SHA-512:	9F607E53514306B0F4B54EECD4CF0E4E05E7B6492CF1EEE87C15D084F435A4CA92081E751BE7CAB3BDF811C182C2BB9280FA929AE880ADE5B55A95C9EF230005
Malicious:	false
Preview:	GIF89a..........p26VLMv+4obdngiU=H..........................g`.............;=b...st.G].GZ.Qd.Of.Wm._w.Wa.PY.Vq.c..(M.,O.:\.Cg.Mo.[{.i..\..g..l..8d.Lx./03...&T.$F.Fn.Oz.h..4].=V..D.;V....EPg.......O..m..v......... .......'2......'y....=?@wyz...TY[tz\|...#+-kvw.......[\\.....H..%eT............Twct..Q.i..fviVx[.z.$./U.]f.kS.VI^Jt.w...w.x...4.4.........I.F9.8W.UV.Ug.fo.n2.,b._...n.fs.k..c.Tt.g}.w`.R^.Ip~m..t.................................z5...\|...1.W..W.c.j..y....j...{+.<.GrjW.........~1.l1........G...5.1..L..W\|`...U.nu`;..B.#..E..M..M..N..P..Q.w.......J....A.W.,..2..6..9..(.'..2..2..1..3..4..5..7.%.j..,.v'.X4.l .z(.~xM-.q".o!.T.._..a..d \|A..K..T..H....G.O;1{kciL?....$.\|).W&.v..(..i''TRR&%%....................yyynnngggIII+++......!.......,...............H......\.0.'T.F9@H..z.G..)..TR.....>x....e..'J.B."G...,].].2..=..*...K..J.......'T..c..B.P.h.jE...S0..'...q.M.vnU-^.n....!...{a.Z.g.E.&..\.p..v.o.x.......k.%.%L..`..j.@^<_E&...Z.:-.

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\arrow-down.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 11 x 11
Category:	dropped
Size (bytes):	839
Entropy (8bit):	3.1621657426626735
Encrypted:	false
SSDEEP:	12:Fta/5XTggHY7Ddega/f4zgUTKt1l8X7NSwDlRp8w9Htmz0OxRaCnoM8SUNK73b85:FkEGY7peHU2k7N7DRhoZNtwNKzb8Rt9
MD5:	5941C3DF4E9A509EB2A25A92EF16D804
SHA1:	A0F11B9C03F5739A02E2191E507F029464C1820D
SHA-256:	5DD609DD32CA3193D915468FCC0B11FF3F3F6D5385CDD3E6635FB67754C826F0
SHA-512:	559133D9F4F924EC2A6FBC829B03A737D39BECE7F3B47CCF3D2ED7E32CDE763971776D1A7C30702B5E05EE030DC02CBCFC8F819E2A2A7B6F546954AC517A30F2
Malicious:	false
Preview:	GIF89a....................................................................................................................................3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f..............3..f.............3..f.........3..3.33.f3..3..3..33.33333f33.33.33.3f.3f33ff3f.3f.3f.3..3.33.f3..3..3..3..3.33.f3.3..3..3..3.33.f3..3..3..f..f.3f.ff..f..f..f3.f33f3ff3.f3.f3.ff.ff3fffff.ff.ff.f..f.3f.ff..f..f..f..f.3f.ff.f..f..f..f.3f.ff..f..f.......3..f.........3..33.3f.3..3.3..f..f3.ff.f..f.f......3..f.............3..f............3..f.............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f....3.f...........3..f.............3..f..............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f.............................................,..........,....HP .....L.......0X...1b,...E...2<.`@.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\arrow-up.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 11 x 11
Category:	dropped
Size (bytes):	821
Entropy (8bit):	3.0066657016290086
Encrypted:	false
SSDEEP:	12:Fta/5XTggHY7Ddega/f4zgUTKt1l8X7NSwDlRp8w9Htmz0OxRaCnoM8SUNK73b8X:FkEGY7peHU2k7N7DRhoZNtwNKzb8kBW
MD5:	01DD5D71DF2A1859DDDEE76061CB29B8
SHA1:	091A2EE56522A34BC11B3E0F648F08067D164252
SHA-256:	8FE64D027C35D7D0BC50C1CD4C462F6C76438E5EAAA99C12FEDFF6EBCBD6036B
SHA-512:	857AE8A5466C71532E94672986DE6E3DFD4602F78271B4C34204CB6F4D1DCC2FCAF7C71CDBB3AEA9C53293C142C5B6AB4FED408748DD158BEFFE7AC82A4B0872
Malicious:	false
Preview:	GIF89a....................................................................................................................................3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f..............3..f.............3..f.........3..3.33.f3..3..3..33.33333f33.33.33.3f.3f33ff3f.3f.3f.3..3.33.f3..3..3..3..3.33.f3.3..3..3..3.33.f3..3..3..f..f.3f.ff..f..f..f3.f33f3ff3.f3.f3.ff.ff3fffff.ff.ff.f..f.3f.ff..f..f..f..f.3f.ff.f..f..f..f.3f.ff..f..f.......3..f.........3..33.3f.3..3.3..f..f3.ff.f..f.f......3..f.............3..f............3..f.............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f....3.f...........3..f.............3..f..............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f.............................................,...............H......*\.p!...!..H.a@.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\background.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 200 x 320 x 24, image size 192000, cbSize 192054, bits offset 54
Category:	dropped
Size (bytes):	192054
Entropy (8bit):	0.004190382336539455
Encrypted:	false
SSDEEP:	3:KTl/alc/lJlhRD:72tfD
MD5:	04883388266F4CF64A7CE66468445628
SHA1:	F66CC6D84A8F0D63885341014EB1BA81615D3545
SHA-256:	627AD089FD5B3E0FD9356F9968E24D0191E4DA235EAD2E00AC34C88461BA0D96
SHA-512:	0BBC69B07735C536DD5C7187661A0BEFDD9793FB24D925C8A7813B544D9FAFC26F7E28A612DB76B93636B50C5385F8D476F1AD65B27CFCA7B84131AAF088A359
Malicious:	false
Preview:	BM6.......6...(.......@.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\bullet.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 9 x 9 x 4, image size 72, cbSize 190, bits offset 118
Category:	dropped
Size (bytes):	190
Entropy (8bit):	2.2113745248957373
Encrypted:	false
SSDEEP:	3:y/lZll2llrXlt3l/Ft/vl/talAotuZh/LP/RP/iputiputiputRP/LP/LP/n:mglOlAjJLnJa80808njnLnn
MD5:	EFF8672526ABE0D382FE591D1A053605
SHA1:	963BB962776AB0869C2BB63538749E67726CD482
SHA-256:	B8EEA347B0E3D9AF7E4425CD61C345567D0358D7B94D56335D0A15EF3478C01A
SHA-512:	E492790B17A9A79171C31BF7625602ED37A3431E81692F5005439C12C772D7242D3D7C65FA3158B267E3F6F535BE5857D167DD7B37563A6A2DB672887D487DB8
Malicious:	false
Preview:	BM........v...(...................H...........................................................................................................................................................

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\checked.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 36 x 36
Category:	dropped
Size (bytes):	711
Entropy (8bit):	5.544495245216503
Encrypted:	false
SSDEEP:	12:aryejlZ7Wx4M1K4wLmumorOaSH6lbKiGcDX0ELkxu5yRzQ:arhjlFWxt1KkgT4QWiFXm05yRzQ
MD5:	A5E5E86B2A022BAD87FFDD87D0F60FBF
SHA1:	6C78F512B94BA51407B42BCCD9CDFEB56C5251B1
SHA-256:	DD04FDA2AD2ACFA565B812E0EA9D884AC14F249ABBCE19B3F2272322BD5FF8CB
SHA-512:	7592B9F5BF98ED3155C9B91C54D15A6BB76C133BCC5F64C37D37850CC9F8AB640D7653EBC71F1DB7C52175A326044AFD894DDBCD5F9E234CFDD7A2C803C238E9
Malicious:	false
Preview:	GIF89a$.$..S...........................................................!..1..3..7..:..;..B..P..Q..S..X..[.._..a..f..g..h..k..m..o..~....QQQ............[[[.........bbb.......................................................................................................................................................................................................................................,....$.$.....S................Q2)..........R.......P.....P@........7..9.....5..=P..../..;....4..6....6..3....=..'..S.D...O...K...H...j..P..?{.P%).@C.U1.........>....@.&..B..$.&...`.@@.....\...U.K&~.T.#...E...pD.Hm.Sq......v..q..%....je!..iRU..t....R....n-aU.@..[1........~_.....`....".8...#I.L.r.@.;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\connect.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 4.0", baseline, precision 8, 60x48, components 3
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	7.468213636820871
Encrypted:	false
SSDEEP:	96:xGkm78YEZJ+Mve4zXzHUnOnOnOnOnOnOnn2CYZ5KSGek2I7vCT5+9gITS1LGf:JNVtVXzH+8KXejI7Ec9aLC
MD5:	4797EC3B319C69FD0307AAC4529FF63B
SHA1:	C5E4AD5E308DCC0E88B9B0057B26CD55BCC9BDEC
SHA-256:	F22A0D9D52DD72B1C7A1D29DC503927AE7121B48D6183D57E44BF1C44C6F6630
SHA-512:	75C22C6D5977E44958BA525216AFEFDB7A30CC1CC8A9E390BCD13D19EE96C368E764F2EE612BF40B354ACEB1AC1067409AA8AB4D3627972BF238445E596DD989
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........H.......H......8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM...................f......................JFIF.....H.H.....'File written by Adobe Photoshop. 4.0.....Adobe.d.................................................................................................................................................f...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..T.I%)$.IJI$.R.I$...I%)$.IJI$.R

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\disc.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 4.0", baseline, precision 8, 140x139, components 3
Category:	dropped
Size (bytes):	26073
Entropy (8bit):	7.931252166294842
Encrypted:	false
SSDEEP:	384:lJtiJ4OqMCvjex8ggnLrAuPwpJKfVyIEnid+cjrGhrz1veNmhdkeoa7Kt:lDi+mCLefgnHNYJoVydC69ZveNmAezmt
MD5:	E39823A903A776223AB28B7D6CFFC404
SHA1:	C7F3F0036DE13D45C4AFCF2E92E0CD1BE9650ED7
SHA-256:	708A4A79F5702F1DED772A26333443DEA8E7ABAA3B920735E279055150D606B4
SHA-512:	8ED1098E6A0CBB4DAF89AEF2D5B0E85A00C5BFE22A9553132D7631CCD7AF8AA0C300A8E392408629A76C6AA0A18B6E87DC3BDB3DF70E3FF96D11A694ADC2E090
Malicious:	false
Preview:	......JFIF.....H.H.....TPhotoshop 3.0.8BIM.........H.......H......8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM..........8BIM............8BIM...............@...@....8BIM..........................................JFIF.....H.H.....'File written by Adobe Photoshop. 4.0.....Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\flags.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 23 x 55 x 24, image size 3960, cbSize 4014, bits offset 54
Category:	dropped
Size (bytes):	4014
Entropy (8bit):	3.9941252162261134
Encrypted:	false
SSDEEP:	24:2Lk7GtxaYeTg8LjXl0I8/t5nqFfKvu2yAC8sCe3hHaP2Mi+gcBTQIjh7kVAaod:2LkSDjqjXlqVBqpK6A/s5+2gBTLjPR
MD5:	F25A9B539F16ADC95ED44DE89B8A3432
SHA1:	68F7AFAB6EC81EAB4AF639069C182528221B5BFE
SHA-256:	2225B33A918FE06BAFC9717D8A9850712ED4D7E1B8EC65CD3DA1B79ADEC4F6C8
SHA-512:	809D7BF90E9F93E02C6C87D2B6A2BF0C4E6683C66D694E9E5F28B465301BE0E878C65BDD6E60CAEBFDC587D82324861BA4739DBC0B070E4D823014821DA728A6
Malicious:	false
Preview:	BM........6...(.......7...........x........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................x..T..]..W..Cnr:KL...................................................v..,.............. ..9y~N\]..........................................`........6.................0..Z``................................................L.................&..;hl....................................U................................:..npp.................................4...........U....................2..OUU......................

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\help.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 4.0", baseline, precision 8, 65x61, components 3
Category:	dropped
Size (bytes):	13074
Entropy (8bit):	7.874960761471155
Encrypted:	false
SSDEEP:	384:T1cqvlJUjPae0EbsoD0FGArPadcFo5zU4jrN7XZ+:T1caGOE6UcFo5zXQ
MD5:	907389078D608A26536FAB58364BD688
SHA1:	BA7694EEB72717C91077814141EB371E54B74FAA
SHA-256:	FEE172AC762A40C0CFA7601E865D3032373A6D8F77625513E1806A29E5CDC678
SHA-512:	2D5C5C7E7BB84A119F41B4761995D297721C6FBCCC4FA09E77FA1C58B9AE7D4DC6C21E541431D32DA6807A961307D08FD7105143656E0F273868BBB73C414085
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........H.......H......8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM..........8BIM............8BIM...............@...@....8BIM.......,...........x......................JFIF.....H.H.....'File written by Adobe Photoshop. 4.0.....Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\invalid.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 87a, 36 x 36
Category:	dropped
Size (bytes):	887
Entropy (8bit):	6.469859567090635
Encrypted:	false
SSDEEP:	12:UbWuRgdLvWOmEe5ymKmorO0sZdPmzAgErSVmvFvzlkBiqo3q3/3JeM1fI7GQvAl1:GpRgdLvWLEgUvsgf0eUFqP3AWI7GQY1
MD5:	FD92815510C5ABEEEF94949C4508A49B
SHA1:	D801A3548D6ECB224EC4115A3E2F91511B8BEBB0
SHA-256:	A025F9BF613390EC0E8B1E3EA1AC1E49EF03C3A642EC4BF27B88920CE9D3966C
SHA-512:	AC8C356E5E0E457526BEED1F4E37F2752219FADACE5DAC40AE119D648C0758C5320D1185BF350F872AF6DFCE91EB383D3E6B7712C20D5ABAE0AFC59014B29813
Malicious:	false
Preview:	GIF87a$.$.._.............................................. ..!..7...........@..A..B..D..E..G.....L.....M..N..O..P..Q..R..S..T..U..V..p..q..r..&&&'''((())).........222.......................................III.........JJJ.........KKK..................WWWYYY.99..........................................................................................................................................,....$.$....._.................YH......DY..W......V.]...#/38G830#..-].[...(<L...<(...[.[...5...6....]..:...:,.^.-..;.EI.LJC...-.V..7.C."..J$,..f#..S.&.P....~...Ta .(.& ...@.`JL...I..#......!".J.SRB..vIB.,.D..".:...M.DL..\|...'.).:...-.NL.Dy8"-....0....).\.9....Sa.?.bR..[....]:........!-.(...F...P..Qb..o..D=.....H...`.0.@.q<....Q..Id.v.A,....fD...Nib.........NC.%...P...*.V.K....oK....b..m....!...FZ.=S/.P.Z.ia..Ezi<.....=.v..@..4.D.5.P.-.'I...B..TxB..@l..&.l..n....,&...;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\open-file.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 4.0", baseline, precision 8, 65x50, components 3
Category:	dropped
Size (bytes):	8802
Entropy (8bit):	7.736791551736272
Encrypted:	false
SSDEEP:	192:6vGLnlmAJDHBItfHA4Mujh+f6KSPtcYlVpea+MuLIGm+IPc6mc/OUtjjq:6Y7VHBItfH7MujoR+tVpeiuLI5c/cB4
MD5:	E4E0BF3D596A2D8696545A437D2037D2
SHA1:	50844B4A8E707D8EE6F9CE2FBB26CB0340A55730
SHA-256:	52555DDBBDEE513AAB04D990533928F075C8EF30F7DC267330649F58910E27B4
SHA-512:	E82C35E82395F06A2C05C43F150D9470E89E7884B551DB5F549CE026D89314AEA9F19F133A66A317ECF9D174189CC99EB16BD0FFA979D54921DB90E5AF4CF8E2
Malicious:	false
Preview:	......JFIF.....H.H.....,Photoshop 3.0.8BIM.........H.......H......8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM..........8BIM............8BIM...............@...@....8BIM...................b......................JFIF.....H.H.....'File written by Adobe Photoshop. 4.0.....Adobe.d.................................................................................................................................................b...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\s.JPG

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 4.0", baseline, precision 8, 116x58, components 3
Category:	dropped
Size (bytes):	14953
Entropy (8bit):	7.853951628237855
Encrypted:	false
SSDEEP:	384:C97/ZatBji0n2Om6CoD8iGlL7nmfHhA9Bg6prCjFjgBAFcxcL:Q7/i3L+oD+Jmq7gckOAFZ
MD5:	50C82FD8AC9E5F9764D82326BE42660E
SHA1:	A3A297CBA76592C2373B9358988230A1E4B14080
SHA-256:	6E589BC1168257C558E7A87DF7F69F605FD9C5282D22A99E23249B9DF57DDDA0
SHA-512:	4C1948597AFAA056D86D4B0AFC5E0A4D364AD42C26F6192E03F447C7EDC4FD9F9A8FD4F5DAEAE9AC500D2F967A1720E99584293378E6C7435435C7904C2C206B
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........H.......H......8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM...................@......`...............JFIF.....H.H.....'File written by Adobe Photoshop. 4.0.....Adobe.d.................................................................................................................................................@...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..~...].[..................o..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\setup.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 4.0", baseline, precision 8, 68x65, components 3
Category:	dropped
Size (bytes):	9352
Entropy (8bit):	7.758716192045475
Encrypted:	false
SSDEEP:	192:QJIQuTwJfDm4iTbyhFN1tZGkx6K6hm4QJIMv0iajwehsmr8LVeelcTD01:wIQumLbiHyvtr79lREwwh8VeP81
MD5:	70526306D87368C9747B2C14D8FC9BD3
SHA1:	A20641B35A8D5F4AFFB066CC220FD1631B07D5B7
SHA-256:	7F574383B553B7B8B38762A53DADA8622DD1CB6A9DEEEE5C693634B328549FD6
SHA-512:	4D8FEFFAF01D99F1EBD1C032996EE4CD6125ECDC1783533FE66F99966A1F7701ABD7200EE1362AB35DA9F344DF81B0CFEF42B652B780EFBE911AC675E9ACAAF2
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........H.......H......8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM.......S...........z...........7..........JFIF.....H.H.....'File written by Adobe Photoshop. 4.0.....Adobe.d.................................................................................................................................................z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..D.{..=.5....@...C"..E.....4..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\software.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 4.0", baseline, precision 8, 58x60, components 3
Category:	dropped
Size (bytes):	7096
Entropy (8bit):	7.3689596655975524
Encrypted:	false
SSDEEP:	96:aGGU97O7dm0fz2sGtknCaNySNy8F2kAowe1MHt9Vy/SGPD9wlo6lS5HqmV:bY7d1KGnnyA/2oStlGJolSNz
MD5:	A13C39F4A5B58D84CE0D7FEBC4E32D97
SHA1:	3CEE0EC2B7218E249B633F85EE6D0AD30A4DD54F
SHA-256:	5CE5D431366133604894542F46D0A2357E383D62DC695402A5144C7D36D9A169
SHA-512:	57527898650B172BC1416F8290C143968895DBF869E5D2A6C8ECFEC82B2B976B8C49F1BE5C6180547A4F93928318C2B081E8261F03FD1F13E23CF91933ADB977
Malicious:	false
Preview:	......JFIF.....H.H.....$Photoshop 3.0.8BIM.........H.......H......8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM...............{.......t..................JFIF.....H.H.....'File written by Adobe Photoshop. 4.0.....Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....}d.6.oC...[.W......^M^.z6.

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\start.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 4.0", baseline, precision 8, 79x54, components 3
Category:	dropped
Size (bytes):	10966
Entropy (8bit):	7.850748066535318
Encrypted:	false
SSDEEP:	192:FVN19nuBDrKkDUlKGWUiD2tPrIIvvF4OMMmXd2EbyV:n3glKkDUwGWUuGPrI0r2d23V
MD5:	8036EC280430C1B8A2DE7E0D6FBC9386
SHA1:	96BCEF8F172DEAD1B477BA629818875BEDBBE14C
SHA-256:	9C79F0A2E900ACE65ED04B92E83AF168B9D52AE070816AAD47B8798CC00BC8B6
SHA-512:	9EFEAC60758ED2579E3257EDB28F6FED8452B4B74B1F88E5DE43602B52C272D98EF9A9DD4457FD72AEA4FA79236B399EA0B08C5676E3A61AFC083043DDD29845
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........H.......H......8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM..........8BIM..............8BIM...............@...@....8BIM.......u...........W...........Y..........JFIF.....H.H.....'File written by Adobe Photoshop. 4.0.....Adobe.d.................................................................................................................................................W...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\system.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 4.0", baseline, precision 8, 43x50, components 3
Category:	dropped
Size (bytes):	5575
Entropy (8bit):	7.667140432670454
Encrypted:	false
SSDEEP:	96:IGS77N/Tst+KIKjMXjcty7FdI3qk+6CYZ5KSDujTkjFST1qm/Z8fGN4wIB:8psuo7yc3qk+gK1/EK6+WwG
MD5:	2BD6FF3919B1F3267D96F4E33B939FC8
SHA1:	48C61BD788BA715A358CE9E6C13127539A9B9874
SHA-256:	854EB4D9A16AA7CBCEB87FDA05EC0BE748CD6817DB2F729FB24A1BE4859628F7
SHA-512:	BB3243E56FE6E018B9B07D2FDDCBC6AEC7E85AABE07C5263BED36101616222B51B6418DEE00CADA397B208E7A247B400F7505A6ED5B838F11B519CAD23AFB4FE
Malicious:	false
Preview:	......JFIF.....H.H.....dPhotoshop 3.0.8BIM.........H.......H......8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM...............n.......L..................JFIF.....H.H.....'File written by Adobe Photoshop. 4.0.....Adobe.d...................................................................................................................................................n.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..T.I%)$.IJI$.)t.M#.%):....^...n

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\unchecked.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 36 x 36
Category:	dropped
Size (bytes):	124
Entropy (8bit):	6.056145935900649
Encrypted:	false
SSDEEP:	3:Cf/lRCXByBW6H7Lzkp+1G50wsQX4/55d:q/acBWQ7/kp+1G5yQoh3
MD5:	D82478299853E62EBE1452DBB0580A96
SHA1:	369E7E1F9628E801C725F5FD5B8912998BF9311D
SHA-256:	D320836B20B382260696E95B69EE28AD4B94642B4AAAEA5ABE12F1AD3AC857A7
SHA-512:	A9090CF8693828A4D5728CEBC49783144031413549DDB92FA63846D01244F5E1DA0D02832AFFB900817F6F8F20528D060EF63684A14E6C6B46F84E426DE9DB89
Malicious:	false
Preview:	GIF89a$.$..........,....$.$...[.................U.i.Z....!..{....U..6".8..QJ....Q.Oj3..a.I.....Gfx[E_.c..!.....(..;

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Start.htm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13207
Entropy (8bit):	5.316622986220392
Encrypted:	false
SSDEEP:	384:ww6ACUqSbPJVg4qfXIRfOUqfTNsRfOwqfTNsRfF9rdtltdIsRfCfWPJDdhfO9qfW:ww6ACaQ9fJBNS5Vdk9Q/uOoLyuSi5AL4
MD5:	28881440DCD68E4D1C4B344EAFDF3F13
SHA1:	9A50FCE293F4FD6C8B0185CF69E8A2F1A5ACAE87
SHA-256:	C0C6380DFFED79CD92F23225F662D30CC6FE4152892B71EFC8E83F7222A7B12A
SHA-512:	D4020EAF8300787C8831059B5D33515DF8EE9A5EBEEC3BE84526D8FF8CC9650E5ED5F7F090A67EB0F99B0B6E4BF587F212AB4F1FD06F1A8BE538B69D60B43636
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<html>...<head>....<title>Start</title>....<meta content="Microsoft Visual Studio.NET 7.0" name="GENERATOR">....<meta content="http://schemas.microsoft.com/intellisense/ie5" name="vs_targetSchema">....<META http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">....<script language="jscript" src="../scripts/common.js"></script>....<script language="jscript" src="../scripts/xml.js"></script>....<script language="jscript" src="../scripts/tables.js"></script>....<script language="jscript" src="../scripts/functions.js"></script>....<script language="jscript" src="../scripts/errors.js"></script>....<script language="jscript" src="Start.js"></script>....<LINK href="..\base.css" rel="stylesheet">....<LINK href="view.css" rel="stylesheet">...</head>...<body style="BORDER-RIGHT: black 1px solid; BORDER-TOP: black 1px solid; MARGIN: 0px; BORDER-LEFT: black 1px solid; BORDER-BOTTOM: black 1px solid"....scroll="no" onload="

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Start.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7307
Entropy (8bit):	5.302576387394905
Encrypted:	false
SSDEEP:	192:is4eCa2izLSHVJrNkdvareu08XeOmSbgJrnM/5n6NNs:ir/pM0JDeOmw96s
MD5:	00825AB577B4609B077839BCA1F5FC1C
SHA1:	5DA871A2393DBEA084DFFBA22EE01B8698502E28
SHA-256:	181D64D963713C706341351FC4143FF2A31C2FC716022640E12989A2E358523B
SHA-512:	25C50C0C30A303D5262A782C31A2D66C32688AC20EFBAEB68473737C8C01C4F60F09AE5ABE07F61AA9ED982B59D2AA9045DDD6BACBEAAAE96A60A8DF58899C66
Malicious:	false
Preview:	// OnLoadPage - called in Body on load (or at least must be)..var Host=window.external; ..var Objects=Host.Objects; ..var Variables=Host.Variables; ....var PageName="Start";........var Window=Objects("Window"); // don't mess with 'window' which is IE object..var Application=Objects("Application");..var AppSettings=Application.Settings;..var ExportSettings=AppSettings.CreateNode("Export");..var CommunicationDialogs=Objects.CreateObject("SonCommUI.CommunicationDialogs");..var Communicator=Objects.CreateObject("SonCommunications.SonCommunicator");..CommunicationDialogs.Communicator=Communicator;..CommunicationDialogs.hwnd=Application.hwnd;..CommunicationDialogs.Settings=AppSettings.CreateNode("CommunicationDialogs");..var StatusDialog=Objects.CreateObject("UI.StatusDialog");......var PageSettings=null;....document.onselectstart = function ()..{ .. var oSource = window.event.srcElement;.. if(oSource.tagName=="INPUT")....return true;......return false; ..}....function OnCommand(str)..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\highlight.htc

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296
Entropy (8bit):	4.776023153366642
Encrypted:	false
SSDEEP:	3:g/O95wovoU/nivWp4AfWAMniv/GE77MQLjWePYgAI2KCBtVXNvFCMQLjwqYgAI2q:zoGJKA+nQOjewg6/jtPX9g6/Vy4KOMv
MD5:	1E57AE629643710E45F8F0C59BE4A73A
SHA1:	5E2A045DFBD7A69A8B5874877EBF498FF3E8AC1B
SHA-256:	233BDAA259762CA5B70665DF24E95354C2D1202D4D41820B2BAED0D9D461AE14
SHA-512:	C422F449EBC471D063152CCBDB8F514D6B8BFA2064D3E3A09053373E56F672AFA9515807D14562FCB4D2F5126C15A9B28AB1268CEF5F130C56F0872CFBED5FF7
Malicious:	false
Preview:	<script language="jscript">....attachEvent("onmouseover", event_onmouseover);..attachEvent("onmouseout", event_onmouseout);....function event_onmouseover()..{...element.style.border="solid 2pt navy";..}....function event_onmouseout()..{...element.style.border="solid 2pt white";..}....</script>..

C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\view.css

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9499
Entropy (8bit):	4.957090875202257
Encrypted:	false
SSDEEP:	192:6KUM8EU/XDjEryUlQOQAqKHyyn2GQdz4M+MiFT0:dUsWUlt+G+aDT0
MD5:	08DC59809299F4B0E1842F8650A537EE
SHA1:	AFC39034ED38B71B1B969A72B7137035F21800B2
SHA-256:	4C2F0A3AFF5517D4E30FF8D83EE30A093D8B3001CB2AEAA61657E1BD2118699D
SHA-512:	7E19CBC142EFDE02DE287D8F9613271FFF820D796544B98D8812FE26CA1CB656990A4BCA62AAD488C93810F2A4DE1B94E71647F48AF8F4AC62A8A25B83B93767
Malicious:	false
Preview:	body..{...border-right: medium none;...border-top: medium none;...font-size: 9pt;...margin: 0px;...border-left: medium none;...color: black;...border-bottom: medium none;...font-family: 'Tahoma';...background-color:white;...text-align: center;..}....a:link...... { color: blue;...... ....text-decoration: underline; }............a:visited..... { color: blue;...... ....text-decoration: underline; }............a:active..... { color: blue;...... ....text-decoration: underline; }............a:hover...... { color: blue;...... ....text-decoration: underline; }.......CommandLink..{...margin-top: 5px;...margin-left: 5pt;...margin-right: 5pt;...line-height: 15pt;...cursor: hand;...color: blue;...font-style: normal;...font-weight: bold;...text-align: left;...text-decoration: underline;..}.....InfoTitle..{...margin-top: 1pt;...margin-bottom: 1pt;...margin-left: 15pt;...margin-right: 5pt;...font-style: normal;...font-weight: bold;...text-align: left;...color: black;..}.....InfoField..{...mar

C:\Program Files (x86)\SonTek\FlowTracker\Resources\base.css

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3073
Entropy (8bit):	4.901282774406636
Encrypted:	false
SSDEEP:	48:VIMvmcmI0JJHqApQkPRcKxQEzJXtnGQ7Mhkvk62yzYkKYnMZ9cQu0cQeYJ:VX2qvlonZYqvk8LhI
MD5:	198C8F2F05111F38D890A63372F0B9DE
SHA1:	E9957468FE119927409CF39E882C3C5CF4749DF5
SHA-256:	D18A11C1678E4B1F47B87A226D2A676882B3262B326E1ACF262F7B6A5CB3BF28
SHA-512:	53D966B70A4E4D7A30D43126E7FFF8A03E1419A0C2722B576FB3CE1682CBCEAB04F9748DF92441C4D6C4F07CB0BAEB214CB07047A034AC1E9D3B8DFD63998927
Malicious:	false
Preview:	body..{...border-right: white thin solid;...border-top: white thin solid;...font-size: 9pt;...margin: 0px;...border-left: white thin solid;...color: black;...border-bottom: white thin solid;...font-family: 'Tahoma';...background-color: lightsteelblue;...text-align: center;..}....a:link...... { color: darkblue;...... ....text-decoration: none; }............a:visited..... { color: darkblue;...... ....text-decoration: none; }............a:active..... { color: darkblue;...... ....text-decoration: underline; }............a:hover...... { color: darkblue;...... ....text-decoration: underline; }.....Title..{...font-size: 10pt;...font-weight: bold;...width: 100%;...text-align: left;...text-indent: 5px;...border-bottom: white thin solid;...padding-top: 2px;...padding-bottom: 2px;...background-color: cornflowerblue;...color: white;...margin-bottom: 0pt;..}.....Paragraph..{...border: solid 1px royalblue;...margin-top: 5pt;...margin-bottom: 5pt;...margin-left: 1px;...margin-right: 5px;...te

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sontek Software\FlowTracker Manual.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormal
Category:	dropped
Size (bytes):	954
Entropy (8bit):	1.416118935576414
Encrypted:	false
SSDEEP:	6:4xtibdlrY2QXr6fAlul5aIyomtqPojwh4CkHc:8wbdpY2QX2fAhVtAAUh4CkH
MD5:	8CF2AE611896F1727F99F6B83F96D444
SHA1:	289F21D231D6A9E1122650E534E7671AFE9B826D
SHA-256:	BA5926B425FCC6638ACB6DBC87F11F7864FD46BA965BA49144A2EC3389D5524C
SHA-512:	4F6C5B788F8CC3027A80A005F3B2EC30E4341D171AB15DBA3D06BEEEBF03D17738437D47A13827818D9EB37E8CA3CDD1FB25CA7728ABE2062C9F4FEA2D56123D
Malicious:	false
Preview:	L..................F.........................................................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.o.n.T.e.k.\.F.l.o.w.T.r.a.c.k.e.r.\.........6H8X,t[j(=Bt(E^dgB46>2^J^T~rbYArCh?ku,Cv...........................................................................................................................................................................................................................6.H.8.X.,.t.[.j.(.=.B.t.(.E.^.d.g.B.4.6.>.2.^.J.^.T.~.r.b.Y.A.r.C.h.*.?.k.u.,.C.v...........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sontek Software\FlowTracker.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=2, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	2.575800694831178
Encrypted:	false
SSDEEP:	24:8Aj+DQh7AbVy1py2+MNy1pXuxd42f4+MNy1pXWQW2SWc+14WNy1pX:8B07AMWugLed4O45gLXSWc/WgL
MD5:	38D87578BC1389B3C3AD5A2A3E12C66A
SHA1:	32EABBAD26A5242D11E300653B18E7618B970825
SHA-256:	BBB0E05413E51543A7686F1BD7C29B686614E6B06C279E9BFC2EFBF460BB0866
SHA-512:	EAFD07E67EBD948FCEAC057679AB92417C255DB38AF9C6EC1D709A09A8511021D32130DF95FE672BA057DB10A709D7FA51F5E24C593278AC79AB2BD9FDD2B007
Malicious:	false
Preview:	L..................F.P...........................................................P.O. .:i.....+00.../C:\...................V.1.....DWP`..Windows.@......OwH_Y......3........................W.i.n.d.o.w.s.....\.1....._Y&...Installer.D......O.I_Y&...............................I.n.s.t.a.l.l.e.r.......1....._Y)...{1DC4B~1..~......_Y)._Y)......D....................\|8..{.1.D.C.4.B.5.C.F.-.7.D.8.A.-.4.4.A.9.-.9.C.D.F.-.F.7.A.5.D.D.3.5.9.A.3.8.}.....p.2....._Y).!.ICONA6~1.EXE..T......_Y)._Y)......E....................\|8..I.c.o.n.A.6.B.7.F.1.4.0.1...e.x.e.......\.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.1.D.C.4.B.5.C.F.-.7.D.8.A.-.4.4.A.9.-.9.C.D.F.-.F.7.A.5.D.D.3.5.9.A.3.8.}.\.I.c.o.n.A.6.B.7.F.1.4.0.1...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.o.n.T.e.k.\.F.l.o.w.T.r.a.c.k.e.r.\.M.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.1.D.C.4.B.5.C.F.-.7.D.8.A.-.4.4.A.9.-.9.C.D.F.-.F.7.A.5.D.D.3.5.9.A.3.8.}.\.I.c.o.n.A.6.B.7.F.1.4.0.1...e.x.e........

C:\Users\user\AppData\Local\Temp\MSI7931.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	111104
Entropy (8bit):	6.569409090398154
Encrypted:	false
SSDEEP:	3072:g4YKjbfCNSY9lkTbePshNS3W6XbtWrXoJeWC/J0WPcwED:r4NSYE3CW4tWrX7z8
MD5:	6AB48D790D3D87A32B0037C28B2ECBD0
SHA1:	5C8959EDC81BD12A52CF22B5E68A46AFFF47A011
SHA-256:	6D9FDE2878469019479560C5AAE884428A356EB5FC7E72E1BC78DC05DA3024E9
SHA-512:	11A56AAC2F8D5FB526BA07D98D4DAFE55E84BC24BA5F12600630C5E53AA4BDF61A3F056EC8BBDB87A5D9C2720AECFC35887CA4A6FFBCF6B28FFC88500CE836A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y.l..`...`...`...C%..`...DB..`...C...`...B'..`...C...`...`..`.....<`...D...`...D..C`...D=..`...D?..`..Rich.`..................PE..L....V.?...........!.....$...................@..........................................................................A...(........................................................................................@...............................text....".......$.................. ..`.rdata...b...@...d...(..............@..@.data...<$..........................@....reloc..6...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIa7ad8.LOG

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (370), with CRLF line terminators
Category:	dropped
Size (bytes):	840
Entropy (8bit):	3.722095995531394
Encrypted:	false
SSDEEP:	24:QkU3YKoSwFjmBLGakWQUEHg0RKOaVnTN/:hKPoSj9GaYe0YjN/
MD5:	5EF95499F429FE32F002BF5586D51F78
SHA1:	A74749BD62CD44A757AECD22C548FA4CD262FC39
SHA-256:	443B416ED44006EEDAA86B1986D0BB9D48D450C239211D5F954A1EFAFFC74123
SHA-512:	AF6B5FD9A908A2E206D97C43469D5FA99ADAE9F3DD1449E5E2427ADCC41C7017C7A2BB773A456E77E4BB095BA69826DABB7723A782375524D4CD79613357289B
Malicious:	false
Preview:	..E.r.r.o.r. .1.9.3.5... .A.n. .e.r.r.o.r. .o.c.c.u.r.r.e.d. .d.u.r.i.n.g. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n. .o.f. .a.s.s.e.m.b.l.y. .'.M.i.c.r.o.s.o.f.t...V.C.8.0...C.R.T.,.p.u.b.l.i.c.K.e.y.T.o.k.e.n.=.".1.f.c.8.b.3.b.9.a.1.e.1.8.e.3.b.".,.t.y.p.e.=.".w.i.n.3.2.".,.v.e.r.s.i.o.n.=.".8...0...5.0.7.2.7...7.6.2.".,.p.r.o.c.e.s.s.o.r.A.r.c.h.i.t.e.c.t.u.r.e.=.".x.8.6.".'... .P.l.e.a.s.e. .r.e.f.e.r. .t.o. .H.e.l.p. .a.n.d. .S.u.p.p.o.r.t. .f.o.r. .m.o.r.e. .i.n.f.o.r.m.a.t.i.o.n... .H.R.E.S.U.L.T.:. .0.x.8.0.0.7.0.4.2.2... .a.s.s.e.m.b.l.y. .i.n.t.e.r.f.a.c.e.:. .I.A.s.s.e.m.b.l.y.C.a.c.h.e.I.t.e.m.,. .f.u.n.c.t.i.o.n.:. .C.o.m.m.i.t.,. .c.o.m.p.o.n.e.n.t.:. .{.9.8.C.B.2.4.A.D.-.5.2.F.B.-.D.B.5.F.-.A.0.1.F.-.C.8.B.3.B.9.A.1.E.1.8.E.}.....=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .3.1./.1.0./.2.0.2.4. . .1.7.:.0.9.:.3.1. .=.=.=.....

C:\Windows\Installer\5aa756.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 0, Number of Characters: 0, Security: -1, Create Time/Date: Mon Jul 3 20:32:19 2006, Last Printed: Mon Jul 3 20:32:19 2006, Name of Creating Application: Wise for Windows Installer 5.2 - Professional Edition, Last Saved Time/Date: Mon Mar 23 21:42:13 2009, Title: APPNAME, Subject: APPNAME, Author: SonTek/YSI Inc., Template: ;1033, Last Saved By: SonTekRD, Revision Number: {6480B60F-D404-4E1F-B8A6-D4A8D8E57662}, Number of Pages: 200, Number of Words: 2
Category:	dropped
Size (bytes):	26413568
Entropy (8bit):	7.987530549946486
Encrypted:	false
SSDEEP:	393216:ACm39VVlR+jnX5q1wXwKK+AMCW2GxEOSyE+0avLT6GV9rtOjlr/vvAdaXJO:Ah39V7R+7ge7K+NPM+06LT5AlLYd
MD5:	E936C4D09CCDA7AA94D7475EE4FFFFEB
SHA1:	EE02E16754FC457F6D1C1CF2175532B51C00BECE
SHA-256:	65299669DB7C5304BE603B0EC14C7EC2B5963FBEC19AB3ECA19AB8654076CB49
SHA-512:	76A9D859A06B11E62F8C16BC5792040B9D3466EED7706122F152D8B0EF63ED12A1823B78C9F29C0E66A8F6390E47435C8D056D512EAA34B2773784A21105FDDF
Malicious:	false
Preview:	......................>.........................................................................../...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...{...\|...}...~...........................................................................................................................Re..............................Ke...F.............................................................................. ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\5aa758.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 0, Number of Characters: 0, Security: -1, Create Time/Date: Mon Jul 3 20:32:19 2006, Last Printed: Mon Jul 3 20:32:19 2006, Name of Creating Application: Wise for Windows Installer 5.2 - Professional Edition, Last Saved Time/Date: Mon Mar 23 21:42:13 2009, Title: APPNAME, Subject: APPNAME, Author: SonTek/YSI Inc., Template: ;1033, Last Saved By: SonTekRD, Revision Number: {6480B60F-D404-4E1F-B8A6-D4A8D8E57662}, Number of Pages: 200, Number of Words: 2
Category:	dropped
Size (bytes):	26413568
Entropy (8bit):	7.987530549946486
Encrypted:	false
SSDEEP:	393216:ACm39VVlR+jnX5q1wXwKK+AMCW2GxEOSyE+0avLT6GV9rtOjlr/vvAdaXJO:Ah39V7R+7ge7K+NPM+06LT5AlLYd
MD5:	E936C4D09CCDA7AA94D7475EE4FFFFEB
SHA1:	EE02E16754FC457F6D1C1CF2175532B51C00BECE
SHA-256:	65299669DB7C5304BE603B0EC14C7EC2B5963FBEC19AB3ECA19AB8654076CB49
SHA-512:	76A9D859A06B11E62F8C16BC5792040B9D3466EED7706122F152D8B0EF63ED12A1823B78C9F29C0E66A8F6390E47435C8D056D512EAA34B2773784A21105FDDF
Malicious:	false
Preview:	......................>.........................................................................../...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...{...\|...}...~...........................................................................................................................Re..............................Ke...F.............................................................................. ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSIAB0F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.741623752383387
Encrypted:	false
SSDEEP:	192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
MD5:	85221B3BCBA8DBE4B4A46581AA49F760
SHA1:	746645C92594BFC739F77812D67CFD85F4B92474
SHA-256:	F6E34A4550E499346F5AB1D245508F16BF765FF24C4988984B89E049CA55737F
SHA-512:	060E35C4DE14A03A2CDA313F968E372291866CC4ACD59977D7A48AC3745494ABC54DF83FFF63CF30BE4E10FF69A3B3C8B6C38F43EBD2A8D23D6C86FBEE7BA87D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........CnuS".&S".&S".&t.}&P".&S".&.".&t.{&X".&t.m&^".&t.z&R".&t.n&R".&t.x&R".&RichS".&........................PE..L...\..C...........!.....@... .......6.......P....@..........................p......I................................B.......=..x............................`......0...............................x...@............................................text....2.......@.................. ..`.data...h....P.......P..............@....reloc..<....`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIACD5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	196765
Entropy (8bit):	5.629064205375183
Encrypted:	false
SSDEEP:	6144:euJ09BvOMgstIUfZsxaWelcH9uF0lprlap+mhq+5Pwv0NhlY/bh0KYOfWSOAjIhp:euwTVfs/eXNC7L06nugjEXH
MD5:	6FB4483E244625809C8F86F3D52DC368
SHA1:	B6C4DC64E8A913EBE22E88202DF730D6F596F780
SHA-256:	DF11FAB57DB48ED8F8DE461376B987373A4C0F2543CBFA6C4041B1B40D865612
SHA-512:	DD4FFA35DCE3C5B3AEE8CC56ACE57909AD14A01594FE27004110B5D9879E8DA3E031BC5B26AC3D2211F7047E337A96B2F7B296CCA875C7B3862FCB2215D1224D
Malicious:	false
Preview:	...@IXOS.@.....@&._Y.@.....@.....@.....@.....@.....@......&.{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}..FlowTracker,.WIS1DC4B5CF7D8A44A99CDFF7A5DD359A38_2_30.MSI.@.....@.....@.....@........&.{6480B60F-D404-4E1F-B8A6-D4A8D8E57662}.....@.....@.....@.....@.......@.....@.....@.......@......FlowTracker......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files.....File: [1]...@.......@........ProcessComponents".Updating component registration......@p....@.....@.]....&.{46BF110B-0B75-4F7B-9684-0AF9A8F6EBDE}9.C:\Program Files (x86)\SonTek\FlowTracker\Resources\Help\.@.......@.....@.....@......&.{8ADB46B6-81E8-4F9A-A97F-D847BB0392F0}J.C:\Program Files (x86)\SonTek\FlowTracker\FlowTracker Technical Manual.pdf.@.......@.....@.....@......&.{14268BF5-48E8-465B-8745-4C47694EA767}N.C:\Program Files (x86)\SonTek\FlowTracker\Resources\Views\Images\open-file.jpg.@.......@.....@.....@......&.{D59A9269-E6CF-4EFB-B652-B4DD5F7072A9}K.C:\Program Files (x86)\SonTek\FlowTracker\Resources\Vie

C:\Windows\Installer\SourceHash{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1812552698547334
Encrypted:	false
SSDEEP:	12:JSbX72FjsAGiLIlHVRp/h/7777777777777777777777777vDHF++lRHXkzwWkMR:JqQI57MSZkzYs8F
MD5:	F437238F5D3A6BAC2576EDF77E63C470
SHA1:	400EC179CD24B51A9A5CEA66719EE455F37F6E1E
SHA-256:	2EFC569F52A0DD99CD34CF9122E0ABF05592BAA82912B70217B7E586D75B3F20
SHA-512:	1C39C91406C42F7C72A1768B8EB2F76BE893C9302D0CA8873D87029CCA3EA2A8CE9F47350707FB0BC574C4C2DD00F36690F84154E60DE0639CF6723322721B0F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6502811038470033
Encrypted:	false
SSDEEP:	48:n8Ph9ZuRc06WXzMnT5xd99AVuSJ8d4yqXd4O51rA232kWD2ToxVmQBSW8d4yqXdc:mhL1RnTqucEOHJmDP/EOHF
MD5:	982CA88E05DAED63E10C41E03C084ACB
SHA1:	5133668E9C8BFBBA7528DB54963E4B3C966CC889
SHA-256:	5F244D1218CF06507335CD4C9635C54FB58F3D3F2B67024AFFA057D164464572
SHA-512:	BB96339C141A3A6CC6CAAF59973D4338CDEDF21CE142D978B73F453898D3E0DE73388D8539CCCBB381674BBA1C0A794721F91A0849688A0CA339EC6672AA2938
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{1DC4B5CF-7D8A-44A9-9CDF-F7A5DD359A38}\IconA6B7F1401.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	3.6601830294927713
Encrypted:	false
SSDEEP:	96:x2nxKFhwOtJyg4DzBOtJyg4DYcrMLVj8Trj3:x24TKDQKDYjL5erj
MD5:	3E2E9F863B35C8FAEAE3FACCEA201A47
SHA1:	3BE484CD35A3012CE12BD9750BBEF673545334AC
SHA-256:	7E0EF5C0A1EE47E2ED53F588A96E7765EA98FBAE6039C7628C798A990669E0BB
SHA-512:	6C756AFB6FFE22FCD5F35E80FB2E029D343F7A88534007220521736452A459C7758F52A43AF9E9A849A59E10317A802E61A7722537A4BBB5AB45F5C0BF44E87A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......3..................................... ....@..........................`....................................... ..5............0.......................P.......................................................................................text............................... ..`.rdata..5.... ......................@..@.rsrc........0......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.3751710998111735
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaug:zTtbmkExhMJCIpErZ
MD5:	9DCCC90A629F1495CEB122B06565442C
SHA1:	D647FA596DF40BF67B79C360958144761BFBE5FC
SHA-256:	1D09DAF097525B1B42F11F93FC0967371B1FF1A7C918AE83B2E8830527BFD83E
SHA-512:	3A925A086A4842680E9DC336553038357BF43CA831038C5CCE31E3C451AD6D16D535E1F25A58B15684DB08A488518EDADCE5DD5E6B572F2781C5819ED1D9C546
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\atl71.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	6.444169507868961
Encrypted:	false
SSDEEP:	1536:oERCMDI2M2n5lJsYx+J55I+EfA+GsKdQrnzEC560hf/GLKqTM4Zwmibv/4:HnM25V+RI+IGsKVC560R/GOqTJZwmI/4
MD5:	8F2097E8B174F38178570C611464935F
SHA1:	86476819229F4BF00F32E5F0969E19C5B61D1B2A
SHA-256:	3F25E7B097B65EAF82A6D5B58646DFF38CA19347664F40C2B8A409B9D6939457
SHA-512:	85F60B00B4D2E7D5047D4D0F1B834C23073797FCAEA0E14161BAAC9A7EC719D79782A17BA6AA8DA55B933C89B3D94C89696DA194C3CF7170C746C8BAB7E38904
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.Y...7Q..7Q..7Q..hQ..7Q..WQ..7Q..8Q..7Q...Q..7Q..jQ..7Q..6Q..7Q..hQ..7Q..WQ..7Q..kQ..7Q..iQ..7Q..mQ..7QRich..7Q................PE..L.....w>...........!...............................\|............................................................................<....@..0#...................p...... ...................................H............... ...0........................text............................... ..`.rdata...6.......8..................@..@.data........ ......................@....rsrc...0#...@...$..."..............@..@.reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ipp20\ippsa6.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1740800
Entropy (8bit):	6.772843073252498
Encrypted:	false
SSDEEP:	24576:L8BxAG6zNOmSbLJmrVW+ue8YOBbZ3of9CrqKOoDrDJDnzAUGVH91/NE7+zT6vSwD:YBKG6Z7rVW+uiOLo2o5j+9IoyhlLHq
MD5:	88202464392F62F11B142B2B0AA2C26F
SHA1:	8C82D842085906CF5F26C1CBE930553BFE5B1906
SHA-256:	8CDFB7AFDC549980FD986381CB0DF77D7148AEB68EF1C233D8828D5AD6E81224
SHA-512:	90659B89B3F9EEEB258AAE98F4F9E30E88AB118D904DECAED29EC3FEEF2F7524B7C3283BD417F3DBA5EB2546A6A4283138D28DE7667716F6AF73E37AE324EB24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................A................+..................=......Rich...................PE..L.....?...........!.....0...p......m........@......................................................................0K......<F..<....0.......................@..([...................................................@...............................text....$.......0.................. ..`.rdata.......@.......@..............@..@.data........ ...p... ..............@....data1...y..........................@....rsrc........0......................@..@.reloc..Lg...@...p... ..............@..BIntel(R) C++ Compiler for 32-bit applications, Version 7.0 Pre-Beta Build 020328Z : vml_scos4.c : -Qvc6 -Qlocation,link,D:\DevTools\Microsoft Visual Studio\VC98\Bin -nologo -W3 -Ze -Qlong_double -Qsfalign- -D_SVML_FASTCALL -ML -O2 -G6 -D_SVML_DISPATCH -D_SVML_STUB -c -F

C:\Windows\SysWOW64\ipp20\ippsca6.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	610304
Entropy (8bit):	6.392443198441695
Encrypted:	false
SSDEEP:	12288:fxgnaPsFxsFssFPsFvb50VLxQZ9IVYlEWh9sIiUwJE:f2nysFxsFssFPsFvb50VLxQZ9mWh9sWA
MD5:	97E662D293C33F07F633442EDFC74FAC
SHA1:	EB44F947ECC576A20FCDA2CA6233944344BC48A3
SHA-256:	09E818E3829009EEB7C0B914894180BD63872B7A27C0F7C9726E1DB3F642EE69
SHA-512:	23507BD6AA962DA3CB8EAA315A4E9D9A2F2ECD844E5B616F6637494EB9AE3093C3AA8E9F52BBB6BB08C5EAEEA3C62BAAE4DC4294FB8E7C67D2AFC6D505D75BF6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.K6r.%er.%er.%er.$e3.%e..6eq.%e/..es.%e..+ed.%e/./eK.%er.%e%.%e..#es.%e4..e..%e..!es.%eRichr.%e................PE..L...N..?...........!.....P...................`...............................P......................................0...........(............................ .......................................................`...............................text....A.......P.................. ..`.rdata..;....`.......`..............@..@.data...............................@....data1..............................@...CONST1..............................@....rsrc...............................@..@.reloc...$... ...0... ..............@..B........................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ipp20\ippsci7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) Intel Itanium, for MS Windows
Category:	dropped
Size (bytes):	1423360
Entropy (8bit):	5.431956198063226
Encrypted:	false
SSDEEP:	12288:m3IEHp2WmnslxpWWgItDwlbGbBsgIYF6o2dDTW8giP6CDrBVsLOWLTvyeYCH5Knq:8wyHiRTXrBmvFKpLLf3sgAaobAfFw
MD5:	B9F507F8551E6B9184FCCB4EF77B1F46
SHA1:	6C6E6C1305D80EAF01BF4CED89C87462B268348F
SHA-256:	1BA95D17CBC89FAA7008CCEC8AB9E86D19B6F612B73F4558E5FBA189F5B45657
SHA-512:	3B2F91A0820E894535959BD22C084DAE66F3499DFB525D69D6ED04919A0AF937E2983756C7582F9A34B23225FA9F7C403A4633E64DAEFE199EB865DA8DFA747B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............g..g..g..~..g..f...g..z..g..{...g..g...g..X..g.."..g..Z..g.Rich.g.................PE......E..?...........!.....@...~.......l... ........... ........................................@......@............... .............. ...........(....@....... ...$...........`.......................`4..............................................................text...0?... ...@.................. ..`.rdata..+....`.......D..............@..@.pdata...$... ...&..................@..@.srdata......`.......*..............@..@.sdata..h............4..............@....sdata1..............:..............@....data....W.......P...<..............@....data1.. .... ......................@....rsrc........@......................@..@.reloc...#...`...$..................@..B........................................................................................................

C:\Windows\SysWOW64\ipp20\ippscpx.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	372736
Entropy (8bit):	6.450841297907654
Encrypted:	false
SSDEEP:	6144:kkiVZO8F02i/Sux5M2I1wMJUXkNpN0pdISJ2KBJ9rRW1/0d:sjdYSIS2I10kWrhJtrw
MD5:	0779A67A4D206B1496C75CC43033E9F7
SHA1:	AB5A2C6FF72636420A9829A964F771C909380A37
SHA-256:	ADD55903D7F2C632DD1F49020F7619734B1DF64F57F7E8006E8543CFBFC88316
SHA-512:	D61A38FE39B0C613311F764FF14741C23925FD545DBA78B79930C9EB375D8A847D913044A51BB267C2F0F27A89334F2A5379DDC6306383E700BADDC6A75A3701
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0B..cB..cB..cB..c...c ..cA..c...cC..c...cT..c...c{..cB..c...c...cC..c...cC..cRichB..c........PE..L...A..?...........!................X\|..........................................................................................(....................................................................................................................text...v........................... ..`.rdata...(.......0..................@..@.data....~..........................@....data1..\|....p.......p..............@....rsrc...............................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ipp20\ippsct7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	749568
Entropy (8bit):	6.402064245802819
Encrypted:	false
SSDEEP:	12288:lTRQ8TV5TbGxxZ9R6tw3PJYp1YMILb7/fPXkTJtPdc7ImMWwQw:lTRQ8TV5TbGxxZ99PXMILb7/fPXkTJto
MD5:	366F8E618CB68B2EB654FB01BF31F888
SHA1:	529EA82A230377AAE30911E8388AF68C9B70BCDE
SHA-256:	47EFEF1BEA89429BCD430AC49A6C42929BED024C8A73BD03732096153B97D5B2
SHA-512:	C32B7EF9D65178ADCC01E3209F26489495711C51155A1F9E731543803C8CFD7CD6DAE605CAB30950CA41FD86D7C82ABC98ACAF0FCC409F75DAF2B670B78516D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3=.]n.]n.]n.\n..]n..Nn..]n..Vn.]nA.Sn.]n..Wn..]n.]n..]n..[n.]n..wnD.]n=.Yn.]nRich.]n........PE..L...i..?...........!.........p..............................................p..............................................H...(....0.......................@..."...................................................................................text............................... ..`.rdata..............................@..@.data............ ..................@....data1..P...........................@...CONST1..t.... ....... ..............@....rsrc........0.......0..............@..@.reloc...,...@...0...@..............@..B................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ipp20\ippscw7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	741376
Entropy (8bit):	6.413605960576327
Encrypted:	false
SSDEEP:	12288:LxMbGMjSm5TbmxRZ9xaNw3vxOILb5/fPdkTJNvLhwmmc/Ww6w:1MbGMmm5TbmxRZ9dvxOILb5/fPdkTJN2
MD5:	536C8898E0A66F2455D40811665875B2
SHA1:	90CE88AA38CB9D5CB804124A56A36AF98582B125
SHA-256:	C154FBEE07CC5BEFC5E7858A138F3CDCB25B51E9C4D4E6460BC36F83383AEC2D
SHA-512:	C0915A1473FD153D5139931B11AA24A5E789F117C7836AB589987F5B36DD376710E611A2FCF68F062413DAAA3687BF97AA693BD5F9AA872F1220B98C91DBD00D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0...c...c...c...c...c...c...c...c...c...c...c...c...c...c...cO..c...c...c...cw..c...cRich...c........PE..L...[..?...........!.........p......z........................................P.............................................H...(............................ ..."...................................................................................text............................... ..`.rdata..............................@..@.data............ ..................@....data1.. ...........................@...CONST1..t...........................@....rsrc...............................@..@.reloc...+... ...0... ..............@..B................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ipp20\ippsi7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) Intel Itanium, for MS Windows
Category:	dropped
Size (bytes):	4158464
Entropy (8bit):	5.212616128340083
Encrypted:	false
SSDEEP:	24576:W1LBzLCLHLojqHfMFEQpZwiJUHsDrEXjUYYwsgAaobA5lLL+CDmakuqr+8Bvx5uq:WzmkpZw/lLLVRw
MD5:	4319044AA83C3CA76C7DDCF6A39AF063
SHA1:	D65602902E2AC82D35763A509591990D32EF7DC3
SHA-256:	0CE8628987D778DC813FF5C48B4C1C43A448491786051B863DE1138A8961ED5D
SHA-512:	C481476EA99FA5284E785477B2FB1391F4C186118BEDC99E279D23911F8E6E04FE7EFEC0C89333093F3217582190B2BF87ADD4D6460B8089B369AE95067BB3D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[V8..7V..7V..7V...O..7V...K..7V...J..7V..7W.N7V...O..7V..7V.(6V...i..7V......7V...k..7V.Rich.7V.........................PE....#.>..?...........!.....z9...........<.. ........... ........................B...............@......@............... .............. j>......c>.<.....B......@?.4............ B..*...................._...............................@. ............................text.....8.. ....8................. ..`ps10lgin......8.......8............. ..`psexpflt......9.......8............. ..`psexpflt`.... 9.......8............. ..`psexpdbl.....@9.......8............. ..`KaiserSh ....`9.......8............. ..`Kaiserfl`.....9.......8............. ..`Kaiserdb......9.......8............. ..`psln32ss......9.......9............. ..`magsquar .....9.......9............. ..`MiniMax.P.....:.......9............. ..`MiniMaxI..... :......&9............. ..`Norm32fc

C:\Windows\SysWOW64\ipp20\ippspx.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1482752
Entropy (8bit):	6.698433396871772
Encrypted:	false
SSDEEP:	24576:uR2nJG6gSHzKlKsyBMt8ewPR2hLN3a38Tu9qGbEQDNbdNT1bAFx33J70LPk1wICm:5G7Xlv/pTu9qG/bhPCskfL
MD5:	5B8C9FC9ACD92F4918250D8373849672
SHA1:	E3A4B2EE88CA8AA9F9775BF695952CD6B5305B04
SHA-256:	DF195DC22A5E3191CE46C390D596BC348AC9AA084C64E2B88963596E489CC7E6
SHA-512:	0E2CF7788FF62917F365422003397171D16585710DBC3DFB3CF805208246EADAC820F006582DE661FF9854C715D71AE0616A5CEF393BEA041C3D79846620A299
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........a..a..a..~..a.I~..a.I~..a."}..a..a..a..B...a..a..a.fg..a.^A..a.Rich.a.................PE..L...7..?...........!.....@...`...............P......................................................................0[......<V..<....0.......................@...W...................................................P...............................text....=.......@.................. ..`.rdata.......P.......P..............@..@.data...,i...0...`...0..............@....data1..\|...........................@....rsrc........0....... ..............@..@.reloc..hc...@...p...0..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ipp20\ippsra6.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1196032
Entropy (8bit):	6.803164265285231
Encrypted:	false
SSDEEP:	24576:RgBmvv+ZJOOVnfNINBVSYzyJ+97HSnpTmGunuOmP9e6eqez2F/B:RgOv+ZJgzG+9amGunuOmVe6eqey
MD5:	B23766A8B9168259F2689C0E7C6D2199
SHA1:	9C23D26EE4FE69A743DC8D79D7A6D08566F6876F
SHA-256:	EB08B01D9262A87FFCB50F7EA5A2B344C687DD436A81A8FC54EE898261D869E2
SHA-512:	C16666FAA13EDFADC295A0126A5B53D6FB636F1CFA24D3D2C7D761ECC952FBAF27C87886037DC641CA7D9FCF8522BBAA814213F1322B4C2375FFCF5049F24F13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_it.>.'.>.'.>.'.>.'.>.'.!.'.>.'...'.>.'H".'.>.'...'.>.'.>.'.>.'.8.'.>.'..-'.>.'4..'.>.'Rich.>.'........PE..L...y..?...........!................&C.......................................P.......................................@...^...;..(...............................TJ...................................................................................text.............................. ..`.rdata..O...........................@..@.data...............................@....data1...<.......@..................@..._DATA1.. ...........................@....rsrc...............................@..@.reloc...U.......`..................@..BIntel(R) C++ Compiler for 32-bit applications, Version 7.0 Pre-Beta Build 020328Z : vml_sln4.c : -Qvc6 -Qlocation,link,D:\DevTools\Microsoft Visual Studio\VC98\Bin -nologo -W3 -Ze -Qlong_double -Qsfalign- -D_SVML_FASTCALL -ML -O2 -G6 -D_S

C:\Windows\SysWOW64\ipp20\ippsri7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) Intel Itanium, for MS Windows
Category:	dropped
Size (bytes):	2875392
Entropy (8bit):	5.214026659181993
Encrypted:	false
SSDEEP:	24576:XBb1R/0rohfj28OcSLNkNYuES0sgAaobAF7:RbvhLzU
MD5:	B5534BC11FEB72140681E976AB242DB9
SHA1:	CEC3673C0DDC9BFE1F346C2B2244C1A28C727453
SHA-256:	CC44EA663512A318FAADAE1F135A8D49AA60084B9DA0C9EAD295CAB540963666
SHA-512:	AAEB3CFDC4D4048B0FF5071E4D723F730CAFA7842AE6F9CEE05F6076716C8E8672C41C0C8B7BACED972B5B2652FC4263423BC158498D0289675E6B88E0212FEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............g..g..g..~..g..f...g..z..g..{...g..g...g..X..g.."..g..Z..g.Rich.g.................PE......#..?...........!......(..d......@.(.. ........... ........................-...............@......@............... ..................^.....(.....,.........G............,.......................J...............................+..............................text...P.(.. ....(................. ..`.rdata..?.....(.......(.............@..@.pdata...G......H...>.............@..@.srdata...........................@..@.sdata........+....................@....sdata1...... +....................@....data........@+....................@....data1.. ....`,.......+.............@....rsrc.........,.......+.............@..@.reloc...@....,..B....+.............@..B........................................................................................................

C:\Windows\SysWOW64\ipp20\ippsrpx.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	815104
Entropy (8bit):	6.629446295706209
Encrypted:	false
SSDEEP:	24576:3uo66DG8MDo5d0w4Hxr64eriimCBlgxOKp7Mf+kM9SGbQUDF:PXY3HxwiiLBl7Kpu+bXP
MD5:	A59510BFF1B6F7479605E47423B8891C
SHA1:	C4BEE523C93D2670F0D002EED5562CCF667B6F16
SHA-256:	79EDBC585C5BB7C55FFD382D2D6E099BF60500CED8FA86783F3EAF393BA93C0B
SHA-512:	5C56E83BFAC91434829A36BC9DE498DE8B75B6B25B73AEFF1E98C2BB0B763A4087C38B09CAC7B490185F919B138E20B0348E1EE2AB7A27C35C75B1A00B34BDB8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................J.......................6.....Rich...........PE..L...^..?...........!.....`... ......6........p......................................................................`{...^...v..(....0.......................@...C...................................................p...............................text....Z.......`.................. ..`.rdata...j...p...p...p..............@..@.data...............................@....data1...;.......@..................@....rsrc........0......................@..@.reloc...L...@...P... ..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ipp20\ippsrt7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1732608
Entropy (8bit):	6.864761288167971
Encrypted:	false
SSDEEP:	24576:Zf1N1Y6e5qSLTJDFx6lDH3Umacp1ww7yrGnWzSTEfgerlmIRRmuiBINEnwYCvfQp:r/Y1HyUmacp17I0PX
MD5:	220E1A5F619A4A71E5B4A02C01CE59AD
SHA1:	6820893634B2C705106D769214D4F30D2142AA9B
SHA-256:	DF174524D2996619E1D92721AE2C56763CA94F070808B215D51885CB07E473DD
SHA-512:	B6F35FE1D9E86D575BC2C6CA3005C3C1509DE15CDBF152CA36DFA5F02032E9B605857E3421B45722E5EF87F76A4398A222C85AE2A090DF110B80F5A8F5321C69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1~.._-.._-.._-..^-.._-..L-.._-..T-.._-J.Q-.._-..U-.._-.._-.._-..Y-.._-..u-C._-6.[-.._-Rich.._-................PE..L.....?...........!.....P...0...............`.......................................................................L...^...G..(.... .......................0...K...................................................`...............................text....B.......P.................. ..`.rdata...K...`...P...`..............@..@.data...............................@....data1...0.......0..................@..._DATA1..............................@..._DATA2..............................@....rsrc........ ......................@..@.reloc...Z...0...`..................@..B................................................................................................................................................................................................

C:\Windows\SysWOW64\ipp20\ippsrw7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1781760
Entropy (8bit):	6.870277909555683
Encrypted:	false
SSDEEP:	24576:lRLwK4UQDWnVqxd/HpF68Bglb2fSmDX1CQ2mmcp16S7yrGnWzSTEfgerlVIQROu0:TwG9gKmmcp1t+B
MD5:	2F9F6D4A40ECBD3D1E3C7FE5A32DA475
SHA1:	E44B5C7C427C99D9A9D57C63F16C5B2E635242B8
SHA-256:	EC176CAC69D69F19E48D62F2423CD06463C86B12BBC50E2B5C30E78D71ADA33E
SHA-512:	0EABC31F22E650300BAE689E2169F919EBD55B1927B3DED9D1C9B6EAE4E7798C29BB31ACBE476932626A1CD8633B5EF75A26DA6ED9FD04133583FB4CED949B2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........DI.U%'.U%'.U%'.U%&..%'.7:4.V%'...,.T%'..9).B%'...-..%'.U%'..%'..#!.T%'......%'...#.T%'.RichU%'.........PE..L......?...........!.........P...............................................P...........................................^......(................................O...................................................................................text............................... ..`.rdata...K.......P..................@..@.data....$...P.......P..............@....data1..x5.......@...`..............@..._DATA1..............................@..._DATA2..............................@....rsrc...............................@..@.reloc..>^.......`..................@..BIntel(R) C++ Compiler for 32-bit applications, Version 7.0 Pre-Beta Build 020328Z : vml_sexp4.c : -Qvc6 -Qlocation,link,D:\DevTools\Microsoft Visual Studio\VC98\Bin -nologo -W3 -Ze -Qlong_double -Qs

C:\Windows\SysWOW64\ipp20\ippst7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2162688
Entropy (8bit):	6.656100811383678
Encrypted:	false
SSDEEP:	49152:0vw0voLu7xlvyC32oxnZO74DqHsuVqpyvenBQa14r:02LOrX32oxnZO6BQa6r
MD5:	470B1E8B90FE77AA8913E0970D696EC1
SHA1:	7D593E279EECE355E917710220441E9E9B5FC152
SHA-256:	B8A4AC8B7AE470828206A7B6DB79F8FE61A3E4E60741FA45E5BE2661C728D484
SHA-512:	2A50B43A24EE72874029E1254868FDFFAE48DD6CFDB77414A81534AFF3E5A317DCB693B81D3F1BB8A90B19807F8A87607551DF0BFB427D0CFCD5EE4A66F04C9E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...G..G..G...X..G..gX..G..gX...G...[..G..G...G..G..bG..HA..G...d..F..pg..G..Rich.G..........................PE..L...e..?...........!.....`...................p............................... !.....................................0{......<v..<..... ....................... .Dh...................................................p...............................text....S.......`.................. ..`.rdata.......p.......p..............@..@.data.......P.......P..............@....data1...~.... .....................@....rsrc......... ......p .............@..@.reloc...u.... ....... .............@..B........................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ipp20\ippsw7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2195456
Entropy (8bit):	6.664123211234808
Encrypted:	false
SSDEEP:	49152:tr0Dsah6ru7XCv3cNy/IY1vtssHIuVqpy+aDjmUFe+oN3:t87Sv3cNy/IYgN3
MD5:	56E258347FD52CF3836848173F9D52A3
SHA1:	854BA2156B3B13036EDF52CB3C6A4B4CEBF36A3D
SHA-256:	3F7EA7DF8EA7BC85173E84DD605B820849F65B91BFD4643668543BBD2FE6670D
SHA-512:	C8F6AEBA702CAFDB462B8EDC8FAFC2DCAA395E126FF42495AFEF4157198CC87D92FB68603510560BEA360DB48E2D22FF63DBFBC2720173F9F8F7FB5BE26416B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<...]..]..]...B..]..fB..]..fB...]...A..]..]...]..]..b]..I[..]...~..f]..q}..]..Rich.]..................PE..L......?...........!.........................................................!.....................................0.......<...<.....!...................... !.@h...................................................................................text............................... ..`.rdata..............................@..@.data...............................@....data1..X..... ......` .............@....rsrc.........!....... .............@..@.reloc...u... !.......!.............@..BIntel(R) C++ Compiler for 32-bit applications, Version 7.0 Pre-Beta Build 020328Z : vml_dcos2.c : -Qvc6 -Qlocation,link,D:\DevTools\Microsoft Visual Studio\VC98\Bin -nologo -W3 -Ze -Qlong_double -Qsfalign- -D_SVML_FASTCALL -ML -O2 -G7 -Zl -D_SVML_W7 -c -Foobj/nt/std/d/v

C:\Windows\SysWOW64\ippcore.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.4014423473735205
Encrypted:	false
SSDEEP:	1536:cssYgsZP0tcrTscoRgecOtyfwrDov9jXyPfbxPWH:cssDYP0y1BMttrDovH
MD5:	28AC22104C937A0FE3863B8756E69130
SHA1:	9EB4058E371A3976C295C9D40DEDB8FF5D99C6B6
SHA-256:	F6A27AAB62A64CD88B1EB88F9135363F8E3925F889186E32AFB5FD1358D0E2B1
SHA-512:	3C4872C064BB14DC2D80F669C11EF0D6C41969FF2CD2D224ADF8B10FD42630CEBF07AACBF3DA8F953482C038B4CC6FD4876580AE36EF1D285964CAF186B18305
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h..........................a.......a......................N........,.....v.......Rich....................PE..L......?...........!................t+......................................................................................(...(.......p............................................................................................................text...bt.......................... ..`.rdata..............................@..@.data...............................@....data1...!.......0..................@....rsrc...p...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ipps20.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	5.992634990510045
Encrypted:	false
SSDEEP:	3072:XHHHHHnHnnnNxnnHRfznbvD3r/TH7PjXLfznbvD3FR/TH7PjXLfznbvD3r/TH7Pi:XHHHHHnHnnnNxnnHRfznbvD3r/TH7Pjn
MD5:	3310BDEC5E6EB2EF182B7435F7348CB5
SHA1:	DFA8E9EAAF3E3B1647B55C8EF6AFA3322E159F56
SHA-256:	28E346C3BD1AC7090E3E798CBF0798180EBA1854115825FBFB7C247509054836
SHA-512:	C45D03C3CF5995A2A13B1943EF2C5CEC5245E5B9A8F7F03808A1B310E83A3D88E7D494C692FFFF920CF8E2DF5C87E21ECE16027DC7A294892649CED73A084853
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............L..L..L..L...L...L..L$..L..LO..L..L$..L...L...L..L..L..L...L..L3..L..LRich..L................PE..L......?...........!.........P.......U......................................................................................0...P....................................................................................................................text.............................. ..`.rdata..R...........................@..@.data....u.......P..................@....data1.............................@....rsrc................p..............@..@.reloc..f6.......@..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ippsc20.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	4.783959145032705
Encrypted:	false
SSDEEP:	768:rshgPkI+Ka3kTeaLSVVjfRBunkpFnd9YilWYGr8oxg/OVnGUOkG7kA9b8UvEBI:CgshkTeOSTlbVdcmoxtrG7iq
MD5:	CCE0E0EA1A77207B64BDC0C30F392D72
SHA1:	19EA352DE1A0D5CDC7D5812848CAE5A72EA1E912
SHA-256:	F937F3B202A69C6B858C00BFBAA649F547D68E06D9D34FA085B5D35788BFE6B4
SHA-512:	131C0E50B0C56DE0D62C707FF812F27EDA848B6ACBFAB8DA82DEFCBA0212C89273109EE95566F605003EADB25BF27A3AC0AC86AC9B5386FAE361649646CD278A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T)..5G.5G.5G.5F..5G..T.5G...L.5G.5)I.5G...M..5G...m.5G.5G.5G.q3A.5G.I.C.5G.Rich.5G.........................PE..L......?...........!.....p...........%.......................................P..................................................P.... .......................0..,....................................................................................text....g.......p.................. ..`.rdata..........0..................@..@.data....M.......@..................@....data1........... ..................@....rsrc........ ......................@..@.reloc..b....0... ... ..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ippsr20.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	5.497368811722827
Encrypted:	false
SSDEEP:	1536:EyctBHHH3XHKMHnergs1HTTrMelE03wWoEcwZXWq6uBfVzymPh1LiaOhsOClKjyA:EycHHHH3XHnHnv2dEVWoEdOGGqyP
MD5:	71A0A36DA51F7C64876CF9D3837BE8C7
SHA1:	956F1F3A3A6A40628A8F96D02F7CC7B1A3A21806
SHA-256:	0E9EAECFF8B2A58151637F54A0CF92E94A7D6863E5CFC31F44228FFB19640065
SHA-512:	C2325A8B22698D6C0F82F5098D5206D6614C91C3E5E9B9076770BDC35B21BB2252D6831D7C519C11B016480EE3784545FB41683EBD435D38F607B2AEA11957F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T)..5G.5G.5G.5F..5G..*T.5G...L.5G.5)I.5G...M..5G...m.5G.5G.5G.q3A.5G.I.C.5G.Rich.5G.........................PE..L.....?...........!.........`......p3...................................................................................^......P....................................................................................................................text....u.......................... ..`.rdata.._k.......p..................@..@.data....c.......P..................@....data1...L...p...P...P..............@....rsrc...............................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\libguide40.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	5.673508110826574
Encrypted:	false
SSDEEP:	1536:A+A2P+EoLrHPUZ15pwHfgaMq9ayCwtMj426AE+7Sz3TCsmDT0BR8M15fH9w87Hie:A7goCpwHYaMq93M/uJt5JioJQWv8Ph
MD5:	B70E2C66006328D0FD087549B0648511
SHA1:	11E7F1D06C48F9F326760021909C56546CFE1DD8
SHA-256:	B72AD78C8E3082E45EE55DE157C798AEB063323718A2EAE8FBE6A58483A23A42
SHA-512:	BE4A9DB83508FD5E24F32FF0BC6215506926E645751570B9D4787CC30028E9F602FD2D4DD28ED9E4EEFD4BEBD13909B25CFC44FD60A8AB6ACF9AC6F5C322E568
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........ET..+...+...+...8...+...*...+...'...+... ...+.F.%...+...!...+...+...+...-...+.:./...+.Rich..+.........................PE..L.....R>...........!.........P#......$........................................%..........................................1......(.....$.......................$.d.......................................................P............................text............................... ..`.rdata..QA.......P..................@..@.data...4."......@..................@....data1...#....$..0...@..............@....rsrc.........$......p..............@..@.reloc...3....$..@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msvcp71.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msvcr71.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0A50220AD1F13B1A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF132C00C7D72F195C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6502811038470033
Encrypted:	false
SSDEEP:	48:n8Ph9ZuRc06WXzMnT5xd99AVuSJ8d4yqXd4O51rA232kWD2ToxVmQBSW8d4yqXdc:mhL1RnTqucEOHJmDP/EOHF
MD5:	982CA88E05DAED63E10C41E03C084ACB
SHA1:	5133668E9C8BFBBA7528DB54963E4B3C966CC889
SHA-256:	5F244D1218CF06507335CD4C9635C54FB58F3D3F2B67024AFFA057D164464572
SHA-512:	BB96339C141A3A6CC6CAAF59973D4338CDEDF21CE142D978B73F453898D3E0DE73388D8539CCCBB381674BBA1C0A794721F91A0849688A0CA339EC6672AA2938
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF161839196E165966.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF72120C8A55F6CD50.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.1673658647635417
Encrypted:	false
SSDEEP:	48:Lg3N8l5SW8d4yqXd4O51r4SJ8d4yqXd4O51rA232kWD2ToxVmQi6Sd99:kQ/EOH4cEOHJmDc
MD5:	190CFFF78371AC8AAC802C77C6792AEF
SHA1:	38F0B7BA6C19FE2798FF3FC8F6DE82EC118BA1F5
SHA-256:	C25E5D417D31F7E45856FF53F6ADB0DA7BD226C4E901ECD4987D78C8088AE720
SHA-512:	27AA13DE67EB2E6F7BF31D2DADADE51AD5CE678C322867F1F7DF947E9DD0C40529CADE455E27C11A67699C4B4D24BE2CC4604C4818EC339769F49EAF4DEA4F23
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA3A21DC84B8D23F7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.08450307708386824
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKO+OT7yYRHnXkhlsRWkMTct4Vky6lwt/:2F0i8n0itFzDHF++lRHXkzwWkMTcBw1
MD5:	498279CB8749A58F35FE4FA3F72B59C4
SHA1:	626DC978F90A0A6BA2A72FFF90B48F10A419EE30
SHA-256:	CAF76FB432437ADF2DEDF4EBEA732D1C82F025B98B530AE5BCA106993C1CC4E0
SHA-512:	15701E1F5A5F97FCDCACE4B2EBFD2B507566CFC2DE1D8D1F5273A077D5349E456537C01BC1BA968E630C89D6259A4B2438D27CE9E036B24C6580C94E97DFABDA
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB95CD5B63B727531.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.3143807824919835
Encrypted:	false
SSDEEP:	48:RolZumu4uFXzjT5sd99AVuSJ8d4yqXd4O51rA232kWD2ToxVmQBSW8d4yqXd4O5g:CTedTvucEOHJmDP/EOHF
MD5:	07FB27032585DA286E6539F932177740
SHA1:	F4824E8A4C56A5973EA32F75AC83FB827DDC1ABA
SHA-256:	9B7338B67DC681FB01AC5F23A5C07DE405CAC180615FC8FD9CE0DFAC6FF0FCA3
SHA-512:	33AB0207916E14DA68A89DAF1AA5E17A28B05C78C688A6D7CB7728B26D752847E781DE7036B27B9651652EEA5B9977DF79187FC225A5544CEE34CA31640B3023
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBE86C34428E78050.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEB3126E504E78F10.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.3143807824919835
Encrypted:	false
SSDEEP:	48:RolZumu4uFXzjT5sd99AVuSJ8d4yqXd4O51rA232kWD2ToxVmQBSW8d4yqXd4O5g:CTedTvucEOHJmDP/EOHF
MD5:	07FB27032585DA286E6539F932177740
SHA1:	F4824E8A4C56A5973EA32F75AC83FB827DDC1ABA
SHA-256:	9B7338B67DC681FB01AC5F23A5C07DE405CAC180615FC8FD9CE0DFAC6FF0FCA3
SHA-512:	33AB0207916E14DA68A89DAF1AA5E17A28B05C78C688A6D7CB7728B26D752847E781DE7036B27B9651652EEA5B9977DF79187FC225A5544CEE34CA31640B3023
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcm80.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	6.031745108754355
Encrypted:	false
SSDEEP:	6144:9Rj8Tfo4zrcq2FXOth6wsjb2fPzatjLhQeRW86ODl1KWOjPQeH:9So4zATQsjyWRhQ+W83D/6QO
MD5:	CAE6861B19A2A7E5D42FEFC4DFDF5CCF
SHA1:	609B81FBD3ACDA8C56E2663EDA80BFAFC9480991
SHA-256:	C4C8C2D251B90D77D1AC75CBD39C3F0B18FC170D5A95D1C13A0266F7260B479D
SHA-512:	C01D27F5A295B684C44105FCB62FB5F540A69D70A653AC9D14F2E5EF01295EF1DF136AE936273101739EB32EFF35185098A15F11D6C3293BBDCD9FCB98CB00A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-./.ihA.ihA.ihA..g..mhA.ih@..hA.N.:.lhA...?.hhA.N.<.hhA.N.,.fhA.N./..hA.N.;.hhA.N.=.hhA.N.9.hhA.RichihA.........................PE..L...."qE...........!.........@.......T............L\|................................2.....@.............................c ..D...d.....................................................................@..............................H............text....x.......................... ..`.rdata..S[.......`..................@..@.data............ ..................@....rsrc...............................@..@.reloc..P$.......0... ..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcp80.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.402420828464982
Encrypted:	false
SSDEEP:	12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo
MD5:	4C8A880EABC0B4D462CC4B2472116EA1
SHA1:	D0A27F553C0FE0E507C7DF079485B601D5B592E6
SHA-256:	2026F3C4F830DFF6883B88E2647272A52A132F25EB42C0D423E36B3F65A94D08
SHA-512:	6A6CCE8C232F46DAB9B02D29BE5E0675CC1E968E9C2D64D0ABC008D20C0A7BAEB103A5B1D9B348FA1C4B3AF9797DBCB6E168B14B545FB15C2CCD926C3098C31C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y..fv..y..y..#y.....y..2...y.....y.....y......y.....y.....y.....y..Rich.y..........PE..L...."qE...........!.....@... ...............P....B\|.........................p......u.....@.............................L...T...<............................ ..L2...S..............................Pe..@............P.. ............................text....;.......@.................. ..`.rdata......P.......P..............@..@.data...l&....... ..................@....rsrc...............................@..@.reloc..NA... ...P..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20241031170916085.0\msvcr80.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	626688
Entropy (8bit):	6.8397070634061174
Encrypted:	false
SSDEEP:	12288:6Fqi2VC1J7Zs7a5zchr46CIfsyZmGyYCqeC:6Ui2C1JdoiEdmGyYu
MD5:	E4FECE18310E23B1D8FEE993E35E7A6F
SHA1:	9FD3A7F0522D36C2BF0E64FC510C6EEA3603B564
SHA-256:	02BDDE38E4C6BD795A092D496B8D6060CDBE71E22EF4D7A204E3050C1BE44FA9
SHA-512:	2FB5F8D63A39BA5E93505DF3A643D14E286FE34B11984CBED4B88E8A07517C03EFB3A7BF9D61CF1EC73B0A20D83F9E6068E61950A61D649B8D36082BB034DDFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.........@................!......;.............d.......................Rich...................PE..L...8"qE...........!.....0...p......+#.......@.....x......................................@..........................q...~..Pc..<....`.......................p..H3...B...............................F..@............@...............................text...*'.......0.................. ..`.rdata......@.......@..............@..@.data...Li.......P..................@....rsrc........`.......@..............@..@.reloc...7...p...@...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20241031170916085.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	8335
Entropy (8bit):	7.405582810794059
Encrypted:	false
SSDEEP:	192:80XxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTb2LQ82:PBLCcUJvMYb6uT+qugeajCQ2
MD5:	790ADAF5E825415E35AD65990E071AE0
SHA1:	E23D182AB1EDFEF5FD3793313D90935FC034ABC8
SHA-256:	88B03FE13D2710AD787D5D96CD0E5CBEDA3A61C2A0A2BDC0C0984A48365242E2
SHA-512:	050BBAD3122CD0627ECACAF3FB24EBF1E1845F209C33ED6607B282D9DCD4F5D99E345DF3A99E4344AF2ABA6E7923C8483E8D5A8D709BF97F3CB37926D975FDAD
Malicious:	false
Preview:	0. ....H........ \|0. x...1.0...+......0..u..+.....7.....f0..b0...+.....7..........MfN....O.....061202142259Z0...+.....7.....0...0....R2.E.1.2.C.6.D.F.7.3.5.2.C.3.E.D.3.C.6.1.A.4.5.B.A.F.6.8.E.A.C.E.1.C.C.9.5.4.6.E...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............sR..<a.[.h....Tn0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.8.0...C.R.T...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............sR..<a.[.h....Tn0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0....H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H........

C:\Windows\WinSxS\InstallTemp\20241031170916085.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.395078491534145
Encrypted:	false
SSDEEP:	48:3SlK+hk6g4u09kkK23zWO09kkKFzv09kkKldSzY:Clth9uXkd3COXkgTXkX8
MD5:	541423A06EFDCD4E4554C719061F82CF
SHA1:	2E12C6DF7352C3ED3C61A45BAF68EACE1CC9546E
SHA-256:	17AD1A64BA1C382ABF89341B40950F9B31F95015C6B0D3E25925BFEBC1B53EB5
SHA-512:	11CF735DCDDBA72BABB9DE8F59E0C180A9FEC8268CBFCA09D17D8535F1B92C17BF32ACDA86499E420CBE7763A96D6067FEB67FA1ED745067AB326FD5B84188C6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr80.dll" hash="10f4cb2831f1e9288a73387a8734a8b604e5beaa" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>n9On8FItNsK/DmT8UQxu6jYDtWQ=</dsig:DigestValue></asmv2:hash></file>.. <file name="msvcp80.dll" hash="b2082dfd3009365c5b287448dcb3b4e2158a6d26" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xml

C:\Windows\WinSxS\InstallTemp\20241031170916257.0\8.0.50727.762.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	8355
Entropy (8bit):	7.399558553058028
Encrypted:	false
SSDEEP:	192:MjDVxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbW/J/:83LCcUJvMYb6uT+qugeajCo
MD5:	29C0897D5D709A2394960B26999126D0
SHA1:	56501EDA82ECF05C4A90B035BE62B422A24C71C3
SHA-256:	DD72F7AB2DEF5F75F58D01B24643B308750C38685DAAED50BCDDF61C18460DEE
SHA-512:	75FB603D58105F0A2AACADE320E2EAB212DD6B3D6FCBDAB09CA137D123CC1DECB88C848B81E017BBDDD41D9591900FF723AED90FB0D6166E8C62E3C14D39166E
Malicious:	false
Preview:	0. ....H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7......uU....L..F&.K....061202065436Z0...+.....7.....0...0...8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........@...@......_...."0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.1.0.4.4.0.9.3.0.C.C.9.9.4.4.0.9.E.9.2.0.D.9.4.C.7.C.4.5.F.0.4.0.5.D.6.0.4.2.2...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........@...@......_...."0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0....H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0....H............

C:\Windows\WinSxS\InstallTemp\20241031170916257.0\8.0.50727.762.policy

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	800
Entropy (8bit):	5.192462113683958
Encrypted:	false
SSDEEP:	24:2dtMEDJ5iN+nhQ56g4NnjiNK+hcg4NnM23+LJ23sZQR:ciEDJw0hk6g4EK+hcg46HQR
MD5:	A785CE93C7468DBCDFA7BC379F8FFDDC
SHA1:	D10440930CC994409E920D94C7C45F0405D60422
SHA-256:	3A131923C7403C1EEF33B59FDCA57D8272549B7912D2B522FC8A4C840CBCA735
SHA-512:	8E514E11887F6A198756F4A4B1A584E0A337ABEF90F1A9330436E21E75CD5FFFE7E90A80424018C03EA55AE43758FCFA16F5A7C266D5476CE8F985F76CE5CADA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.CRT" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, WISE installer self-extracting archive
Entropy (8bit):	7.986390255626898
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FlowTracker_Setup.exe
File size:	26'464'768 bytes
MD5:	e103387250c2f8330978838bd5b6365f
SHA1:	f441f01bf13e1498a2d8b5dbb3de4ae52c43227d
SHA256:	cc43b037bdb72a60d29e0ac7be83e1dbabc472bfd8555b5ae90736ea10da02a3
SHA512:	0a0979a0e05ee9c6b9aae634a4ec453012eb5e038214ff77551223dad16cd22c79bef8d64647919c3c24df204cb3801e550341e865de16eed7eb32a0a6e4cd0f
SSDEEP:	393216:QCm39VVlR+jnX5q1wXwKK+AMCW2GxEOSyE+0avLT6GV9rtOjlr/vvAdaXJO:Qh39V7R+7ge7K+NPM+06LT5AlLYd
TLSH:	F04733C67D5C8137D48406360B338A380CA7282E4562874AC77AA6CD5DBF2EF91F49DB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I.S.I.S.I.S7j.S.I.S.I.S.I.S.I.S.I.S7m.S.I.S7m.S.I.S7m.S.I.S7m.S.I.SRich.I.S........................PE..L....V.?...........

File Icon


Icon Hash:	978fbcf5e567671b

Static PE Info

General

Entrypoint:	0x4039e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x3FBE5685 [Fri Nov 21 18:16:37 2003 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	8b6130a51e22ee5ae74880b8b58d6211

Entrypoint Preview

Instruction
sub esp, 00000F20h
push esi
push edi
push 00000004h
call dword ptr [0040610Ch]
xor edi, edi
mov dword ptr [esp+40h], edi
mov dword ptr [esp+24h], edi
mov dword ptr [esp+20h], edi
mov dword ptr [esp+28h], edi
mov dword ptr [esp+1Ch], edi
call dword ptr [004060A4h]
mov cl, byte ptr [eax]
cmp cl, 00000022h
mov dword ptr [esp+30h], eax
jne 00007F6CBCC40CECh
jmp 00007F6CBCC40CC7h
cmp cl, 00000022h
je 00007F6CBCC40CD2h
inc eax
mov cl, byte ptr [eax]
test cl, cl
mov dword ptr [esp+30h], eax
jne 00007F6CBCC40CB2h
cmp cl, 00000022h
jne 00007F6CBCC40CD9h
inc eax
mov dword ptr [esp+30h], eax
jmp 00007F6CBCC40CD2h
cmp cl, 00000020h
je 00007F6CBCC40CD2h
inc eax
mov cl, byte ptr [eax]
mov dword ptr [esp+30h], eax
test cl, cl
jne 00007F6CBCC40CB2h
cmp byte ptr [eax], 00000020h
jne 00007F6CBCC40CCCh
inc eax
cmp byte ptr [eax], 00000020h
je 00007F6CBCC40CBCh
mov dword ptr [esp+30h], eax
mov dl, byte ptr [eax]
cmp dl, 0000002Fh
je 00007F6CBCC40CDDh
mov ecx, eax
jmp 00007F6CBCC40CCAh
cmp dl, 0000003Dh
je 00007F6CBCC40CC9h
inc ecx
mov dl, byte ptr [ecx]
test dl, dl
jne 00007F6CBCC40CB6h
cmp byte ptr [ecx], 00000000h
jne 00007F6CBCC40CC8h
mov eax, ecx
mov dword ptr [esp+30h], eax
push eax
call 00007F6CBCC4029Dh
pop ecx
push edi
call dword ptr [00406108h]
push 00000100h
lea ecx, dword ptr [esp+000000F0h]
push ecx
push eax
mov dword ptr [00408810h], eax
call dword ptr [004060D0h]
lea eax, dword ptr [esp+000000ECh]
push eax
lea eax, dword ptr [esp+00000000h]

Rich Headers

Programming Language:

[ C ] VS2002 (.NET) build 9466
[EXP] VS2002 (.NET) build 9466
[RES] VS2002 (.NET) build 9466
[LNK] VS2002 (.NET) build 9466

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x75c0	0xba	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6d14	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x194a000	0x53d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6000	0x1c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4df0	0x4e00	35fa1d05bb53eb7adc0069f07cac549a	False	0.5453725961538461	data	6.169942228692919	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6000	0x167a	0x1800	26f7ab45a904cfdba646f581a052779d	False	0.4230143229166667	data	5.076288897409713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x8000	0x10410	0x600	31c10cf1c411040fcff60fd74bc18bf6	False	0.12890625	DOS executable (block device driver CDEFGHIJ)	1.2549836844555777	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.WISE	0x19000	0x1930db8	0x1930e00	70ff0386f41165f8889aaec71f9d4985	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x194a000	0x53d8	0x5400	8a634d92d5f85343cc203a44daf3c4da	False	0.33603050595238093	data	4.297475826278103	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0x194d018	0x19cc	RIFF (little-endian) data, AVI, 32 x 32, 15.00 fps, video: RLE 8bpp	English	United States	0.19866747425802544
RT_ICON	0x194a350	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.43789978678038377
RT_ICON	0x194b1f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.5175992779783394
RT_ICON	0x194baa0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.3952312138728324
RT_ICON	0x194c008	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.43597560975609756
RT_ICON	0x194c670	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.5631720430107527
RT_ICON	0x194c958	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.75
RT_DIALOG	0x194cae0	0x1ba	data	English	United States	0.5158371040723982
RT_DIALOG	0x194cca0	0x1b4	data	English	United States	0.6169724770642202
RT_DIALOG	0x194ce58	0x1ba	data	English	United States	0.5339366515837104
RT_STRING	0x194ec38	0x630	data	English	United States	0.3244949494949495
RT_STRING	0x194f268	0x16e	data	English	United States	0.4426229508196721
RT_GROUP_ICON	0x194ca80	0x5a	data	English	United States	0.7666666666666667
RT_VERSION	0x194e9e8	0x24c	data	English	United States	0.41156462585034015

Imports

DLL	Import
WSOCK32.dll	WSACleanup, WSAStartup, send, socket, htons, connect, WSAAsyncSelect, WSAGetLastError, shutdown, recv, setsockopt, closesocket, ioctlsocket, gethostbyname
KERNEL32.dll	lstrcpyA, lstrlenA, _lwrite, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, _lclose, GetProcAddress, LoadLibraryA, _lcreat, GetPrivateProfileStringA, GetPrivateProfileIntA, GlobalLock, GlobalAlloc, GlobalFree, GlobalUnlock, GetTempFileNameA, lstrcatA, FreeLibrary, DeleteFileA, _llseek, lstrcmpA, _lread, GetCommandLineA, CloseHandle, GetFileTime, CreateFileA, FreeResource, LockResource, LoadResource, SizeofResource, FindResourceA, GetExitCodeProcess, WaitForSingleObject, GetModuleFileNameA, CreateDirectoryA, GetSystemDirectoryA, GetVersionExA, MulDiv, GetUserDefaultLangID, SetCurrentDirectoryA, lstrcmpiA, ExpandEnvironmentStringsA, Sleep, GetFileSize, ExitProcess, _lopen, SetEnvironmentVariableA, GetModuleHandleA, SetErrorMode, GetTempPathA, GetCurrentProcess
USER32.dll	GetDC, MessageBoxA, DestroyWindow, CharNextA, LoadStringA, SendMessageA, GetDlgItem, EnumChildWindows, ReleaseDC, EndDialog, GetDlgItemTextA, wsprintfA, SetDlgItemTextA, CreateDialogParamA, ExitWindowsEx, EnableWindow, ShowWindow, SetTimer, DialogBoxParamA, TranslateMessage, DispatchMessageA, SetWindowTextA, PeekMessageA
GDI32.dll	GetDeviceCaps, DeleteObject, CreateFontA
ADVAPI32.dll	LookupPrivilegeValueA, RegDeleteValueA, RegEnumValueA, OpenSCManagerA, CloseServiceHandle, OpenProcessToken, RegCloseKey, AdjustTokenPrivileges, RegCreateKeyExA, RegSetValueExA, RegQueryValueA, RegOpenKeyExA, RegQueryValueExA
SHELL32.dll	ShellExecuteExA

Exports

Name	Ordinal	Address
_LanguageDlg@16	1	0x4034af
_PasswordDlg@16	2	0x4033ad
_ProgressDlg@16	3	0x403404
_UpdateCRC@8	4	0x402927
_t1@40	5	0x401d53
_t2@12	6	0x401737

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	17:08:55
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\FlowTracker_Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FlowTracker_Setup.exe"
Imagebase:	0x400000
File size:	26'464'768 bytes
MD5 hash:	E103387250C2F8330978838BD5B6365F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:08:56
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS1DC4B5CF7D8A44A99CDFF7A5DD359A38_2_30.MSI" WISE_SETUP_EXE_PATH="C:\Users\user\Desktop\FlowTracker_Setup.exe"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:08:57
Start date:	31/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7da480000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:08:57
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 721A14B488BA2239A99405E88BE13886 C
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:09:10
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 401F6D3C4DBC37D117E40A823546F8D4
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:09:18
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDrvLib.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:09:19
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonUsb.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:09:19
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScriptLib.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:09:20
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Communications.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:09:20
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonScript.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:09:20
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Graphics.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:09:20
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataControls.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:09:20
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataLib.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:09:20
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonData.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:09:20
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Base.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:09:20
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUtils.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:09:20
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataExport.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:09:21
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDTP.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:09:21
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\YsiPlatform.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:09:21
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUI.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:09:21
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDiag.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:09:21
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommunications.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:09:21
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataUI.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:09:21
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\UI.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:09:21
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataProcessing.dll"
Imagebase:	0x590000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	17:09:22
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataBrowser.dll"
Imagebase:	0x7ff72bec0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:09:22
Start date:	31/10/2024
Path:	C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\SonTek\FlowTracker\FlowTrackerExport.exe" /RegServer
Imagebase:	0x400000
File size:	633'856 bytes
MD5 hash:	F2B4252F45413AA4644C1CCE16C8C811
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	8.8%
Signature Coverage:	2.9%
Total number of Nodes:	489
Total number of Limit Nodes:	33

Executed Functions

Function 0041FE70 Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 148
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000208,7EE0FD72), ref: 0041FEBD
RegCreateKeyExA.KERNELBASE(80000000,FlowTrackerExport.SontekFlowTrackerFile.1,00000000,00000000,00000000,00020006,00000000,?,?,0047A264,00000002), ref: 0041FF3A
RegSetValueExA.KERNELBASE(00000000,EditFlags,00000000,00000004,?,00000004), ref: 0041FF67
RegSetValueExA.KERNELBASE(00000000,BrowserFlags,00000000,00000004,?,00000004), ref: 0041FF82
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00420016
RegCloseKey.ADVAPI32(00000000), ref: 00420021

Strings

EditFlags, xrefs: 0041FF59
FlowTrackerExport.SontekFlowTrackerFile.1, xrefs: 0041FF2C, 0041FF86, 0041FF9F, 0041FFBA
SonTek FlowTracker Data File, xrefs: 0041FFB5
FlowTrackerExport.SontekFlowTrackerFile.1\shell\Open\Command, xrefs: 0041FFFC
.SontekFlowTrackerFile, xrefs: 0041FFA4
BrowserFlags, xrefs: 0041FF74
&Open, xrefs: 0041FFE1
FlowTrackerExport.SontekFlowTrackerFile.1\shell\Open, xrefs: 0041FFE6
0`I, xrefs: 0041FEAA
FlowTrackerExport.SontekFlowTrackerFile.1\DefaultIcon, xrefs: 0041FFD0
/o "%1", xrefs: 0041FEED
.wad, xrefs: 0041FF8B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Value$ChangeCloseCreateFileModuleNameNotify
String ID: /o "%1"$&Open$.SontekFlowTrackerFile$.wad$0`I$BrowserFlags$EditFlags$FlowTrackerExport.SontekFlowTrackerFile.1$FlowTrackerExport.SontekFlowTrackerFile.1\DefaultIcon$FlowTrackerExport.SontekFlowTrackerFile.1\shell\Open$FlowTrackerExport.SontekFlowTrackerFile.1\shell\Open\Command$SonTek FlowTracker Data File
API String ID: 3358869470-3782932605
Opcode ID: 3af3bd331bccab7fc44008f37494194b308e1379cedcccc16d76d59ae6c56be8
Instruction ID: dac7ff971e98b2e5a667e0c5407b26d4eb4bdf83da1834a09925491b2a14e1fe
Opcode Fuzzy Hash: 3af3bd331bccab7fc44008f37494194b308e1379cedcccc16d76d59ae6c56be8
Instruction Fuzzy Hash: B951D570248300BFE220DF51DC46F9BB7A4EB95B14F10855EFA48672D2DBB8A404CB9E

Function 00403730 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000104), ref: 0040376A

Part of subcall function 00401340: GetLastError.KERNEL32(004539CD), ref: 00401340

Strings

MODULETYPE, xrefs: 004038EB, 004038FF
Module_Raw, xrefs: 00403816
InprocServer32, xrefs: 004038E6
MODULEGUID, xrefs: 004038A8
Module, xrefs: 004037F8
LocalServer32, xrefs: 004038FA

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: InprocServer32$LocalServer32$MODULEGUID$MODULETYPE$Module$Module_Raw
API String ID: 2776309574-664224703
Opcode ID: 836d792d6c6e83612313bfeccdb131782ac6cbc0d3ae019a1eb2b62605dc4184
Instruction ID: 0c77d95d92243191775de3b0224008b4e4733424fc31e2c037c20bf66a2e0f18
Opcode Fuzzy Hash: 836d792d6c6e83612313bfeccdb131782ac6cbc0d3ae019a1eb2b62605dc4184
Instruction Fuzzy Hash: 7D51E7716002059BD721DF68CC45FEE7BADAF88705F20447EF909E7291EB789A01CB69

Function 0041F1F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0041F259

Part of subcall function 00401340: GetLastError.KERNEL32(004539CD), ref: 00401340

Strings

.tlb, xrefs: 0041F3DC

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: .tlb
API String ID: 2776309574-1487266626
Opcode ID: adb5a1ff16ac2d66d52e432bf00f8af7cb9503df874892f081c82f03058fb298
Instruction ID: 9b9785280e83c06bf72cfa17a2c29b21f14e15cf94fe44496f559c848fd52b78
Opcode Fuzzy Hash: adb5a1ff16ac2d66d52e432bf00f8af7cb9503df874892f081c82f03058fb298
Instruction Fuzzy Hash: F681D6B1A006199BDB21DB75DC41BDF7369AF44304F10013EFD05A7252EB3D9A8A8B99

Function 0041F8E0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 98
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F1F0: GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0041F259

SysStringLen.OLEAUT32(?), ref: 0041F95D
GetModuleHandleW.KERNEL32(OLEAUT32.DLL), ref: 0041F9AC
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 0041F9BC
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0041F9D2
SysFreeString.OLEAUT32(?), ref: 0041F9DB
SysFreeString.OLEAUT32(?), ref: 0041F9F2

Strings

`<u, xrefs: 0041F9DB, 0041F9F2
OLEAUT32.DLL, xrefs: 0041F9A7
RegisterTypeLibForUser, xrefs: 0041F9B6

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$FreeModule$AddressFileHandleNameProcRegisterType
String ID: OLEAUT32.DLL$RegisterTypeLibForUser$`<u
API String ID: 940515025-1088932911
Opcode ID: 874ca412e3c63a284832fe8332c329a68f2cf71b4f8fd0871e1a2d389c88ac8f
Instruction ID: 0fa5801e8c7711098bf60dcfff18f6572caf3306e921b0cfa503c6be295beacb
Opcode Fuzzy Hash: 874ca412e3c63a284832fe8332c329a68f2cf71b4f8fd0871e1a2d389c88ac8f
Instruction Fuzzy Hash: 24317CB5608305AFC710EF65CC85E9BB7ECAFC8750F00892EB859C7251D634D989CBA6

Function 00402380 Relevance: 12.1, APIs: 8, Instructions: 129
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 004023C7
RegCloseKey.ADVAPI32(?,?,?,00000000,?,?), ref: 004023DE
RegEnumKeyExA.ADVAPI32(?,00000000), ref: 00402426
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000000,00000000,00000000,00000000,?), ref: 00402466
RegCloseKey.ADVAPI32(?), ref: 00402475
RegDeleteKeyA.ADVAPI32(?,?), ref: 0040248B
RegCloseKey.ADVAPI32(?,?,?,00000000,?,?), ref: 0040249C
RegCloseKey.ADVAPI32(?), ref: 004024C4

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Close$Enum$DeleteOpen
String ID:
API String ID: 3743465055-0
Opcode ID: 07676910dae279339e65c66eff11ea98f48860bb268aa7f578fa5aab01ffc370
Instruction ID: f5f978d7ed31b560cfb05a1ccfc567160bbffaae4958ef08ce20a98a3db99b67
Opcode Fuzzy Hash: 07676910dae279339e65c66eff11ea98f48860bb268aa7f578fa5aab01ffc370
Instruction Fuzzy Hash: 3B415CB1108240AFC724CF19D888C6BF7E8EBC8754F544A2EF989D3290D774D944CB66

Function 0041FB40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0041FB48
CoInitialize.OLE32 ref: 0041FB70
GetModuleHandleA.KERNEL32(Mscoree.dll), ref: 0041FB86

Strings

pH, xrefs: 0041FBA0
Mscoree.dll, xrefs: 0041FB81

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CurrentHandleInitializeModuleThread
String ID: Mscoree.dll$pH
API String ID: 1538281074-633203213
Opcode ID: e40993b3cb225473027884b1e421b489c6205368021bf6557ed9be95bce7f805
Instruction ID: c2b311cd136238bf75f49b4a5e6807f9446e2b002b534428bfd2d7fb6bf45521
Opcode Fuzzy Hash: e40993b3cb225473027884b1e421b489c6205368021bf6557ed9be95bce7f805
Instruction Fuzzy Hash: 0101D8312043408BD760CB69E99478ABBD57B51314F95047FE049C7A91C3F8F8CA8B9D

Function 024C8DD1 Relevance: 7.5, APIs: 5, Instructions: 38
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,00100000,00004000,?,?,?,?,024C85C4), ref: 024C8DFF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,?,024C85C4), ref: 024C8E0A
HeapFree.KERNEL32(00000000,?,?,?,?,?,024C85C4), ref: 024C8E17
HeapFree.KERNEL32(00000000,?,?,024C85C4), ref: 024C8E35
HeapDestroy.KERNELBASE(?,?,024C85C4), ref: 024C8E3D

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Free$Heap$Virtual$Destroy
String ID:
API String ID: 782257640-0
Opcode ID: a5b393bd58b0c9020bf395f2d5fc010e580cd649379e4c3f144dafc61214df09
Instruction ID: 7bcbc6e34dd43fba1b4da23e8dc3a693f1e091f2490dab09c1f4a5c4c1d82bbb
Opcode Fuzzy Hash: a5b393bd58b0c9020bf395f2d5fc010e580cd649379e4c3f144dafc61214df09
Instruction Fuzzy Hash: C0F03736A80214EFD6A59B1AEC85F427B69EB80764F324825F754264A087736834DF68

Function 0041FBD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteCriticalSection.KERNEL32(?), ref: 0041FC30
CoUninitialize.COMBASE ref: 0041FC48
DeleteCriticalSection.KERNEL32 ref: 0041FC79

Strings

pH, xrefs: 0041FBD2

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CriticalDeleteSection$Uninitialize
String ID: pH
API String ID: 1535714030-1451419334
Opcode ID: 1945ecea51107de2ad4085c649ae4dbc9bf98903b784cb05a6b09ed9b4b41bff
Instruction ID: f8247abbd7ebcf2dd4be1066be441b9111249e36522e993c846fb5ed87ade0e1
Opcode Fuzzy Hash: 1945ecea51107de2ad4085c649ae4dbc9bf98903b784cb05a6b09ed9b4b41bff
Instruction Fuzzy Hash: FB21AF3110060AABD720EF59C894B96B7A8BF45314F19853AD94887690D73CF8D6DBD8

Function 00407960 Relevance: 6.1, APIs: 4, Instructions: 107
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?,?,?,?), ref: 0040798C
_strcpy_s.LIBCMT ref: 004079B2
lstrlenA.KERNEL32(?), ref: 004079C1
_strcpy_s.LIBCMT ref: 004079E1

Part of subcall function 00405A80: __recalloc.LIBCMT ref: 00405A8D

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: _strcpy_slstrlen$__recalloc
String ID:
API String ID: 2628709221-0
Opcode ID: 3ab1ede86810f13982e809abfde6c1e8d0c77fae1980946221441278bbe9009b
Instruction ID: 8639fc9ba028f734c44e57eb1b61ffe3f3a1060c752f4f9ab0400c862042aeb5
Opcode Fuzzy Hash: 3ab1ede86810f13982e809abfde6c1e8d0c77fae1980946221441278bbe9009b
Instruction Fuzzy Hash: EF2186735052105BC200EF16AC8196FF3DCEED5769F04062FF98963242E639EA1586AB

Function 0041EFB0 Relevance: 6.1, APIs: 4, Instructions: 51
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 0041EFD6
lstrlenA.KERNEL32(?), ref: 0041EFF8
RegSetValueExA.KERNELBASE(00000000,?,00000000,00000001,?,00000001), ref: 0041F00B
RegCloseKey.ADVAPI32(00000000), ref: 0041F018

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 220b5a7a9d48e27996724097114404e934bb456e1c41db03473b8bdd94c12589
Instruction ID: 554972dd1a03b5d49e5174abad69aa6281b1cb8a2a7263eb5113a7cd4abda9c1
Opcode Fuzzy Hash: 220b5a7a9d48e27996724097114404e934bb456e1c41db03473b8bdd94c12589
Instruction Fuzzy Hash: 5C015E762082116FD231CF15AC48EABBBECEBC9B50F01452DF949E3241D774EC46D666

Function 024C95EE Relevance: 5.1, APIs: 4, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapReAlloc.KERNEL32(00000000,?,?,00000000,024C93B6,?,?), ref: 024C9616
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,024C93B6,?,?), ref: 024C964A
VirtualAlloc.KERNELBASE(00000000,00100000,00002000,00000004,?,00000000,024C93B6,?,?), ref: 024C9664
HeapFree.KERNEL32(00000000,?,?,00000000,024C93B6,?,?), ref: 024C967B

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 7455041880b36e6698c6e7560b45c2c46a9053659141173815068d45f6e70e73
Instruction ID: 2c37d0a319c58e064605554dbf7caea7beb30d09712eccde2179124d622b56c0
Opcode Fuzzy Hash: 7455041880b36e6698c6e7560b45c2c46a9053659141173815068d45f6e70e73
Instruction Fuzzy Hash: E2115B30A80200AFC7A8DF19EC449627BBAFBC57247324D1DE262D2990C3329875CF20

Function 0045A5EA Relevance: 4.5, APIs: 3, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0045A604

Part of subcall function 00459A0C: __FF_MSGBANNER.LIBCMT ref: 00459A2F
Part of subcall function 00459A0C: __NMSG_WRITE.LIBCMT ref: 00459A36
Part of subcall function 00459A0C: RtlAllocateHeap.NTDLL(00000000,0045A5FA,?,?,?,?,0045A609,?), ref: 00459A83

std::bad_alloc::bad_alloc.LIBCMT ref: 0045A627

Part of subcall function 0045A5CF: std::exception::exception.LIBCMT ref: 0045A5DB

__CxxThrowException@8.LIBCMT ref: 0045A649

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID:
API String ID: 3715980512-0
Opcode ID: f1a27d3a758a045c387bd5cd365edb82f4a31e8953aefd4ce0201162d28ae2cb
Instruction ID: 6c0a3679e22a46d002f9a7326fc1cfd5dc285797fa98cfa63209a2ed1efe20d1
Opcode Fuzzy Hash: f1a27d3a758a045c387bd5cd365edb82f4a31e8953aefd4ce0201162d28ae2cb
Instruction Fuzzy Hash: 32F02E3050020571CF057722EC17A4E3B595B40359B14813FFD00551E3DF6E9D5D854E

Function 0041ECF0 Relevance: 3.8, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharNextA.USER32(?), ref: 0041ED1B
CharNextA.USER32(?), ref: 0041ED22
CharNextA.USER32(?), ref: 0041ED31

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 1a68402594a324a227b1a85714b0c7364cabffe6a9162b98fdc3fd1be7644e31
Instruction ID: b1debb2f072bf2afeec4ec210f33277ac18c78df6538a55c3f74db67f394d6c7
Opcode Fuzzy Hash: 1a68402594a324a227b1a85714b0c7364cabffe6a9162b98fdc3fd1be7644e31
Instruction Fuzzy Hash: 1AF0A77F6063671BE7315AAA7850ADB53C88FC2761B19886BED8097301D319ACC543B9

Function 00407D20 Relevance: 3.1, APIs: 2, Instructions: 110
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00407DC6
RegCloseKey.ADVAPI32 ref: 00407DD9

Part of subcall function 00459AD6: __lock.LIBCMT ref: 00459AF4
Part of subcall function 00459AD6: ___sbh_find_block.LIBCMT ref: 00459AFF
Part of subcall function 00459AD6: ___sbh_free_block.LIBCMT ref: 00459B0E
Part of subcall function 00459AD6: HeapFree.KERNEL32(00000000,0045A609,0048DED0,0000000C,0045DDA5,00000000,0048E048,0000000C,0045DDDF,0045A609,?,?,004634E9,00000004,0048E2A8,0000000C), ref: 00459B3E
Part of subcall function 00459AD6: GetLastError.KERNEL32(?,004634E9,00000004,0048E2A8,0000000C,00463974,0045A609,?,00000000,00000000,00000000,?,0045D85E,00000001,00000214), ref: 00459B4F

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CloseCreateErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1295320124-0
Opcode ID: ef435da05bfb10a762ca1b674a03248c3a0a3ca98373551826142447dff24079
Instruction ID: 5476938c28825630ca6e74e4e869c346e6d9c1683751b9cda9ddd8da1968bb32
Opcode Fuzzy Hash: ef435da05bfb10a762ca1b674a03248c3a0a3ca98373551826142447dff24079
Instruction Fuzzy Hash: A63176B2A083585BD210EE55DC8082BB3D8EFC8754F540D3EF545A3241D235FD0886A7

Function 00401430 Relevance: 3.0, APIs: 2, Instructions: 28
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00401452
RegCloseKey.ADVAPI32 ref: 00401463

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 5e516e49b18bdb8d842e81705a0db527fd5c6b9844303cf9578a545d2e53e537
Instruction ID: 7a0320dcaec48890875100717ac5bb5dd89479aecf6acf376af6f9ae8149b982
Opcode Fuzzy Hash: 5e516e49b18bdb8d842e81705a0db527fd5c6b9844303cf9578a545d2e53e537
Instruction Fuzzy Hash: DFF0F8B5208301AFD328CF14D854F5BB7E8EF98741F10882DF58A833A0D774A844CB65

Function 00401490 Relevance: 3.0, APIs: 2, Instructions: 26registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004014A5
RegSetValueExA.KERNELBASE(?,?,00000000,?,?,00000001), ref: 004014BD

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Valuelstrlen
String ID:
API String ID: 799288031-0
Opcode ID: 517a0f0ebaf9668a7289ff4f31efff436417c2e913b4a7760f80bb1fe9946684
Instruction ID: b9612187c43c8f82ace58adc7f1a38e150b2087770bdc69f77fbb2ac5de9bbf7
Opcode Fuzzy Hash: 517a0f0ebaf9668a7289ff4f31efff436417c2e913b4a7760f80bb1fe9946684
Instruction Fuzzy Hash: 49E01A7A104120AFD221DB08E844EEBB7ACEFE9330B05882BF949D3250C674AC42C6A4

Function 024C8D95 Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,024C851E,00000001), ref: 024C8DA6

Part of subcall function 024C8F51: HeapAlloc.KERNEL32(00000000,00000140,024C8DBA), ref: 024C8F5E

HeapDestroy.KERNEL32 ref: 024C8DC4

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 5b4abac7657aed2f0f5d8ecaea5b3a28fc7cb9f373f669f6f39c8e79c0b4a194
Instruction ID: ca8fe9bd5e41980e8dc9a0e5ebcdcb73140c815e3a5d018030430e8df17429b7
Opcode Fuzzy Hash: 5b4abac7657aed2f0f5d8ecaea5b3a28fc7cb9f373f669f6f39c8e79c0b4a194
Instruction Fuzzy Hash: 1AE01274B90300EEEB955B3AAC04B6636E5AB54792F308C2AF905C4190E771D0A09F20

Function 0045E96F Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 0045E977

Part of subcall function 0045E944: GetModuleHandleW.KERNEL32(mscoree.dll,?,0045E97C,0045A609,?,0045DD33,000000FF,0000001E,0048E048,0000000C,0045DDDF,0045A609,?,?,004634E9,00000004), ref: 0045E94E
Part of subcall function 0045E944: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0045E95E

ExitProcess.KERNEL32 ref: 0045E980

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 820de88a53bc34ae35e7cb914764d49d679154b6d7f8b364fb262064cdaf127c
Instruction ID: 4da39ebc19e81f2f5b15b9fc2eed3cff75f0268e15f001ab71a053ec61fe42ec
Opcode Fuzzy Hash: 820de88a53bc34ae35e7cb914764d49d679154b6d7f8b364fb262064cdaf127c
Instruction Fuzzy Hash: FAB09B710041087BCB052F53DC0D8593F15FB403657544025F80805131EF719D91D689

Function 0045E8BB Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0045E8D0

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 68f83f20475b3df81ba0df263fd454434f95c5151ec5bb9346305263b7aa12ae
Instruction ID: f4c4d7b11d8b7b416557e2a5bb64f49cb4558b4f530250a00d370fbe89a9ef15
Opcode Fuzzy Hash: 68f83f20475b3df81ba0df263fd454434f95c5151ec5bb9346305263b7aa12ae
Instruction Fuzzy Hash: 27D05E326583046EDB006F71BC087223BDCE784395F108476B80CC6250E674D5409A48

Function 0045EB8B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 0045EB97

Part of subcall function 0045EA5F: __lock.LIBCMT ref: 0045EA6D
Part of subcall function 0045EA5F: __decode_pointer.LIBCMT ref: 0045EAA4
Part of subcall function 0045EA5F: __decode_pointer.LIBCMT ref: 0045EAB9
Part of subcall function 0045EA5F: __decode_pointer.LIBCMT ref: 0045EAE3
Part of subcall function 0045EA5F: __decode_pointer.LIBCMT ref: 0045EAF9
Part of subcall function 0045EA5F: __decode_pointer.LIBCMT ref: 0045EB06
Part of subcall function 0045EA5F: __initterm.LIBCMT ref: 0045EB35
Part of subcall function 0045EA5F: __initterm.LIBCMT ref: 0045EB45

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 830d18821fbf58695c80868ab2f530ebdf4f05e524c6810499408387132a203c
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: 2BB0923268020C33DA202553AC03F063A0D97C0B64E250022BA0C1D1A2AAA2AE658089

Function 024CA21E Relevance: 1.3, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,?,00000000,00000000,?,024C9962,00000001,00000074,?,?,024C88CE,024C0787), ref: 024CA273

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 22dc225e19acabe6ac465f657c0b64d7ce9744a0f3d7cf245f6bc474347b25e7
Instruction ID: a4014d7b719dd8bfcc75916f0a1ac89227655557f90298cc1759d53df2d0f3d7
Opcode Fuzzy Hash: 22dc225e19acabe6ac465f657c0b64d7ce9744a0f3d7cf245f6bc474347b25e7
Instruction Fuzzy Hash: 9A01903FA816382AD6E1592D5C40B5B32199BD17B1F39053FED547F3C8E7324C0486A1

Non-executed Functions

Function 004257D0 Relevance: 386.5, APIs: 139, Strings: 80, Instructions: 3247memoryfileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00425B46
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042624B
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00426278
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004262AA
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004262D8
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042630A
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00426331
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00426358
VariantClear.OLEAUT32(?), ref: 00426531
_com_issue_errorex.COMSUPP ref: 0042656B
SysAllocString.OLEAUT32(SampleNumber), ref: 004265B8
VariantClear.OLEAUT32(?), ref: 004265FE
SysAllocString.OLEAUT32(StationNumber), ref: 00426612
VariantClear.OLEAUT32(?), ref: 00426655
SysAllocString.OLEAUT32(DepthMethodIndex), ref: 00426669
VariantClear.OLEAUT32(?), ref: 004266AC
SysAllocString.OLEAUT32(NumberOfPoints), ref: 004266C0
VariantClear.OLEAUT32(?), ref: 00426706
SysAllocString.OLEAUT32(NumberOfSpikes), ref: 0042671A
VariantClear.OLEAUT32(?), ref: 00426760
SysAllocString.OLEAUT32(Temperature), ref: 00426774
VariantClear.OLEAUT32(?), ref: 004267BA
SysAllocString.OLEAUT32(Battery), ref: 004267CE
VariantClear.OLEAUT32(?), ref: 00426814
SysAllocString.OLEAUT32(MeasurementDepth), ref: 00426828
VariantClear.OLEAUT32(?), ref: 0042686E
SysAllocString.OLEAUT32(Method), ref: 00426882
VariantClear.OLEAUT32(?), ref: 004268C8
SysAllocString.OLEAUT32(Location1), ref: 004268DC
VariantClear.OLEAUT32(?), ref: 00426922
SysAllocString.OLEAUT32(Location2), ref: 00426936

Part of subcall function 00405620: _com_issue_errorex.COMSUPP ref: 0040566C

VariantClear.OLEAUT32(?), ref: 0042697C
SysAllocString.OLEAUT32(WaterDepth), ref: 00426990
VariantClear.OLEAUT32(?), ref: 004269D6
SysAllocString.OLEAUT32(CorrectionFactor), ref: 004269EA
VariantClear.OLEAUT32(?), ref: 00426A30
SysAllocString.OLEAUT32(IceDepth), ref: 00426A44
VariantClear.OLEAUT32(?), ref: 00426A8A
SysAllocString.OLEAUT32(WaterDepth), ref: 00426A9E
VariantClear.OLEAUT32(?), ref: 00426AE4
SysAllocString.OLEAUT32(Method), ref: 00426AF8
VariantClear.OLEAUT32(?), ref: 00426B40
SysAllocString.OLEAUT32(Location1), ref: 00426B54
VariantClear.OLEAUT32(?), ref: 00426B9C
SysAllocString.OLEAUT32(Location2), ref: 00426BB0
VariantClear.OLEAUT32(?), ref: 00426BF8
SysAllocString.OLEAUT32(WaterDepth), ref: 00426C0C
VariantClear.OLEAUT32(?), ref: 00426C54
SysAllocString.OLEAUT32(CorrectionFactor), ref: 00426C68
VariantClear.OLEAUT32(?), ref: 00426CB0
SysAllocString.OLEAUT32(IceDepth), ref: 00426CC4
VariantClear.OLEAUT32(?), ref: 00426D0C
SysAllocString.OLEAUT32(WaterDepth), ref: 00426D20
InterlockedIncrement.KERNEL32(-00000008), ref: 00426D55
VariantClear.OLEAUT32(?), ref: 00426E39
SysAllocString.OLEAUT32(WaterDepth2), ref: 00426E4D
InterlockedIncrement.KERNEL32(-00000008), ref: 00426E82
VariantClear.OLEAUT32(?), ref: 00426F66
SysAllocString.OLEAUT32(Velocity), ref: 00426F7A
VariantClear.OLEAUT32(?), ref: 00426FBF
SysAllocString.OLEAUT32(VelocityStdDev), ref: 00426FD3
VariantClear.OLEAUT32(?), ref: 00427018
SysAllocString.OLEAUT32(Amplitude), ref: 0042702C
VariantClear.OLEAUT32(?), ref: 00427071
SysAllocString.OLEAUT32(NoiseLevel), ref: 00427085
VariantClear.OLEAUT32(?), ref: 004270CA
SysAllocString.OLEAUT32(AmplitudeStdDev), ref: 004270DE
VariantClear.OLEAUT32(?), ref: 00427123
VariantClear.OLEAUT32(?), ref: 004271A7
VariantClear.OLEAUT32(?), ref: 00427202
_com_issue_errorex.COMSUPP ref: 0042728E

Part of subcall function 00459380: GetErrorInfo.OLEAUT32(00000000,00000000,?,00405831,00000000,?,00477D28), ref: 004593D0

SysAllocString.OLEAUT32(VelocityBurstNumber), ref: 004272B0
VariantClear.OLEAUT32(?), ref: 004272F0
SysAllocString.OLEAUT32(NumberOfPoints), ref: 00427304
VariantClear.OLEAUT32(?), ref: 00427344
SysAllocString.OLEAUT32(MeasurementDepth), ref: 00427358
VariantClear.OLEAUT32(?), ref: 00427398
VariantClear.OLEAUT32(?), ref: 004273F0
VariantClear.OLEAUT32(?), ref: 00427436
VariantClear.OLEAUT32(?), ref: 004274A0
VariantClear.OLEAUT32(?), ref: 004275A3
VariantClear.OLEAUT32(?), ref: 004275C5
VariantClear.OLEAUT32(?), ref: 0042764A
VariantClear.OLEAUT32(?), ref: 00427667
VariantClear.OLEAUT32(?), ref: 004276EC
VariantClear.OLEAUT32(?), ref: 00427709
VariantClear.OLEAUT32(?), ref: 0042778F
VariantClear.OLEAUT32(?), ref: 004277AC
VariantClear.OLEAUT32(?), ref: 0042783D
VariantClear.OLEAUT32(?), ref: 00427860
VariantClear.OLEAUT32(?), ref: 004278F1
VariantClear.OLEAUT32(?), ref: 00427914
VariantClear.OLEAUT32 ref: 00427975
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00427988
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?), ref: 004279AF
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?), ref: 004279DB
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00425BD6

Part of subcall function 00459580: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,7EE0FD72,?,00000000,?,?,00000000,00476A70,000000FF), ref: 004595F0
Part of subcall function 00459580: GetLastError.KERNEL32(?,00000000,?,?,00000000,00476A70,000000FF,?,00423D9B,?,?,AbbrBurst,?,00000000,?,Year), ref: 004595FC

Part of subcall function 00459580: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00459659
Part of subcall function 00459580: GetLastError.KERNEL32 ref: 0045966C

Part of subcall function 0041E9B0: SysStringByteLen.OLEAUT32(00000000), ref: 0041EB64
Part of subcall function 0041E9B0: SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 0041EB6E

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00425D29
SysAllocString.OLEAUT32(Station Summary), ref: 00426378
VariantClear.OLEAUT32(?), ref: 0042642E
_com_issue_errorex.COMSUPP ref: 00426469
InterlockedDecrement.KERNEL32(?), ref: 00427A8C
SysFreeString.OLEAUT32(00000000), ref: 00427AA5
SysAllocString.OLEAUT32(Velocity Data), ref: 00426480

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 00409730: InterlockedDecrement.KERNEL32(?), ref: 0040973E
Part of subcall function 00409730: SysFreeString.OLEAUT32(00000000), ref: 00409753

InterlockedDecrement.KERNEL32(?), ref: 00427B47
SysFreeString.OLEAUT32(00000000), ref: 00427B60
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00427B9D
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00427BCC
VariantClear.OLEAUT32 ref: 00427C27
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00427C37
VariantClear.OLEAUT32 ref: 00427C92
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00427CA2
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00427CD1
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00427D00
_com_issue_errorex.COMSUPP ref: 00427D65
_com_issue_errorex.COMSUPP ref: 00427DCD
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00427E06
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00427E35
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00427E99
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00427EC8

Part of subcall function 00420600: VariantInit.OLEAUT32 ref: 00420613
Part of subcall function 00420600: _com_issue_errorex.COMSUPP ref: 00420636
Part of subcall function 00420600: _memcpy_s.LIBCMT ref: 00420649

VariantClear.OLEAUT32(?), ref: 00427F64
VariantClear.OLEAUT32(?), ref: 00427F91
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00427FBC
VariantClear.OLEAUT32(?), ref: 00428067
VariantClear.OLEAUT32(?), ref: 00428094
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004280BF

Part of subcall function 00402F50: VariantInit.OLEAUT32(?), ref: 00402F95
Part of subcall function 00402F50: VariantChangeType.OLEAUT32(?,00000000,00000000,00000005), ref: 00402FC1
Part of subcall function 00402F50: VariantClear.OLEAUT32(?), ref: 00402FDE

VariantClear.OLEAUT32(?), ref: 00428187
VariantClear.OLEAUT32(?), ref: 004281AC
VariantClear.OLEAUT32(?), ref: 00428229
VariantClear.OLEAUT32(?), ref: 00428256
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004282A5
VariantClear.OLEAUT32(?), ref: 00428354
VariantClear.OLEAUT32(?), ref: 00428381
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004283B2
VariantClear.OLEAUT32 ref: 00428424
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00428434
VariantClear.OLEAUT32 ref: 00428494
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004284A4
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 004284CB

Strings

@, xrefs: 00427791
%s, xrefs: 00425BA3, 00425CF9
AbbrTemperature, xrefs: 00425D81
NoiseLevel, xrefs: 00427078
AbbrMethod, xrefs: 004259E5
AbbrSNR3, xrefs: 00425EA1
AbbrVelocityErrorZ, xrefs: 00425F79
AbbrMeasuredDepth, xrefs: 00425957
AbbrMeanDepth, xrefs: 00425BE3
AbbrAmpStd2, xrefs: 00425E11
, xrefs: 004287D4
%6.2f , xrefs: 00428406
CorrectionFactor, xrefs: 004269DD, 00426C5B
AbbrLocation, xrefs: 0042583C
Location1, xrefs: 004268CF, 00426B47
Method, xrefs: 00426875, 00426AEB
%s %s %s %s %s %s %s %s %s, xrefs: 00425AB6
Amplitude, xrefs: 0042701F
AbbrVelocityErrorY, xrefs: 00425FC1
(m) (m), xrefs: 0042628E
WaterDepth, xrefs: 00426983, 00426A91, 00426BFF, 00426D13
(ft) (ft), xrefs: 004262EE
AbbrStation, xrefs: 00425A2C
AbbrVelZ, xrefs: 00426051
%4d , xrefs: 00427C09
%s %s %s %s %s %s %s %s %s %s %s %s %s %s %s , xrefs: 00426173
AbbrVelocityErrorX, xrefs: 00426009
VelocityStdDev, xrefs: 00426FC6
Location2, xrefs: 00426929, 00426BA3
Station Summary, xrefs: 0042636B
WaterDepth2, xrefs: 00426E40
NumberOfPoints, xrefs: 004266B3, 004272F7
AbbrBattery, xrefs: 00425D36
`<u, xrefs: 00427AA5, 00427B60
%2d , xrefs: 00427C74
IceDepth, xrefs: 00426A37, 00426CB7
NumberOfSpikes, xrefs: 0042670D
Battery, xrefs: 004267C1
DepthMethodIndex, xrefs: 0042665C
AbbrDepth1, xrefs: 00425B62
AbbrDepth2, xrefs: 00425C2E
(ft) (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (dB) (dB) (dB) () () () (degF) (V), xrefs: 00426315
%s %s, xrefs: 00425C6C
%s , xrefs: 00427A5F, 00427B21
AbbrVelX, xrefs: 004260E7
%, xrefs: 004287B5
%3d , xrefs: 00427957, 00427993
%6.4f , xrefs: 004280A3
%4.2f , xrefs: 00427CB5
AbbrDepthFactor, xrefs: 0042599E
SampleNumber, xrefs: 004265AB
%1d , xrefs: 004279BB
() () () () (m) () () () (m) (m), xrefs: 0042625C
Velocity Data, xrefs: 00426473
AbbrNumberOfPoints, xrefs: 00425910
AbbrBurst, xrefs: 00425A73
AmplitudeStdDev, xrefs: 004270D1
AbbrVelY, xrefs: 0042609C
(m) (m/s) (m/s) (m/s) (m/s) (m/s) (m/s) (dB) (dB) (dB) () () () (degC) (V), xrefs: 004262B5
AbbrIceDepth, xrefs: 00426132
AbbrNumberOfSpikes, xrefs: 004258C9
VelocityBurstNumber, xrefs: 004272A3
q, xrefs: 00426EC9
%6.3f , xrefs: 00427DEA, 00427E19, 00427E52, 00427E7D, 00427EAC
AbbrSNR1, xrefs: 00425F31
MeasurementDepth, xrefs: 0042681B, 0042734B
AbbrAmpStd3, xrefs: 00425DC9
StationNumber, xrefs: 00426605
Temperature, xrefs: 00426767
AbbrAmpStd1, xrefs: 00425E59
() () () () (ft) () () () (ft) (ft), xrefs: 004262BC
%4.1f , xrefs: 00428289, 00428396
%8.3f , xrefs: 00427CE4
%5.2f , xrefs: 00427BB0, 00428476
%7.4f , xrefs: 00427FA0
AbbrCorrection, xrefs: 00425882
Velocity, xrefs: 00426F6D
AbbrDepth, xrefs: 00425CAA
o, xrefs: 00426E9C
AbbrSNR2, xrefs: 00425EE9

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$String$Alloc$FileWrite$_com_issue_errorex$Interlocked$Byte$DecrementErrorFree$CharIncrementInitLastMultiWide$ChangeConvertInfoType_com_util::_memcpy_s
String ID: () () () () (m) () () () (m) (m)$ () () () () (ft) () () () (ft) (ft)$ $ (m) (m)$ (ft) (ft)$ (m) (m/s) (m/s) (m/s) (m/s) (m/s) (m/s) (dB) (dB) (dB) () () () (degC) (V)$ %s$ (ft) (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (dB) (dB) (dB) () () () (degF) (V)$ %s %s$ %s %s %s %s %s %s %s %s %s$ %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s $%$%1d $%2d $%3d $%4.1f $%4.2f $%4d $%5.2f $%6.2f $%6.3f $%6.4f $%7.4f $%8.3f $%s $@$AbbrAmpStd1$AbbrAmpStd2$AbbrAmpStd3$AbbrBattery$AbbrBurst$AbbrCorrection$AbbrDepth$AbbrDepth1$AbbrDepth2$AbbrDepthFactor$AbbrIceDepth$AbbrLocation$AbbrMeanDepth$AbbrMeasuredDepth$AbbrMethod$AbbrNumberOfPoints$AbbrNumberOfSpikes$AbbrSNR1$AbbrSNR2$AbbrSNR3$AbbrStation$AbbrTemperature$AbbrVelX$AbbrVelY$AbbrVelZ$AbbrVelocityErrorX$AbbrVelocityErrorY$AbbrVelocityErrorZ$Amplitude$AmplitudeStdDev$Battery$CorrectionFactor$DepthMethodIndex$IceDepth$Location1$Location2$MeasurementDepth$Method$NoiseLevel$NumberOfPoints$NumberOfSpikes$SampleNumber$Station Summary$StationNumber$Temperature$Velocity$Velocity Data$VelocityBurstNumber$VelocityStdDev$WaterDepth$WaterDepth2$`<u$o$q
API String ID: 1693379380-3825761198
Opcode ID: 7a7a35a913fb437568e9cca5596dcb2ff64da81137b720c5035fd2420b7df66b
Instruction ID: 1433840865e8e85b33c4b8b4394771e59134ab54aa507a48a30fd132f88207c4
Opcode Fuzzy Hash: 7a7a35a913fb437568e9cca5596dcb2ff64da81137b720c5035fd2420b7df66b
Instruction Fuzzy Hash: 6B539470208781DFD734DB65C884B9FB7E8AFC8304F50895EE98997291DB789844CB6B

Function 0041C040 Relevance: 238.3, APIs: 111, Strings: 24, Instructions: 2066COMMON

Download Yara Rule

APIs

Part of subcall function 00402B00: SysAllocString.OLEAUT32(?), ref: 00402B55

_com_util::ConvertStringToBSTR.COMSUPP ref: 0041C263
VariantClear.OLEAUT32(?), ref: 0041C2B7
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041C34F
VariantClear.OLEAUT32(?), ref: 0041C39F
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041C3B3
VariantClear.OLEAUT32(?), ref: 0041C3EB
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041C3FF
VariantClear.OLEAUT32(?), ref: 0041C437
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041C44B

Part of subcall function 00405970: _com_issue_errorex.COMSUPP ref: 004059BC

VariantClear.OLEAUT32(?), ref: 0041C486
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041C497

Part of subcall function 00459400: lstrlenA.KERNEL32(?,7EE0FD72,?,00000000,00000000), ref: 00459447
Part of subcall function 00459400: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,?,00000000,00000000), ref: 0045945D
Part of subcall function 00459400: GetLastError.KERNEL32(?,00000000,00000000), ref: 0045946C
Part of subcall function 00459400: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000), ref: 004594FB
Part of subcall function 00459400: GetLastError.KERNEL32 ref: 00459516
Part of subcall function 00459400: SysAllocString.OLEAUT32(00000000), ref: 00459531

Part of subcall function 0041B2C0: VariantInit.OLEAUT32 ref: 0041B2D4
Part of subcall function 0041B2C0: _com_issue_errorex.COMSUPP ref: 0041B311
Part of subcall function 0041B2C0: _memcpy_s.LIBCMT ref: 0041B324

VariantClear.OLEAUT32(?), ref: 0041C4D7
VariantClear.OLEAUT32(?), ref: 0041C4E6
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041C583

Part of subcall function 00459400: _malloc.LIBCMT ref: 004594B1

Part of subcall function 00402EA0: VariantInit.OLEAUT32(7EE0FD72), ref: 00402EE5
Part of subcall function 00402EA0: VariantChangeType.OLEAUT32(?,00000000,00000000,00000003), ref: 00402F11
Part of subcall function 00402EA0: VariantClear.OLEAUT32(?), ref: 00402F2A

VariantClear.OLEAUT32(?), ref: 0041C5C3
VariantClear.OLEAUT32(?), ref: 0041C5CA
VariantClear.OLEAUT32(?), ref: 0041C640
VariantClear.OLEAUT32(?), ref: 0041C647
VariantClear.OLEAUT32(?), ref: 0041C699
VariantClear.OLEAUT32(?), ref: 0041C6A0
VariantClear.OLEAUT32(?), ref: 0041C716
VariantClear.OLEAUT32(?), ref: 0041C71D
VariantClear.OLEAUT32(?), ref: 0041C7A8
VariantClear.OLEAUT32(?), ref: 0041C7B2
VariantClear.OLEAUT32(?), ref: 0041C7B9
VariantClear.OLEAUT32(?), ref: 0041C7C8
VariantClear.OLEAUT32(?), ref: 0041C829

Strings

Index, xrefs: 0041C342
J, xrefs: 0041D01A
PeakShapeCheck, xrefs: 0041C180
k, xrefs: 0041DBE0
Y, xrefs: 0041D500
NoiseLevelCheck, xrefs: 0041C08A
_, xrefs: 0041D6FD
j, xrefs: 0041DBB8
SamplingVolumeStart, xrefs: 0041C579
NominalNoiseLevel, xrefs: 0041C256
[, xrefs: 0041D534
PassTest, xrefs: 0041D937, 0041DA0F, 0041DADE, 0041DBB3
SnrTooLowForTest, xrefs: 0041CC0C, 0041D02E
`<u, xrefs: 0041CD39, 0041D155, 0041D24C, 0041D3DB, 0041D4C4, 0041D655, 0041D68D, 0041D6C5, 0041DC77
SamplingVolumeCenter, xrefs: 0041C48D
Range, xrefs: 0041C3A6
%.0f,%.0f, xrefs: 0041D1AB, 0041D423
SnrCheck, xrefs: 0041C0EA
ExpectedNoiseLevel, xrefs: 0041D52F
NoiseLevel, xrefs: 0041C43E
Amplitude, xrefs: 0041C3F2
MeasuredNoiseLevel, xrefs: 0041D2B7
PeakLocationCheck, xrefs: 0041C135
,%.0f, xrefs: 0041D1F3, 0041D46B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$String$Convert_com_util::$AllocByteCharErrorInitLastMultiWide_com_issue_errorex$ChangeType_malloc_memcpy_slstrlen
String ID: %.0f,%.0f$,%.0f$Amplitude$ExpectedNoiseLevel$Index$J$MeasuredNoiseLevel$NoiseLevel$NoiseLevelCheck$NominalNoiseLevel$PassTest$PeakLocationCheck$PeakShapeCheck$Range$SamplingVolumeCenter$SamplingVolumeStart$SnrCheck$SnrTooLowForTest$Y$[$_$`<u$j$k
API String ID: 4003595407-2371156064
Opcode ID: 68523be965f32c5ae61e0b31ca29b44b4f8f95e51713286a8fcb95404571e9f8
Instruction ID: 401af8e63522db3bb0a684354c7862ad9661e14b564f36114365fdd637accb59
Opcode Fuzzy Hash: 68523be965f32c5ae61e0b31ca29b44b4f8f95e51713286a8fcb95404571e9f8
Instruction Fuzzy Hash: 6403AFB05083859FD320DF69C880B9BBBE9BFD8304F10891EE98997352DB78D945CB56

Function 00429540 Relevance: 229.3, APIs: 74, Strings: 56, Instructions: 1779memoryfileCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Velocity Data), ref: 0042958D
VariantClear.OLEAUT32(?), ref: 00429645
_com_issue_errorex.COMSUPP ref: 004296A2

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 00459580: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,7EE0FD72,?,00000000,?,?,00000000,00476A70,000000FF), ref: 004595F0
Part of subcall function 00459580: GetLastError.KERNEL32(?,00000000,?,?,00000000,00476A70,000000FF,?,00423D9B,?,?,AbbrBurst,?,00000000,?,Year), ref: 004595FC

Part of subcall function 00459580: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00459659
Part of subcall function 00459580: GetLastError.KERNEL32 ref: 0045966C

Part of subcall function 00409730: InterlockedDecrement.KERNEL32(?), ref: 0040973E
Part of subcall function 00409730: SysFreeString.OLEAUT32(00000000), ref: 00409753

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00429DF9
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00429E31
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00429E5C
SysAllocString.OLEAUT32(SampleNumber), ref: 00429E7E
VariantClear.OLEAUT32(?), ref: 00429EC1
SysAllocString.OLEAUT32(StationNumber), ref: 00429ED5
VariantClear.OLEAUT32(?), ref: 00429F18
SysAllocString.OLEAUT32(Location1), ref: 00429F2C
VariantClear.OLEAUT32(?), ref: 00429F6F
SysAllocString.OLEAUT32(Location2), ref: 00429F83

Part of subcall function 00405620: _com_issue_errorex.COMSUPP ref: 0040566C

VariantClear.OLEAUT32(?), ref: 00429FC6
SysAllocString.OLEAUT32(WaterDepth), ref: 00429FDA
VariantClear.OLEAUT32(?), ref: 0042A01D
SysAllocString.OLEAUT32(MeasurementDepth), ref: 0042A031
VariantClear.OLEAUT32(?), ref: 0042A074
SysAllocString.OLEAUT32(Method), ref: 0042A088
VariantClear.OLEAUT32(?), ref: 0042A0CE
SysAllocString.OLEAUT32(CorrectionFactor), ref: 0042A0E2
VariantClear.OLEAUT32(?), ref: 0042A128
SysAllocString.OLEAUT32(NumberOfPoints), ref: 0042A13C
VariantClear.OLEAUT32(?), ref: 0042A17F
SysAllocString.OLEAUT32(NumberOfSpikes), ref: 0042A193
VariantClear.OLEAUT32(?), ref: 0042A1D6
SysAllocString.OLEAUT32(Temperature), ref: 0042A1EA
VariantClear.OLEAUT32(?), ref: 0042A22D
SysAllocString.OLEAUT32(Battery), ref: 0042A241
VariantClear.OLEAUT32(?), ref: 0042A284
SysAllocString.OLEAUT32(Velocity), ref: 0042A295
VariantClear.OLEAUT32(?), ref: 0042A2D1
SysAllocString.OLEAUT32(VelocityStdDev), ref: 0042A2E2
VariantClear.OLEAUT32(?), ref: 0042A31E
SysAllocString.OLEAUT32(Amplitude), ref: 0042A32F
VariantClear.OLEAUT32(?), ref: 0042A36B
SysAllocString.OLEAUT32(NoiseLevel), ref: 0042A37C

Part of subcall function 004205A0: _com_issue_errorex.COMSUPP ref: 004205E4

VariantClear.OLEAUT32(?), ref: 0042A3B8
SysAllocString.OLEAUT32(AmplitudeStdDev), ref: 0042A3C9
VariantClear.OLEAUT32(?), ref: 0042A405
VariantClear.OLEAUT32 ref: 0042A47B
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042A48E
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?), ref: 0042A4BD
VariantClear.OLEAUT32 ref: 0042A512
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042A522

Part of subcall function 00420600: VariantInit.OLEAUT32 ref: 00420613
Part of subcall function 00420600: _com_issue_errorex.COMSUPP ref: 00420636
Part of subcall function 00420600: _memcpy_s.LIBCMT ref: 00420649

VariantClear.OLEAUT32 ref: 0042A577
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042A587
VariantClear.OLEAUT32 ref: 0042A5E1
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042A5F1
VariantClear.OLEAUT32 ref: 0042A64B
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042A65B
VariantClear.OLEAUT32 ref: 0042A6B5
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042A6C5
VariantClear.OLEAUT32(?), ref: 0042A717
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042A727

Part of subcall function 00402F50: VariantInit.OLEAUT32(?), ref: 00402F95
Part of subcall function 00402F50: VariantChangeType.OLEAUT32(?,00000000,00000000,00000005), ref: 00402FC1
Part of subcall function 00402F50: VariantClear.OLEAUT32(?), ref: 00402FDE

VariantClear.OLEAUT32(?), ref: 0042A7BE
VariantClear.OLEAUT32(?), ref: 0042A7E8
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042A813
VariantClear.OLEAUT32(?), ref: 0042A8C4
VariantClear.OLEAUT32(?), ref: 0042A8F1
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042A91C

Strings

%s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s , xrefs: 00429CF0
, xrefs: 0042AE17
AbbrTemperature, xrefs: 0042970C
NoiseLevel, xrefs: 0042A372
AbbrSNR3, xrefs: 0042982C
AbbrVelocityErrorZ, xrefs: 00429904
AbbrMeasuredDepth, xrefs: 00429AAE
AbbrAmpStd2, xrefs: 0042979C
%6.2f , xrefs: 0042AC4A
CorrectionFactor, xrefs: 0042A0D5
Location1, xrefs: 00429F1F
Method, xrefs: 0042A07B
Amplitude, xrefs: 0042A325
AbbrVelocityErrorY, xrefs: 0042994C
WaterDepth, xrefs: 00429FCD
AbbrStation, xrefs: 00429C61
AbbrVelZ, xrefs: 004299D9
%4d , xrefs: 0042A4F4
AbbrVelocityErrorX, xrefs: 00429994
VelocityStdDev, xrefs: 0042A2D8
Location2, xrefs: 00429F76
NumberOfPoints, xrefs: 0042A12F
AbbrBattery, xrefs: 004296C4
%2d , xrefs: 0042A559
NumberOfSpikes, xrefs: 0042A186
Battery, xrefs: 0042A234
AbbrLocation1, xrefs: 00429B86
AbbrVelX, xrefs: 00429A66
%3d , xrefs: 0042A45D, 0042A49A
%6.4f , xrefs: 0042A900
AbbrLocation2, xrefs: 00429B3E
SampleNumber, xrefs: 00429E71
Velocity Data, xrefs: 00429580
AbbrNumberOfPoints, xrefs: 00429C16
AbbrBurst, xrefs: 00429CAC
() () () () (m) (m) (m) (m) (m/s) (m/s) (m/s) (m/s) (m/s) (m/s) (dB) (dB) (dB) () () () (degC) (V), xrefs: 00429E0A
AmplitudeStdDev, xrefs: 0042A3BF
AbbrVelY, xrefs: 00429A1E
AbbrNumberOfSpikes, xrefs: 00429BCE
>, xrefs: 0042ACCA
%6.3f , xrefs: 0042A697, 0042A701
AbbrSNR1, xrefs: 004298BC
W, xrefs: 0042AB55
MeasurementDepth, xrefs: 0042A024
() () () () (ft) (ft) (ft) (ft) (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (dB) (dB) (dB) () () () (degF) (V), xrefs: 00429E11
AbbrAmpStd3, xrefs: 00429754
StationNumber, xrefs: 00429EC8
Temperature, xrefs: 0042A1DD
AbbrAmpStd1, xrefs: 004297E4
%4.1f , xrefs: 0042AAE0, 0042ABE0
%8.3f , xrefs: 0042A5C3, 0042A62D
%5.2f , xrefs: 0042ACB4
%7.4f , xrefs: 0042A7F7
Velocity, xrefs: 0042A28B
AbbrDepth, xrefs: 00429AF6
AbbrSNR2, xrefs: 00429874

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$String$Alloc$FileWrite$_com_issue_errorex$ByteCharErrorInitLastMultiWide$ChangeConvertDecrementFreeInterlockedType_com_util::_memcpy_s
String ID: () () () () (m) (m) (m) (m) (m/s) (m/s) (m/s) (m/s) (m/s) (m/s) (dB) (dB) (dB) () () () (degC) (V)$ () () () () (ft) (ft) (ft) (ft) (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (dB) (dB) (dB) () () () (degF) (V)$ $ %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s $%2d $%3d $%4.1f $%4d $%5.2f $%6.2f $%6.3f $%6.4f $%7.4f $%8.3f $>$AbbrAmpStd1$AbbrAmpStd2$AbbrAmpStd3$AbbrBattery$AbbrBurst$AbbrDepth$AbbrLocation1$AbbrLocation2$AbbrMeasuredDepth$AbbrNumberOfPoints$AbbrNumberOfSpikes$AbbrSNR1$AbbrSNR2$AbbrSNR3$AbbrStation$AbbrTemperature$AbbrVelX$AbbrVelY$AbbrVelZ$AbbrVelocityErrorX$AbbrVelocityErrorY$AbbrVelocityErrorZ$Amplitude$AmplitudeStdDev$Battery$CorrectionFactor$Location1$Location2$MeasurementDepth$Method$NoiseLevel$NumberOfPoints$NumberOfSpikes$SampleNumber$StationNumber$Temperature$Velocity$Velocity Data$VelocityStdDev$W$WaterDepth
API String ID: 2243946993-21521936
Opcode ID: 9e051656d111cd7983077c15d179bbea1584dff6c9be277598b5e48dd2464193
Instruction ID: 07d497b8922b0b36f2d8184320b632ade8a1e63a2640bf1527e8b216a17775dd
Opcode Fuzzy Hash: 9e051656d111cd7983077c15d179bbea1584dff6c9be277598b5e48dd2464193
Instruction Fuzzy Hash: CAE2B471209380DFD335EB65C944B9FB7E8AF88704F40891EF58997281DB789944CBAB

Function 00417E80 Relevance: 202.9, APIs: 89, Strings: 26, Instructions: 1630COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?,7EE0FD72), ref: 00417ECB
QueryPerformanceCounter.KERNEL32(?), ref: 00417EE2
_com_util::ConvertStringToBSTR.COMSUPP ref: 00417F59
VariantClear.OLEAUT32(?), ref: 00417FB4
VariantClear.OLEAUT32(?), ref: 00417FBB
VariantClear.OLEAUT32(?), ref: 00417FC2
_com_util::ConvertStringToBSTR.COMSUPP ref: 00417FED
VariantClear.OLEAUT32(?), ref: 00418042
VariantClear.OLEAUT32(?), ref: 00418049
VariantClear.OLEAUT32(?), ref: 00418050
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041807B
VariantClear.OLEAUT32(?), ref: 004180D0
VariantClear.OLEAUT32(?), ref: 004180D7
VariantClear.OLEAUT32(?), ref: 004180DE
_com_util::ConvertStringToBSTR.COMSUPP ref: 00418109
VariantClear.OLEAUT32(?), ref: 0041815E
VariantClear.OLEAUT32(?), ref: 00418165
VariantClear.OLEAUT32(?), ref: 0041816C
_com_util::ConvertStringToBSTR.COMSUPP ref: 00418197
VariantClear.OLEAUT32(?), ref: 004181E9
VariantClear.OLEAUT32(?), ref: 004181F0
VariantClear.OLEAUT32(?), ref: 004181F7
_com_util::ConvertStringToBSTR.COMSUPP ref: 00418222

Part of subcall function 00459400: lstrlenA.KERNEL32(?,7EE0FD72,?,00000000,00000000), ref: 00459447
Part of subcall function 00459400: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,?,00000000,00000000), ref: 0045945D
Part of subcall function 00459400: GetLastError.KERNEL32(?,00000000,00000000), ref: 0045946C
Part of subcall function 00459400: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000), ref: 004594FB
Part of subcall function 00459400: GetLastError.KERNEL32 ref: 00459516
Part of subcall function 00459400: SysAllocString.OLEAUT32(00000000), ref: 00459531

VariantClear.OLEAUT32(?), ref: 00418274
VariantClear.OLEAUT32(?), ref: 0041827B
VariantClear.OLEAUT32(?), ref: 00418282
_com_util::ConvertStringToBSTR.COMSUPP ref: 004182AD
VariantClear.OLEAUT32(?), ref: 004182FF
VariantClear.OLEAUT32(?), ref: 00418306
VariantClear.OLEAUT32(?), ref: 00418315
_com_util::ConvertStringToBSTR.COMSUPP ref: 00418326
_com_util::ConvertStringToBSTR.COMSUPP ref: 00418346
VariantClear.OLEAUT32(?), ref: 0041839D
VariantClear.OLEAUT32(?), ref: 004183A4
VariantClear.OLEAUT32(?), ref: 004183B3
_com_issue_errorex.COMSUPP ref: 0041841E
InterlockedIncrement.KERNEL32(?), ref: 00418466
_com_issue_errorex.COMSUPP ref: 004184E8

Part of subcall function 00409730: InterlockedDecrement.KERNEL32(?), ref: 0040973E
Part of subcall function 00409730: SysFreeString.OLEAUT32(00000000), ref: 00409753

Strings

ExportFpx, xrefs: 00418210
AdminMode, xrefs: 00418F3D
KeypadMode, xrefs: 00418761
.fpx, xrefs: 0041920B
ExportCtl, xrefs: 00418069
ShowReport, xrefs: 00417F47
UserExportPath, xrefs: 00418334
.dis, xrefs: 00418CF7
Setup, xrefs: 00418693
.dat, xrefs: 00419105
,, xrefs: 0041886A
Export, xrefs: 00417EFB
+, xrefs: 0041884E
0, xrefs: 00419268
ExportDat, xrefs: 00418185
C:\SonData\, xrefs: 0041831C
-, xrefs: 00418886
.sum, xrefs: 00418FED
ExportToSamePath, xrefs: 0041829B
ExportDis, xrefs: 00417FDB
", xrefs: 0041938C
?, xrefs: 00419227
.ctl, xrefs: 00418E0E
ExportSum, xrefs: 004180F7
ProcessingFile, xrefs: 00418881
', xrefs: 0041889E

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$String$Convert_com_util::$ByteCharErrorInterlockedLastMultiPerformanceQueryWide_com_issue_errorex$AllocCounterDecrementFreeFrequencyIncrementlstrlen
String ID: "$'$+$,$-$.ctl$.dat$.dis$.fpx$.sum$0$?$AdminMode$C:\SonData\$Export$ExportCtl$ExportDat$ExportDis$ExportFpx$ExportSum$ExportToSamePath$KeypadMode$ProcessingFile$Setup$ShowReport$UserExportPath
API String ID: 3216601141-1526214826
Opcode ID: 76f5ab3531af253b595f63576081e942a5012bd35e99d04dafc35cfd295862cd
Instruction ID: 41f79d0d9f2c6617c65a61770b54a5068406168031109439d8858c9a815b8fae
Opcode Fuzzy Hash: 76f5ab3531af253b595f63576081e942a5012bd35e99d04dafc35cfd295862cd
Instruction Fuzzy Hash: 02D26F71108384DFD720EF65C880BAFB7E9AF99304F00891EF58997292DB78D945CB5A

Function 004247D0 Relevance: 141.2, APIs: 44, Strings: 36, Instructions: 1195filememorytimeCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00424D80

Part of subcall function 00459580: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00459659
Part of subcall function 00459580: GetLastError.KERNEL32 ref: 0045966C

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00424DCB
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00424DF2
SysAllocString.OLEAUT32(DeploymentData), ref: 00424E10
VariantClear.OLEAUT32(?), ref: 00424EC6

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 00459580: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,7EE0FD72,?,00000000,?,?,00000000,00476A70,000000FF), ref: 004595F0
Part of subcall function 00459580: GetLastError.KERNEL32(?,00000000,?,?,00000000,00476A70,000000FF,?,00423D9B,?,?,AbbrBurst,?,00000000,?,Year), ref: 004595FC

_com_issue_errorex.COMSUPP ref: 00424F23
SysAllocString.OLEAUT32(SampleTime), ref: 00424F59
VariantClear.OLEAUT32(?), ref: 00424F9C
_com_util::ConvertStringToBSTR.COMSUPP ref: 00424FB0
VariantClear.OLEAUT32(?), ref: 00424FE8
_com_util::ConvertStringToBSTR.COMSUPP ref: 00424FFC
VariantClear.OLEAUT32(?), ref: 00425034
_com_util::ConvertStringToBSTR.COMSUPP ref: 00425045
VariantClear.OLEAUT32(?), ref: 00425073
_com_util::ConvertStringToBSTR.COMSUPP ref: 00425084
VariantClear.OLEAUT32(?), ref: 004250B2
SysAllocString.OLEAUT32(NoiseLevel), ref: 004250C3
VariantClear.OLEAUT32(?), ref: 004250FC
SysAllocString.OLEAUT32(VelocityStdDev), ref: 0042510D

Part of subcall function 004205A0: _com_issue_errorex.COMSUPP ref: 004205E4

VariantClear.OLEAUT32(?), ref: 00425146
VariantClear.OLEAUT32(?), ref: 004251A4
VariantTimeToSystemTime.OLEAUT32 ref: 004251B5
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004251EA
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00425212
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042523A
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00425262
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042528A
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004252B2

Part of subcall function 00405620: _com_issue_errorex.COMSUPP ref: 0040566C

VariantClear.OLEAUT32(?), ref: 0042534B
VariantClear.OLEAUT32(?), ref: 0042536D
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042537D
VariantClear.OLEAUT32(?), ref: 0042542B
VariantClear.OLEAUT32(?), ref: 0042544D
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042545D
VariantClear.OLEAUT32(?), ref: 0042550E
VariantClear.OLEAUT32(?), ref: 00425530
VariantClear.OLEAUT32(?), ref: 004255AA
VariantClear.OLEAUT32(?), ref: 004255D4
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042561B
VariantClear.OLEAUT32 ref: 0042568B
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042569B
VariantClear.OLEAUT32 ref: 004256F5
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00425705
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 0042572C

Strings

Hour, xrefs: 00424BAA
%4d , xrefs: 004251CB
AbbrTemperature, xrefs: 00424865
NoiseLevel, xrefs: 004250B9
AbbrSNR3, xrefs: 004248AA
Second, xrefs: 00424B20
AbbrVelocityErrorZ, xrefs: 0042497C
%6.2f , xrefs: 0042566D
AbbrVelocityErrorY, xrefs: 004249C1
() () () () () () (m/s) (m/s) (m/s) (m/s) (m/s) (m/s) (dB) (dB) (dB) (degC) (V), xrefs: 00424D91
Month, xrefs: 00424C34
() () () () () () (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (dB) (dB) (dB) (degF) (V), xrefs: 00424DAF
AbbrVelZ, xrefs: 00424A4E
DeploymentData, xrefs: 00424E03
AbbrVelocityErrorX, xrefs: 00424A06
AbbrVelY, xrefs: 00424A96
BatteryMean, xrefs: 00424FEF
-, xrefs: 0042555B
AmplitudeMean, xrefs: 0042507A
Year, xrefs: 00424C79
VelocityStdDev, xrefs: 00425103
AbbrSNR1, xrefs: 00424934
1, xrefs: 004256C4
Day, xrefs: 00424BEF
AbbrBattery, xrefs: 0042481D
", xrefs: 00425128
TemperatureMean, xrefs: 00424FA3
SampleTime, xrefs: 00424F4C
%s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s , xrefs: 00424CBD
%02d , xrefs: 004251F6, 0042521E, 00425246, 0042526E, 00425296
VelocityMean, xrefs: 0042503B
Minute, xrefs: 00424B65
%7.4f , xrefs: 00425335, 00425415
AbbrVelX, xrefs: 00424ADB
%5.1f , xrefs: 004255FF, 004256D7
AbbrSNR2, xrefs: 004248EF

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$FileWrite$String$Convert_com_util::$Alloc$_com_issue_errorex$ByteCharErrorLastMultiTimeWide$System
String ID: () () () () () () (m/s) (m/s) (m/s) (m/s) (m/s) (m/s) (dB) (dB) (dB) (degC) (V)$ () () () () () () (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (ft/s) (dB) (dB) (dB) (degF) (V)$ %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s $ %4d $"$%02d $%5.1f $%6.2f $%7.4f $-$1$AbbrBattery$AbbrSNR1$AbbrSNR2$AbbrSNR3$AbbrTemperature$AbbrVelX$AbbrVelY$AbbrVelZ$AbbrVelocityErrorX$AbbrVelocityErrorY$AbbrVelocityErrorZ$AmplitudeMean$BatteryMean$Day$DeploymentData$Hour$Minute$Month$NoiseLevel$SampleTime$Second$TemperatureMean$VelocityMean$VelocityStdDev$Year
API String ID: 2538089054-4027713949
Opcode ID: 907e4fffe667b3856e0087572a7dbeb889ba8ee19a0ef56bfa667e61ede7840b
Instruction ID: 4498af49a0f54fb91791f6b943d3e425f6df6c2696e9e265e7abcd7d16acb205
Opcode Fuzzy Hash: 907e4fffe667b3856e0087572a7dbeb889ba8ee19a0ef56bfa667e61ede7840b
Instruction Fuzzy Hash: C3A29E71609350AFD324DB65C945F9BBBE8EFC8704F00491EF58997281DB78E844CBAA

Function 004239D0 Relevance: 118.3, APIs: 38, Strings: 29, Instructions: 1023memoryfileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00423E45
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00423E79
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00423EA0
SysAllocString.OLEAUT32(Velocity Data), ref: 00423EBA
VariantClear.OLEAUT32(?), ref: 00423F6A
_com_issue_errorex.COMSUPP ref: 00423F9E

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 00459580: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,7EE0FD72,?,00000000,?,?,00000000,00476A70,000000FF), ref: 004595F0
Part of subcall function 00459580: GetLastError.KERNEL32(?,00000000,?,?,00000000,00476A70,000000FF,?,00423D9B,?,?,AbbrBurst,?,00000000,?,Year), ref: 004595FC

SysAllocString.OLEAUT32(SampleNumber), ref: 00423FC3
VariantClear.OLEAUT32(?), ref: 0042400A
SysAllocString.OLEAUT32(NoiseLevel), ref: 0042401F
VariantClear.OLEAUT32(?), ref: 0042405F
SysAllocString.OLEAUT32(SampleTime), ref: 004240CA

Part of subcall function 00459580: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00459659
Part of subcall function 00459580: GetLastError.KERNEL32 ref: 0045966C

Part of subcall function 00405620: _com_issue_errorex.COMSUPP ref: 0040566C

VariantClear.OLEAUT32(?), ref: 00424117
SysAllocString.OLEAUT32(Velocity), ref: 0042412F
_com_issue_errorex.COMSUPP ref: 0042418D
VariantClear.OLEAUT32(?), ref: 004241A2
SysAllocString.OLEAUT32(Amplitude), ref: 004241B7
_com_issue_errorex.COMSUPP ref: 00424213
VariantClear.OLEAUT32(?), ref: 0042421D
VariantClear.OLEAUT32(?), ref: 004242B1

Strings

Hour, xrefs: 00423C48
SampleNumber, xrefs: 00423FB6
NoiseLevel, xrefs: 00424015
AbbrSNR3, xrefs: 00423A21
Second, xrefs: 00423BBE
Velocity Data, xrefs: 00423EAD
Amplitude, xrefs: 004241AD
AbbrBurst, xrefs: 00423D65
Month, xrefs: 00423CD5
() () () () () () () (m/s) (m/s) (m/s) (dB) (dB) (dB), xrefs: 00423E56
AbbrVelZ, xrefs: 00423AEF
%4d , xrefs: 00424405
AbbrVelY, xrefs: 00423B34
&, xrefs: 00424611
%3u , xrefs: 00424362
Year, xrefs: 00423D1D
AbbrSNR1, xrefs: 00423AAA
Day, xrefs: 00423C8D
() () () () () () () (ft/s) (ft/s) (ft/s) (dB) (dB) (dB), xrefs: 00423E5D
SampleTime, xrefs: 004240BD
%02d , xrefs: 0042442D, 00424455, 0042447D, 004244A5, 004244CD
Minute, xrefs: 00423C03
%7.4f , xrefs: 00424575
&, xrefs: 0042466A
Velocity, xrefs: 00424122
%s %s %s %s %s %s %s %s %s %s %s %s %s , xrefs: 00423DA9
AbbrVelX, xrefs: 00423B79
%5.1f , xrefs: 004246C9
AbbrSNR2, xrefs: 00423A65

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearStringVariant$Alloc$_com_issue_errorex$FileWrite$ByteCharErrorLastMultiWide$Convert_com_util::
String ID: () () () () () () () (m/s) (m/s) (m/s) (dB) (dB) (dB)$ () () () () () () () (ft/s) (ft/s) (ft/s) (dB) (dB) (dB)$ %s %s %s %s %s %s %s %s %s %s %s %s %s $%02d $%3u $%4d $%5.1f $%7.4f $&$&$AbbrBurst$AbbrSNR1$AbbrSNR2$AbbrSNR3$AbbrVelX$AbbrVelY$AbbrVelZ$Amplitude$Day$Hour$Minute$Month$NoiseLevel$SampleNumber$SampleTime$Second$Velocity$Velocity Data$Year
API String ID: 1027955537-3742140617
Opcode ID: c0d75edd718f63e460056961596599e36b536dd2c51082f25b141e629b40956e
Instruction ID: 582b45fdce176d1278d0e2e04aa777c80a52db8de3aab8b255fd4115d4855954
Opcode Fuzzy Hash: c0d75edd718f63e460056961596599e36b536dd2c51082f25b141e629b40956e
Instruction Fuzzy Hash: 8D92BD71609350EFC324DF25C945B9BBBF8EF88704F50495EF58997281CB78A844CBAA

Function 0235A660 Relevance: 45.5, APIs: 30, Instructions: 536COMMON

Download Yara Rule

APIs

mpptid.LIBGUIDE40(024E2244), ref: 0235A674
ippsCopy_64f.IPPSW7(?,?,?), ref: 0235A6DA
mppioa.LIBGUIDE40(024E2230,?,?,?), ref: 0235A709
__kmpc_fork_call.LIBGUIDE40(024E2230,00000011,Function_0006AC32,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235A770
__kmpc_serialized_parallel.LIBGUIDE40(024E2230,?,?,?,?), ref: 0235A785
__kmpc_end_serialized_parallel.LIBGUIDE40(024E2230,?,?,024F58B0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235A7F3
ippsConvert_32f64f.IPPSW7(?,?,?,?,?,?), ref: 0235A93D
ippsFFTFwd_RToPerm_64f.IPPSW7(?,?,?,?,?,?,?), ref: 0235A950
ippsMulPerm_64f_I.IPPSW7(?,?,?,?,?,?,?,?,?,?), ref: 0235A972
ippsFFTInv_PermToR_64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235A985
ippsConvert_64f32f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235A9B1
ippsConvert_32f64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235A9D3
ippsConvert_32f64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AA44
ippsZero_64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AA5C
ippsFFTFwd_RToPerm_64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AA71
ippsMulPerm_64f_I.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AA8C
ippsFFTInv_PermToR_64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AAA1
ippsConvert_64f32f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AAC6
ippsConvert_32f64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AADE
ippsFFTFwd_RToPerm_64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AAF3
ippsMulPerm_64f_I.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AB0E
ippsFFTInv_PermToR_64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AB23
ippsConvert_64f32f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AB49
ippsConvert_32f64f.IPPSW7(?,?,?,?,?,?), ref: 0235AB77
ippsCopy_64f.IPPSW7(?,?,?,?,?,?), ref: 0235AB92
ippsZero_64f.IPPSW7(?,?,?,?,?,?,?,?), ref: 0235ABBD
ippsFFTFwd_RToPerm_64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235ABD0
ippsMulPerm_64f_I.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235ABE9
ippsFFTInv_PermToR_64f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235ABFC
ippsConvert_64f32f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235AC1E

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Convert_32f64f$Convert_64f32fFwd_Inv_PermPerm_64fPerm_64f_R_64f$Copy_64fZero_64f$__kmpc_end_serialized_parallel__kmpc_fork_call__kmpc_serialized_parallelmppioampptid
String ID:
API String ID: 3585616790-0
Opcode ID: 445aaa8368b477466fa4f909d44beea20e2fe7fecec0b4b2c70d8f657a22a08b
Instruction ID: 8f2670c034ac8ab04b2282f543132c37901ef062b8636c8523e9bbf1cac15ec6
Opcode Fuzzy Hash: 445aaa8368b477466fa4f909d44beea20e2fe7fecec0b4b2c70d8f657a22a08b
Instruction Fuzzy Hash: D702AF726043059BCB01CFA4CC8196BF7E6FFC4314F088A5DFA889B215E375E9559B92

Function 02370610 Relevance: 44.0, APIs: 29, Instructions: 543COMMON

Download Yara Rule

APIs

mpptid.LIBGUIDE40(024E4204), ref: 02370624
ippsCopy_64fc.IPPSW7(?,?,?), ref: 02370683
ippsCopy_64fc.IPPSW7(?,?,?,?,?,?), ref: 023706AC
ippsCopy_64fc.IPPSW7(?,?,?,?,?,?,?,?,?), ref: 023706C3
ippsZero_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?,?), ref: 023706F2
ippsFFTFwd_CToC_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02370705
ippsMul_64fc_I.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0237071E
ippsFFTInv_CToC_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02370731
ippsCopy_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02370755
ippsCopy_64fc.IPPSW7(?,?,?,?,?,?), ref: 0237077B
ippsFFTFwd_CToC_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?), ref: 0237078E
ippsMul_64fc_I.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 023707A7
ippsFFTInv_CToC_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 023707BA
ippsCopy_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 023707E3
ippsCopy_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02370802
mppioa.LIBGUIDE40(024E41F0,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02370855

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Copy_64fc$C_64fc$Fwd_Inv_Mul_64fc_$Zero_64fcmppioampptid
String ID:
API String ID: 3626934468-0
Opcode ID: d38cfced9f4f2c5ca84cbf18e653c97fcb8d9ec2154d7675e8219738f270aa81
Instruction ID: ce72bca1084451a1deb8dd208d888d76e46ae5ffb29a418fbbb1ae30b56bd46a
Opcode Fuzzy Hash: d38cfced9f4f2c5ca84cbf18e653c97fcb8d9ec2154d7675e8219738f270aa81
Instruction Fuzzy Hash: EB12CE72608301AFCB15CFA4CC819ABF7EAEFC4714F088A2DF98597214E735E9558B52

Function 00415860 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 254comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00479084,00000000,00000017,00477D48,?), ref: 00415888
OleRun.OLE32(?), ref: 00415899
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041597C
_com_util::ConvertStringToBSTR.COMSUPP ref: 00415994
VariantClear.OLEAUT32(?), ref: 004159DA
VariantClear.OLEAUT32(?), ref: 004159E1
VariantClear.OLEAUT32(?), ref: 004159E8
SysStringLen.OLEAUT32(00000000), ref: 00415A01
GetFileAttributesA.KERNEL32(?), ref: 00415A23
CreateDirectoryA.KERNEL32(?,00000000), ref: 00415A4B
GetLastError.KERNEL32 ref: 00415A55
InterlockedDecrement.KERNEL32(?), ref: 00415AF5
SysFreeString.OLEAUT32(00000000), ref: 00415B06

Strings

`<u, xrefs: 00415B06
UnableToCreateFolder, xrefs: 00415A9A
ApplicationSettings, xrefs: 0041590D
UserExportPath, xrefs: 00415986
C:\SonData\, xrefs: 00415972
AppSettings.htm, xrefs: 0041592E
Export, xrefs: 00415957
Error, xrefs: 00415AAB

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$ClearVariant$ConvertCreate_com_util::$AttributesDecrementDirectoryErrorFileFreeInstanceInterlockedLast
String ID: AppSettings.htm$ApplicationSettings$C:\SonData\$Error$Export$UnableToCreateFolder$UserExportPath$`<u
API String ID: 2467409537-2248621762
Opcode ID: f9daf114a497864e0c7f4bb529647f838137b4d524e7705d79d36543fce25da7
Instruction ID: c7ad04a23f769c0db8ec2f3d44a3c32f50bfcf6bc09706aaaa8b20a85f55d11d
Opcode Fuzzy Hash: f9daf114a497864e0c7f4bb529647f838137b4d524e7705d79d36543fce25da7
Instruction Fuzzy Hash: EE8191B1604701EFC710EF65C8819AFB7E9EFC8704B104A2EF54A97281D738AC45CB9A

Function 024CC2C8 Relevance: 26.7, Strings: 21, Instructions: 417COMMON

Download Yara Rule

Strings

0, xrefs: 024CC469
1, xrefs: 024CC50D
1, xrefs: 024CC540
9, xrefs: 024CC549
+, xrefs: 024CC4BD
9, xrefs: 024CC515
9, xrefs: 024CC389
C, xrefs: 024CC3A9
0, xrefs: 024CC567
9, xrefs: 024CC559
0, xrefs: 024CC536
9, xrefs: 024CC3DD
E, xrefs: 024CC3B2
9, xrefs: 024CC337
0, xrefs: 024CC3F2
c, xrefs: 024CC3B7
0, xrefs: 024CC3A4
+, xrefs: 024CC39A
-, xrefs: 024CC4C6
e, xrefs: 024CC3C0
-, xrefs: 024CC39F

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID: +$+$-$-$0$0$0$0$0$1$1$9$9$9$9$9$9$C$E$c$e
API String ID: 0-1157002505
Opcode ID: 1a264bbc073b5c9f5abbc6781a036853b71f84a5ba8b1e6cc56140c2bed249a9
Instruction ID: 39cb0105208edded5a0462d6a7c416b6b091bda2cd8fadfd2f429fec9e6baae4
Opcode Fuzzy Hash: 1a264bbc073b5c9f5abbc6781a036853b71f84a5ba8b1e6cc56140c2bed249a9
Instruction Fuzzy Hash: 5FE1F139E84219CEEBA4CF6CD9943FE7BB2BB44744F38402FD509A6291D7B48582CB54

Function 02368664 Relevance: 23.9, APIs: 9, Strings: 4, Instructions: 1174COMMON

Download Yara Rule

APIs

ippsMalloc_8u.IPPSW7(?), ref: 02368790
ippsMalloc_32u.IPPSW7 ref: 023687A3
ippsSet_32s.IPPSW7(000000FF,?,?), ref: 02368887
ippsSet_32s.IPPSW7(000000FF,?), ref: 023688A1
ippsSet_32s.IPPSW7(000000FF,?,?), ref: 023688B2
ippsZero_64f.IPPSW7(?,?), ref: 023692B8
ippsFree.IPPSW7(?,?,?), ref: 023694DB

Strings

91IF, xrefs: 02369392
51IF, xrefs: 023692CB
72IF, xrefs: 023692DA
32IF, xrefs: 023692E9

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Set_32s$FreeMalloc_32uMalloc_8uZero_64f
String ID: 32IF$51IF$72IF$91IF
API String ID: 3568243199-4277258956
Opcode ID: 8652d7dbadafaae9de531b9725b92e12d68b40e10568d7ddb7726a22466ef002
Instruction ID: fc2ed0e69a5e4aba0f350dd51895eb94550cd0649dc656a53f8f8c49a7a57fb3
Opcode Fuzzy Hash: 8652d7dbadafaae9de531b9725b92e12d68b40e10568d7ddb7726a22466ef002
Instruction Fuzzy Hash: 63B22A759087068FC724CF18C88066AF7E6FFC8314F158A2DE8999B359E770E955CB82

Function 00458D6A Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 68memorylibraryloaderCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00458E40,?,0040183E), ref: 00458D6C
LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,?,0040183E), ref: 00458D85
GetProcAddress.KERNEL32(00000000,InterlockedPushEntrySList), ref: 00458D9F
GetProcAddress.KERNEL32(00000000,InterlockedPopEntrySList), ref: 00458DAC
GetProcessHeap.KERNEL32(00000000,00000008,?,?,?,?,0040183E), ref: 00458DDE
HeapAlloc.KERNEL32(00000000,?,?,?,?,0040183E), ref: 00458DE1
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00458DF7
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,0040183E), ref: 00458E04
HeapFree.KERNEL32(00000000,?,?,?,?,0040183E), ref: 00458E07

Strings

kernel32.dll, xrefs: 00458D80
InterlockedPushEntrySList, xrefs: 00458D99
InterlockedPopEntrySList, xrefs: 00458DA1

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Heap$AddressProcProcess$AllocCompareExchangeFeatureFreeInterlockedLibraryLoadPresentProcessor
String ID: InterlockedPopEntrySList$InterlockedPushEntrySList$kernel32.dll
API String ID: 3830925854-2586642590
Opcode ID: e6d631f17ba610c332e11595024ff59495df71514ff5691d68fda72801a11f35
Instruction ID: fe6c031b5e464f928355093c839a836e8e7c0cd726662daf52788e65186e1d13
Opcode Fuzzy Hash: e6d631f17ba610c332e11595024ff59495df71514ff5691d68fda72801a11f35
Instruction Fuzzy Hash: FF1149B16002419BDB209FB5AC89A173BB8EB94746795453FE909E3351DF748848CB68

Function 004111A4 Relevance: 12.4, APIs: 8, Instructions: 449stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00411242
CharNextA.USER32(?), ref: 00411288
CharNextA.USER32(00000000), ref: 0041129F

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CharNext$lstrlen
String ID:
API String ID: 2675299387-0
Opcode ID: 92e37bb121f345ce90aa37db9efe7113c065352eddea7ad4de3127e908688315
Instruction ID: c2b63b99df4b6aed7b7f748cc0dddb082c45dc0c9cfbcef6b99b1a377aec8304
Opcode Fuzzy Hash: 92e37bb121f345ce90aa37db9efe7113c065352eddea7ad4de3127e908688315
Instruction Fuzzy Hash: E702BE71D002589BDF25DFA5CC80AEEB7B9BF48300F14416AEA05B73A1DB385D81CB69

Function 00411571 Relevance: 11.0, APIs: 7, Instructions: 467registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0041160A
_memset.LIBCMT ref: 004116A3
RegSetValueExA.ADVAPI32(?,?,00000000,00000003,?,?), ref: 00411736

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Value_memsetlstrlen
String ID:
API String ID: 3969136574-0
Opcode ID: b502ce357639816313f9296dc4b0c054d76e5aafa3d06bd5df52523abc015776
Instruction ID: 95adb0d211aa355e051cfca82bd3aa74566c8e0dc698849a43111f90b30db296
Opcode Fuzzy Hash: b502ce357639816313f9296dc4b0c054d76e5aafa3d06bd5df52523abc015776
Instruction Fuzzy Hash: 7B026171D00218DBDB14DFA5C880AEEB7B5BF48304F14816EE909B7391DB78AD85CB69

Function 00459EDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0045F608
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0045F61D
UnhandledExceptionFilter.KERNEL32( fI), ref: 0045F628
GetCurrentProcess.KERNEL32(C0000409), ref: 0045F644
TerminateProcess.KERNEL32(00000000), ref: 0045F64B

Strings

fI, xrefs: 0045F623

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: fI
API String ID: 2579439406-4222331623
Opcode ID: a0d69b7e2589e6f170c4e26754ae569b40d38f3b7f5917ea2910ce5c2550cef0
Instruction ID: 5853d718e59297ba31e1848cc2347f0a4dfbd15a1ca59344fb953d863086cbe8
Opcode Fuzzy Hash: a0d69b7e2589e6f170c4e26754ae569b40d38f3b7f5917ea2910ce5c2550cef0
Instruction Fuzzy Hash: 2A21B0B4801304DFDB00DFA9F885A443BB4FB68349F9250BBE90887369E7B559868F5D

Function 00410C80 Relevance: 9.5, APIs: 6, Instructions: 463registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?), ref: 00410EA3

Part of subcall function 00402360: RegCloseKey.ADVAPI32 ref: 0040236A

RegCloseKey.ADVAPI32(?,7EE0FD72), ref: 00410D69

Part of subcall function 00459AD6: __lock.LIBCMT ref: 00459AF4
Part of subcall function 00459AD6: ___sbh_find_block.LIBCMT ref: 00459AFF
Part of subcall function 00459AD6: ___sbh_free_block.LIBCMT ref: 00459B0E
Part of subcall function 00459AD6: HeapFree.KERNEL32(00000000,0045A609,0048DED0,0000000C,0045DDA5,00000000,0048E048,0000000C,0045DDDF,0045A609,?,?,004634E9,00000004,0048E2A8,0000000C), ref: 00459B3E
Part of subcall function 00459AD6: GetLastError.KERNEL32(?,004634E9,00000004,0048E2A8,0000000C,00463974,0045A609,?,00000000,00000000,00000000,?,0045D85E,00000001,00000214), ref: 00459B4F

RegCloseKey.ADVAPI32(?,7EE0FD72), ref: 0041180D

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Close$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 3445940573-0
Opcode ID: 5813cf96167df9bd844ad1219da4873ec43fc03de0987cc2666bd8d52114f00a
Instruction ID: ce167694ddc662d6442f7827972cd26bf4a2f2c6a605577834873dd9871ce0af
Opcode Fuzzy Hash: 5813cf96167df9bd844ad1219da4873ec43fc03de0987cc2666bd8d52114f00a
Instruction Fuzzy Hash: 3E027071D002189FDB25DF99D881AEEF7B5BF88300F14416AE905B7360DB786D81CBA9

Function 004113C3 Relevance: 9.4, APIs: 6, Instructions: 408registryCOMMON

Download Yara Rule

APIs

VarUI4FromStr.OLEAUT32(?,00000000,00000000,?), ref: 0041146E
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000004,?,00000004), ref: 00411514

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: FromValue
String ID:
API String ID: 1995724907-0
Opcode ID: fc466b588c341303e20c7cffe77288f8b9ef2fc72ec6a4d72679cecbcb4bc05a
Instruction ID: b355436c3689c995d7f5eb3f4118e23c92dc2de7bf0c28ad7b18930d066d0c37
Opcode Fuzzy Hash: fc466b588c341303e20c7cffe77288f8b9ef2fc72ec6a4d72679cecbcb4bc05a
Instruction Fuzzy Hash: A7F18171D002189FDB24DF95CC80AEEB7B5BF88304F14816AE905B73A0DB786D85CB69

Function 0236A6D0 Relevance: 5.4, APIs: 3, Instructions: 863COMMON

Download Yara Rule

APIs

ippsSet_32s.IPPSW7(000000FF,?,?), ref: 0236A847
ippsSet_32s.IPPSW7(000000FF,?), ref: 0236A861
ippsSet_32s.IPPSW7(000000FF,?,?), ref: 0236A872

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Set_32sipps
String ID:
API String ID: 117161105-0
Opcode ID: 5168fa514704f57f4ac74f3ec49d3428084f4b6bed0ad7ae0d607c80d7954d57
Instruction ID: fdb0a1161be3d21c8167f9a545a12cb3f3ed0a2e5109ecb2622e16fb75ae3a0e
Opcode Fuzzy Hash: 5168fa514704f57f4ac74f3ec49d3428084f4b6bed0ad7ae0d607c80d7954d57
Instruction Fuzzy Hash: 4F8238759087458FC724CF18C88066AF7E6BFC9318F158A2EE899A7315E770E945CF82

Function 00401250 Relevance: 4.5, APIs: 3, Instructions: 47COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(?,?,00000000,?,00401308,00000000,00000000,?,?,00000000,00000000,?,?,00000000,00000004,004122A0), ref: 0040125C
LockResource.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,00000000,00000004,004122A0,?,00000000,?,?,?,00000000), ref: 0040126B
SizeofResource.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,00000004,004122A0,?,00000000,?,?,?,00000000), ref: 00401279

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 53600a5539d68ab7fa6bfc8df95ee760bb037538218d0f33fc8a1a94cdf67d87
Instruction ID: 6e7a99d3320d93e9cfbafe9b93c1321f5f511e533a6c1634693b68eb05e32d3f
Opcode Fuzzy Hash: 53600a5539d68ab7fa6bfc8df95ee760bb037538218d0f33fc8a1a94cdf67d87
Instruction Fuzzy Hash: F7F0A93370512247CB209B79EC449ABB798EFC07A6784047FF955F3250D338D8809668

Function 023B2140 Relevance: 2.7, APIs: 1, Instructions: 1209COMMON

Download Yara Rule

APIs

ippsZero_32f.IPPSW7(?), ref: 023B24BA

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Zero_32fipps
String ID:
API String ID: 1138599663-0
Opcode ID: 79e8142096d1983c2eb7f111cdccdfdf5e564e6699f6cf39fab157e6d512b6f7
Instruction ID: 0699a3d4d81ccc4ecd79524f4c70fe3c1ef9201271f3eae8316549ac0e0fbb18
Opcode Fuzzy Hash: 79e8142096d1983c2eb7f111cdccdfdf5e564e6699f6cf39fab157e6d512b6f7
Instruction Fuzzy Hash: 639283716083158BC728DE7C885075BB7D6AFC8334F258B2DB9A9C77E0EA74D9058741

Function 00464D19 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0c0bd6db6f90ae44cd3a07c3996241b01a0032a49594c139aa7afece7697bb
Instruction ID: f1f5c11ee20ccbd668132bbbc9a4f674dab5e1196bff896d1510b1287fa5a8d8
Opcode Fuzzy Hash: 8b0c0bd6db6f90ae44cd3a07c3996241b01a0032a49594c139aa7afece7697bb
Instruction Fuzzy Hash: 0E32E331D29F414DD7239634D82233A625DAFB73C5F15D737E81AB5AA9EB28C4C34205

Function 023D02D0 Relevance: 1.9, APIs: 1, Instructions: 401COMMON

Download Yara Rule

APIs

ippsWTHaarFwd_16s.IPPSW7(?,?,?,?), ref: 023D0699

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Fwd_16sHaaripps
String ID:
API String ID: 371007771-0
Opcode ID: 29e65a6e788c22d3161be1bdb2141dd4ce6c9b1452270eef483e8a0ad89ce4fb
Instruction ID: ace8afe8ccb9fbd4d535df53d6793e13e8ac946c429ece76f1bebddd8ec16305
Opcode Fuzzy Hash: 29e65a6e788c22d3161be1bdb2141dd4ce6c9b1452270eef483e8a0ad89ce4fb
Instruction Fuzzy Hash: 99E1C777A086158BCB2CCF18E89067AB3A2EFD0B14F09856DDC898B395EB74D841C7C5

Function 024560F0 Relevance: .9, Instructions: 945COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31978b954e3ee37c0d0cabf9111818d39738726437478778b17da0be51c6ccb
Instruction ID: 392b49c8748175d7a02e26b4d5b68e0c131626e2135938b1144f05ac0960e2cc
Opcode Fuzzy Hash: c31978b954e3ee37c0d0cabf9111818d39738726437478778b17da0be51c6ccb
Instruction Fuzzy Hash: 49A2F021D10F854DD2734B78C4253B6F7E8BF6A2D9F42EB0AEDD935821EB2176878244

Function 0249A060 Relevance: .8, Instructions: 836COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff30d4a076351f874ba4f3a34c7d07d4f3f9a3dd845b6091035104364016ff79
Instruction ID: 1847f64e3422e1d7c865a96fe9582df1e784f0825071d57ff5adcd48432a3e9b
Opcode Fuzzy Hash: ff30d4a076351f874ba4f3a34c7d07d4f3f9a3dd845b6091035104364016ff79
Instruction Fuzzy Hash: 9E624525D2AB9D85E733673A5406232EE156FBF285E1EDB0FFD9935D01EB12B1C22200

Function 0243E0F0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d0646701329db12b10439c8d9d33a7eefa79b40a522c9e09e842051bc2e03d
Instruction ID: bd5d5db0ce2142e926d7d16b6fb9997f74dda69127fa4aea2f6103babfdef2d9
Opcode Fuzzy Hash: 31d0646701329db12b10439c8d9d33a7eefa79b40a522c9e09e842051bc2e03d
Instruction Fuzzy Hash: 9BF1F967D16F9482E2274B3A8A46371E311FFBF288B29E71BED8136247F710B1E19150

Function 0246A2B0 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec49776dd2f51bac3ac1194c63bc1fbfe69c900085b557f68e91a8918b6fc31e
Instruction ID: 45e7ba5fce452bdc794f46bbc738f4778f98283927caba76309c7fc84aaf8187
Opcode Fuzzy Hash: ec49776dd2f51bac3ac1194c63bc1fbfe69c900085b557f68e91a8918b6fc31e
Instruction Fuzzy Hash: F6F1BF31914B558FC7228F39C45056ABBA9BFAA3E8B46C71BFC4833911E731E5878B40

Function 023E220C Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e737cd57bd7089cd2843a9634be0671d7133acf84dd5154c3ba44b190f718b1
Instruction ID: 1053bd105e2e6ecf761311000b5b6b1f45c20f1961216f725910e8ee08b7e7b0
Opcode Fuzzy Hash: 1e737cd57bd7089cd2843a9634be0671d7133acf84dd5154c3ba44b190f718b1
Instruction Fuzzy Hash: C6D1B6BDD34FA95AE3234A3EAC022A7FB185EF7184A01E71FFDA835D51D7118642624C

Function 024BE010 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b8268ef98fa59a7c10871485aa1245fa8f90736332ea5c3246c480cf50a516
Instruction ID: bd7b9b1fb207d4206b3724ffc2f38a32b8a28ba45a100a010728c62292a2b75f
Opcode Fuzzy Hash: 19b8268ef98fa59a7c10871485aa1245fa8f90736332ea5c3246c480cf50a516
Instruction Fuzzy Hash: 18B1F351E69F018CDB2B9139C431376A21CAFB32C5F56E73BF817789A6FB1992930210

Function 024003FC Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f7c3c225d61a3337953a52b765651a29b9a2d312f5c30bf66686f69d3df5b7
Instruction ID: 7435f17224141b8e950aa64197242d7e4b08e1cb9aba0cd89acd5238dcde049d
Opcode Fuzzy Hash: c4f7c3c225d61a3337953a52b765651a29b9a2d312f5c30bf66686f69d3df5b7
Instruction Fuzzy Hash: ED91EA69C26F6949D3238B39A943362B7049EF7198E10E75BFDA436E91E324C6C26244

Function 023EA1A8 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f61dfbdc57bd2c1bf02b30c5ec81a390a90142584c5ee8ea965705560a77a5
Instruction ID: a829cf882e25c9f13e39faf372bc192bc63a2a0fc61028f81927530315b21a76
Opcode Fuzzy Hash: b2f61dfbdc57bd2c1bf02b30c5ec81a390a90142584c5ee8ea965705560a77a5
Instruction Fuzzy Hash: 7EA1FC71C0EB6587EB2B9A3A8800164EF90AF7B219F5CC747FD75759B2D322A0C49281

Function 02412238 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bfa6532d68aeea96d290a201d275379b925d71e8e277959a6652eb641309fa
Instruction ID: ae113d02d1ac61d64e3a1b8078607ea66627076dc628cc81e94ea5d7390d6881
Opcode Fuzzy Hash: f6bfa6532d68aeea96d290a201d275379b925d71e8e277959a6652eb641309fa
Instruction Fuzzy Hash: E1912B729083288BC324DF45D48142BB7F2FFC8741F0A895EEA845B325E7B4E9558B96

Function 024B86F0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd87686882f5e0df40c494af17d617a556d5c0b662117c7f40b21fa2576dc39
Instruction ID: 903672382780a7634523d7b9e56fd15607bb805f320c75832782221b86af6777
Opcode Fuzzy Hash: 3cd87686882f5e0df40c494af17d617a556d5c0b662117c7f40b21fa2576dc39
Instruction Fuzzy Hash: A181E2A6D3AB491AE3234A3D940227BFB58AEFB295F41C72FF99831C50E711D5439248

Function 02400170 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6825afd26fb2ca691ca2ac6317c6c63adb11e52f482a76d5025d44a7ed056da9
Instruction ID: 0f9cd256f3cef58f1b867060e2482d7072a5421536a7b59dd24a96abc6bb85cc
Opcode Fuzzy Hash: 6825afd26fb2ca691ca2ac6317c6c63adb11e52f482a76d5025d44a7ed056da9
Instruction Fuzzy Hash: 3651B669C1EF690AD323573AE943362BB049EF7288A00E75BFDB536D90D361C5C27244

Function 0240C1C0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff45df20387e109fb1c8d939d1d17d144c5b9f597c663ec809dadae5fd363fc3
Instruction ID: 71126c208a50494f9f8d9cfd9a5b153786682f8e99a3751fac81b1d700ffbadf
Opcode Fuzzy Hash: ff45df20387e109fb1c8d939d1d17d144c5b9f597c663ec809dadae5fd363fc3
Instruction Fuzzy Hash: EF51037DE25F4A5AD323493AE442277FB185EFB194E02D72FF89835D90D760C6826288

Function 024A42F0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79dbe95dacf007fda772d64893ee56f5bb1f1529ea823cab0c29210db9175909
Instruction ID: 55b9841b1ce6afdd405ebf6fa473a2c63290d699a4815de1fcd03395c834febc
Opcode Fuzzy Hash: 79dbe95dacf007fda772d64893ee56f5bb1f1529ea823cab0c29210db9175909
Instruction Fuzzy Hash: C541372AF3BF460BE707253D98232B696049EB71CD706D75BFD0135957FB65A0C24204

Function 02436047 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec7ae789bb2ca2711e60b2d74b213a65c384ecc3f664fd12ac16684a6d01d67
Instruction ID: ebee9fb4504843edafde2144dcd3d4f9bd634c400ed0c846cf053c62caad8a99
Opcode Fuzzy Hash: 0ec7ae789bb2ca2711e60b2d74b213a65c384ecc3f664fd12ac16684a6d01d67
Instruction Fuzzy Hash: 9B51952AC2BFC646E6235B3E9A07623D618AFFB184A22D74BFDD536D45F710C0C26148

Function 02498050 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67d4b17641e51f6c88fc24aec92c79834b68bc91b52cce89db77f95e9162a33
Instruction ID: 6cce2839b18d01ff2b83fd659fdffcb3fcf4c13ef1e4f1143b8a1e8e5f16e8c6
Opcode Fuzzy Hash: d67d4b17641e51f6c88fc24aec92c79834b68bc91b52cce89db77f95e9162a33
Instruction Fuzzy Hash: 3C4173B6D14F8282F7264F3D9C46136FB61FEEB144B269B2EDEC532E01FB2096459640

Function 0249C670 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b75bd411025ccc94c0e444a0adc0ccbf20fe8a1ee35e9d8c4a83bb9c872b664
Instruction ID: d46a648db358337911c049ee20731473db1afa9711ef624f0e2faa7a7476b3d8
Opcode Fuzzy Hash: 3b75bd411025ccc94c0e444a0adc0ccbf20fe8a1ee35e9d8c4a83bb9c872b664
Instruction Fuzzy Hash: 3F412924C56B5C49E5239A3981C21A3F6966F7F0C47ADDB0FFA563A863E79275C31200

Function 0243A3C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bde3f9167627ea01d08aafe8bab077f61be584c8f1d3f9b4ed2ab549967927
Instruction ID: f30d627790de728f338f2f2e7aec268575a9d33f8c33e96d4e40f2c571ff88f2
Opcode Fuzzy Hash: 38bde3f9167627ea01d08aafe8bab077f61be584c8f1d3f9b4ed2ab549967927
Instruction Fuzzy Hash: B93141A5C54F9285EB079B3DC802661B330FFEA254B41D78ADCD57AA63EB20D6809240

Function 0040C250 Relevance: 79.1, APIs: 25, Strings: 20, Instructions: 355COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0040C295
__wcsicoll.LIBCMT ref: 0040C2B7
__wcsicoll.LIBCMT ref: 0040C2DF
__wcsicoll.LIBCMT ref: 0040C2FF
__wcsicoll.LIBCMT ref: 0040C31F
__wcsicoll.LIBCMT ref: 0040C33F
__wcsicoll.LIBCMT ref: 0040C377
__wcsicoll.LIBCMT ref: 0040C39B
__wcsicoll.LIBCMT ref: 0040C3BB
__wcsicoll.LIBCMT ref: 0040C3DB
__wcsicoll.LIBCMT ref: 0040C3FB
__wcsicoll.LIBCMT ref: 0040C433
__wcsicoll.LIBCMT ref: 0040C453
__wcsicoll.LIBCMT ref: 0040C48B
__wcsicoll.LIBCMT ref: 0040C4AF
__wcsicoll.LIBCMT ref: 0040C4D3
__wcsicoll.LIBCMT ref: 0040C4F3
__wcsicoll.LIBCMT ref: 0040C513
__wcsicoll.LIBCMT ref: 0040C533
__wcsicoll.LIBCMT ref: 0040C56B
__wcsicoll.LIBCMT ref: 0040C58B
__wcsicoll.LIBCMT ref: 0040C5AB
__wcsicoll.LIBCMT ref: 0040C5CB
InterlockedDecrement.KERNEL32(?), ref: 0040C5FB
SysFreeString.OLEAUT32(00000000), ref: 0040C610

Strings

degF, xrefs: 0040C5C5
ft/s, xrefs: 0040C3F5
ft/s, xrefs: 0040C415
cm/s, xrefs: 0040C395
ft^3/s, xrefs: 0040C4ED
ft2, xrefs: 0040C44D
m/s, xrefs: 0040C40E
cms, xrefs: 0040C485
degC, xrefs: 0040C5A5
dm/s, xrefs: 0040C3D5
`<u, xrefs: 0040C610
m3/s, xrefs: 0040C50D
m^3/s, xrefs: 0040C4CD
m/s, xrefs: 0040C371
cfs, xrefs: 0040C4A9
ft3/s, xrefs: 0040C52D
mm/s, xrefs: 0040C3B5
m^3/s, xrefs: 0040C546
ft2, xrefs: 0040C46D
cfs, xrefs: 0040C54D

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: __wcsicoll$Interlocked$DecrementFreeIncrementString
String ID: `<u$cfs$cfs$cm/s$cms$degC$degF$dm/s$ft/s$ft/s$ft2$ft2$ft3/s$ft^3/s$m/s$m/s$m3/s$m^3/s$m^3/s$mm/s
API String ID: 315000579-3922654609
Opcode ID: bf2038410897a19de371faf41fd50121f1982865f26259a1d6b11575a0758832
Instruction ID: c5ba05e3d950ac983803862e4e61af2f02126303780c4a512092853fe42dfa61
Opcode Fuzzy Hash: bf2038410897a19de371faf41fd50121f1982865f26259a1d6b11575a0758832
Instruction Fuzzy Hash: F3B16371B84310EBEA109B768D86F3B32D89B50745B14467EBC08F72C1EB3CEC15966A

Function 00424227 Relevance: 67.0, APIs: 28, Strings: 10, Instructions: 486filememorytimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00405620: _com_issue_errorex.COMSUPP ref: 0040566C

VariantClear.OLEAUT32(?), ref: 00423F6A
SysAllocString.OLEAUT32(SampleNumber), ref: 00423FC3
VariantClear.OLEAUT32(?), ref: 0042400A
SysAllocString.OLEAUT32(NoiseLevel), ref: 0042401F
VariantClear.OLEAUT32(?), ref: 0042405F
SysAllocString.OLEAUT32(SampleTime), ref: 004240CA
VariantClear.OLEAUT32(?), ref: 00424117
SysAllocString.OLEAUT32(Velocity), ref: 0042412F

Part of subcall function 00402F50: VariantInit.OLEAUT32(?), ref: 00402F95
Part of subcall function 00402F50: VariantChangeType.OLEAUT32(?,00000000,00000000,00000005), ref: 00402FC1
Part of subcall function 00402F50: VariantClear.OLEAUT32(?), ref: 00402FDE

_com_issue_errorex.COMSUPP ref: 00423F9E

Part of subcall function 00420600: VariantInit.OLEAUT32 ref: 00420613
Part of subcall function 00420600: _com_issue_errorex.COMSUPP ref: 00420636
Part of subcall function 00420600: _memcpy_s.LIBCMT ref: 00420649

VariantClear.OLEAUT32(?), ref: 004242B1
VariantClear.OLEAUT32(?), ref: 004242E2
_com_issue_errorex.COMSUPP ref: 00424310
VariantClear.OLEAUT32 ref: 00424380
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00424394
VariantClear.OLEAUT32(?), ref: 004243DE
VariantTimeToSystemTime.OLEAUT32(?,?), ref: 004243F6
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0042441E
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00424446
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0042446E
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00424496
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004244BE
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004244E6
VariantClear.OLEAUT32(?), ref: 0042458B
VariantClear.OLEAUT32(?), ref: 004245B1
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004245C2
VariantClear.OLEAUT32(?), ref: 00424660
VariantClear.OLEAUT32(?), ref: 0042468E
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004246E2

Strings

%3u , xrefs: 00424362
Amplitude, xrefs: 004241AD
%02d , xrefs: 0042442D, 00424455, 0042447D, 004244A5, 004244CD
SampleTime, xrefs: 004240BD
%4d , xrefs: 00424405
%7.4f , xrefs: 00424575
&, xrefs: 0042466A
Velocity, xrefs: 00424122
&, xrefs: 00424611
%5.1f , xrefs: 004246C9

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$FileWrite$AllocString_com_issue_errorex$InitTime$ChangeSystemType_memcpy_s
String ID: %02d $%3u $%4d $%5.1f $%7.4f $&$&$Amplitude$SampleTime$Velocity
API String ID: 610345325-1452758860
Opcode ID: 812750ed976663f18a6289c2056a80834cb94ec98c5bd704f11f8a802ac32356
Instruction ID: ddf1c8af4160888b78aa0e3cfe6cff9f4b8bdff0d412d5bbb8e88e64acfbc6ac
Opcode Fuzzy Hash: 812750ed976663f18a6289c2056a80834cb94ec98c5bd704f11f8a802ac32356
Instruction Fuzzy Hash: 0D127D70209380AFD325DB64C948FAFBBE8EFC9704F50485DF68987291D7799844CB6A

Function 004244F6 Relevance: 67.0, APIs: 28, Strings: 10, Instructions: 486fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405620: _com_issue_errorex.COMSUPP ref: 0040566C

VariantClear.OLEAUT32(?), ref: 00423F6A
_com_issue_errorex.COMSUPP ref: 00423F9E

Part of subcall function 00420600: VariantInit.OLEAUT32 ref: 00420613
Part of subcall function 00420600: _com_issue_errorex.COMSUPP ref: 00420636
Part of subcall function 00420600: _memcpy_s.LIBCMT ref: 00420649

VariantClear.OLEAUT32(?), ref: 0042458B
VariantClear.OLEAUT32(?), ref: 004245B1
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004245C2
VariantClear.OLEAUT32(?), ref: 00424660
VariantClear.OLEAUT32(?), ref: 0042468E
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004246E2

Strings

%3u , xrefs: 00424362
Amplitude, xrefs: 004241AD
%02d , xrefs: 0042442D, 00424455, 0042447D, 004244A5, 004244CD
SampleTime, xrefs: 004240BD
%4d , xrefs: 00424405
%7.4f , xrefs: 00424575
&, xrefs: 0042466A
Velocity, xrefs: 00424122
&, xrefs: 00424611
%5.1f , xrefs: 004246C9

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$_com_issue_errorex$FileWrite$Init_memcpy_s
String ID: %02d $%3u $%4d $%5.1f $%7.4f $&$&$Amplitude$SampleTime$Velocity
API String ID: 3877294895-1452758860
Opcode ID: b8c8c1a2c8157cb0144a804d059a79237a7f1551a39fa959e5782b982b3b29fa
Instruction ID: 55826694328131b4abf24e67aad527c347adcde28bb43f1b84bd46ee21e3f32a
Opcode Fuzzy Hash: b8c8c1a2c8157cb0144a804d059a79237a7f1551a39fa959e5782b982b3b29fa
Instruction Fuzzy Hash: 9D127D70209380AFD325DB64C948FABBBE8FFC9704F50485DF68987291D7799844CBA6

Function 00420F30 Relevance: 51.1, APIs: 17, Strings: 12, Instructions: 396memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Setup), ref: 00421001
VariantClear.OLEAUT32(?), ref: 004210A6
SysAllocString.OLEAUT32(AdvProbeConfiguration), ref: 004210B7
VariantClear.OLEAUT32(?), ref: 00421140
SysAllocString.OLEAUT32(KeypadMode), ref: 00421167
VariantClear.OLEAUT32(?), ref: 004211C0
VariantClear.OLEAUT32(?), ref: 004211C7
VariantClear.OLEAUT32(?), ref: 004211CE
SysAllocString.OLEAUT32(DischargeMethod), ref: 004211F5
VariantClear.OLEAUT32(?), ref: 00421240
VariantClear.OLEAUT32(?), ref: 00421247
VariantClear.OLEAUT32(?), ref: 00421256
SysAllocString.OLEAUT32(ProbeNbeams), ref: 00421291
VariantClear.OLEAUT32(?), ref: 004212EA
VariantClear.OLEAUT32(?), ref: 004212F1
VariantClear.OLEAUT32(?), ref: 00421300
PathFindFileNameA.SHLWAPI(00000000,?,?,?,?,?,?,?), ref: 00421344

Strings

AdvProbeConfiguration, xrefs: 004210AD
degF, xrefs: 004213B0
degC, xrefs: 004213A7, 004213B5
ft/s, xrefs: 00421399
DischargeMethod, xrefs: 004211E3
KeypadMode, xrefs: 00421155
ProbeNbeams, xrefs: 0042127F
m^3/s, xrefs: 004213BE, 004213CC
ft2, xrefs: 00421382
m/s, xrefs: 00421390, 0042139E
cfs, xrefs: 004213C7
Setup, xrefs: 00420FF7

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$AllocString$FileFindNamePath
String ID: AdvProbeConfiguration$DischargeMethod$KeypadMode$ProbeNbeams$Setup$cfs$degC$degF$ft/s$ft2$m/s$m^3/s
API String ID: 3255761609-4214479265
Opcode ID: 08ea3245c0fb881e704d7cf4ac09e5c084cd9cb509de02eb54b65f73ca513883
Instruction ID: 4a8937ec2b0006bbff2d96807b170febe713243577b409536e257e4345498837
Opcode Fuzzy Hash: 08ea3245c0fb881e704d7cf4ac09e5c084cd9cb509de02eb54b65f73ca513883
Instruction Fuzzy Hash: 97E18F71208341DFC720EF65C881A5FB7E9AF98304F10896EF58997351DB38E845CBAA

Function 00411B60 Relevance: 47.7, APIs: 20, Strings: 7, Instructions: 433fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

_com_util::ConvertStringToBSTR.COMSUPP ref: 00411C41
_com_util::ConvertStringToBSTR.COMSUPP ref: 00411C61
VariantClear.OLEAUT32(?), ref: 00411C9E
VariantClear.OLEAUT32(?), ref: 00411CA5
InterlockedDecrement.KERNEL32(?), ref: 00411CC3
SysFreeString.OLEAUT32(00000000), ref: 00411CD4
_com_issue_errorex.COMSUPP ref: 00411D5F
InterlockedDecrement.KERNEL32(?), ref: 00411E01
SysFreeString.OLEAUT32(00000000), ref: 00411E12
InterlockedDecrement.KERNEL32(?), ref: 00411E41
SysFreeString.OLEAUT32(00000000), ref: 00411E52
InterlockedDecrement.KERNEL32(?), ref: 00411E89
SysFreeString.OLEAUT32(00000000), ref: 00411E96
_com_util::ConvertStringToBSTR.COMSUPP ref: 00411F54
_com_util::ConvertStringToBSTR.COMSUPP ref: 00411F74
_com_issue_errorex.COMSUPP ref: 00411FE4
VariantClear.OLEAUT32(?), ref: 00411FF4
VariantClear.OLEAUT32(?), ref: 00411FFB
FindNextFileA.KERNEL32(?,?), ref: 00412068
FindClose.KERNEL32(?), ref: 00412095

Strings

`<u, xrefs: 00411CD4, 00411E12, 00411E52, 00411E96
\, xrefs: 00411D64
Path, xrefs: 00411C4F
Language, xrefs: 00411BA4
\*.xml, xrefs: 00411D7A
., xrefs: 00411EF7
Choices, xrefs: 00411CFA

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Convert_com_util::$ClearDecrementFreeInterlockedVariant$Find_com_issue_errorex$CloseFileNext
String ID: .$Choices$Language$Path$\$\*.xml$`<u
API String ID: 3649761967-324184335
Opcode ID: d5f6e753151213b85e021d1442c529f88cac81a0bdf01086dbd73973fa29deff
Instruction ID: b32df03b5f8bd845e5a964a9d940f2d96a7e087506eed5ef562a02cebac0c696
Opcode Fuzzy Hash: d5f6e753151213b85e021d1442c529f88cac81a0bdf01086dbd73973fa29deff
Instruction Fuzzy Hash: E2F1E7716083409FC720DB68C884A9BB7E5AFD9304F144A5EF98997361EB38DC85CB5B

Function 00415350 Relevance: 44.2, APIs: 21, Strings: 4, Instructions: 473memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

SysStringByteLen.OLEAUT32(?), ref: 004154B4
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 004154BE
InterlockedIncrement.KERNEL32(?), ref: 0041558E
InterlockedIncrement.KERNEL32(?), ref: 004155A9
InterlockedIncrement.KERNEL32(?), ref: 004155C4
InterlockedIncrement.KERNEL32(?), ref: 0041560C
InterlockedIncrement.KERNEL32(7EE0FD7A), ref: 0041567D
SysStringByteLen.OLEAUT32(00000000), ref: 00415695
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 0041569F
InterlockedDecrement.KERNEL32(7EE0FD7A), ref: 004156D3
SysFreeString.OLEAUT32(00000000), ref: 004156E0
InterlockedDecrement.KERNEL32(?), ref: 00415707
SysFreeString.OLEAUT32(00000000), ref: 00415714
InterlockedDecrement.KERNEL32(?), ref: 00415765
SysFreeString.OLEAUT32(00000000), ref: 00415776
InterlockedDecrement.KERNEL32(?), ref: 004157A1
SysFreeString.OLEAUT32(00000000), ref: 004157B2
InterlockedDecrement.KERNEL32(?), ref: 004157DD
SysFreeString.OLEAUT32(00000000), ref: 004157EE
InterlockedDecrement.KERNEL32(?), ref: 00415819
SysFreeString.OLEAUT32(00000000), ref: 0041582A

Strings

Warnings, xrefs: 00415426
Unknown message: , xrefs: 00415652
Errors, xrefs: 00415432
Messages, xrefs: 004153E3

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: InterlockedString$DecrementFree$Increment$Byte$Alloc$Convert_com_util::
String ID: Errors$Messages$Unknown message: $Warnings
API String ID: 372727299-2498521435
Opcode ID: d03f1392c8491c9712dc0d1f295d34fd7accafe196238d64eaf0fc6db9c4f108
Instruction ID: 0663f5fefdffe379d7dccdebec853bfad54461e6444f7b8b7544df3e45bb8e3c
Opcode Fuzzy Hash: d03f1392c8491c9712dc0d1f295d34fd7accafe196238d64eaf0fc6db9c4f108
Instruction Fuzzy Hash: B2F19E71604B00DBC610EF69C88199BB7EAAFC8704F54492EF48997351E739EC85CB9A

Function 00457850 Relevance: 44.1, APIs: 19, Strings: 6, Instructions: 368windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001304,00000000,00000000), ref: 004578AC
SendMessageA.USER32(?,00001308,-00000001,00000000), ref: 004578C6
SendMessageA.USER32(?,00001307,00000000,00495FE0), ref: 0045791D
_com_util::ConvertStringToBSTR.COMSUPP ref: 004579FC
_com_util::ConvertStringToBSTR.COMSUPP ref: 00457A19
VariantClear.OLEAUT32(?), ref: 00457A61
VariantClear.OLEAUT32(?), ref: 00457A68
VariantClear.OLEAUT32(?), ref: 00457A74
PathFindFileNameA.SHLWAPI(00000000), ref: 00457A96
SendMessageA.USER32(?,00001306,?,00495FE0), ref: 00457B18
InterlockedDecrement.KERNEL32(?), ref: 00457B26
SysFreeString.OLEAUT32(00000000), ref: 00457B37

Strings

`<u, xrefs: 00457B37, 00457B73
P^I, xrefs: 00457ACA
FileInformation, xrefs: 004579BE
P^I, xrefs: 00457AEA
P^I, xrefs: 004578F1
FilePath, xrefs: 00457A0A

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: MessageSend$ClearStringVariant$Convert_com_util::$DecrementFileFindFreeInterlockedNamePath
String ID: FileInformation$FilePath$P^I$P^I$P^I$`<u
API String ID: 2031882841-2466082667
Opcode ID: f869e638ea69303e7d008b0f90826b8129e179f958258b2870f34133c84099ff
Instruction ID: cf0978661cd4db6b99d46e94874f41b33d71509478dc02e469b3145d516490ee
Opcode Fuzzy Hash: f869e638ea69303e7d008b0f90826b8129e179f958258b2870f34133c84099ff
Instruction Fuzzy Hash: C6D18BB12083409FD714DF64D884A6BBBE9BB88304F14892EF98987352D738EC09CB56

Function 0040CA00 Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 299memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 0040AEA0: SysStringByteLen.OLEAUT32 ref: 0040AEB8
Part of subcall function 0040AEA0: SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 0040AEC2

Part of subcall function 004099C0: InterlockedIncrement.KERNEL32(-00000008), ref: 004099FA

InterlockedDecrement.KERNEL32(?), ref: 0040CA6E
SysFreeString.OLEAUT32(00000000), ref: 0040CA83
InterlockedDecrement.KERNEL32(?), ref: 0040CABB
SysFreeString.OLEAUT32(00000000), ref: 0040CACC
SysAllocString.OLEAUT32(English), ref: 0040CB55
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040CB81
VariantClear.OLEAUT32(?), ref: 0040CBCF
VariantClear.OLEAUT32(?), ref: 0040CBD6
VariantClear.OLEAUT32(?), ref: 0040CBE3
InterlockedDecrement.KERNEL32(?), ref: 0040CC28
SysFreeString.OLEAUT32(00000000), ref: 0040CC3D
InterlockedDecrement.KERNEL32(?), ref: 0040CC7A
SysFreeString.OLEAUT32(00000000), ref: 0040CC87
ShellExecuteA.SHELL32(?,open,00000000,00000000,00477793,0000000A), ref: 0040CCDD
InterlockedDecrement.KERNEL32(?), ref: 0040CCEF
SysFreeString.OLEAUT32(00000000), ref: 0040CCFC
InterlockedDecrement.KERNEL32(?), ref: 0040CD3C
SysFreeString.OLEAUT32(00000000), ref: 0040CD4D

Strings

`<u, xrefs: 0040CA83, 0040CACC, 0040CC3D, 0040CC87, 0040CCFC, 0040CD4D
.pdf, xrefs: 0040CBE5
open, xrefs: 0040CCD7
FlowTracker Users Manual., xrefs: 0040CA28
Language, xrefs: 0040CAF2
Current, xrefs: 0040CB72
English, xrefs: 0040CB4B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Interlocked$DecrementFree$ClearVariant$AllocByteConvert_com_util::$ExecuteIncrementShell
String ID: .pdf$Current$English$FlowTracker Users Manual.$Language$`<u$open
API String ID: 3902795958-2992284623
Opcode ID: a3c0e4119e8ca6011e187e9df385066a4db62da7ac13141bfb0eb3f1218ca977
Instruction ID: fa7dbd81bf3f52b3888b8bdbc088b34d9f75cace7aff03a4036cb20f9fe2b2cd
Opcode Fuzzy Hash: a3c0e4119e8ca6011e187e9df385066a4db62da7ac13141bfb0eb3f1218ca977
Instruction Fuzzy Hash: E8A195B1608341DBD710DB65C985B5B77E8AF44704F044A7EF889A7391EB3CE904CBAA

Function 0040CF10 Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 299memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 0040AEA0: SysStringByteLen.OLEAUT32 ref: 0040AEB8
Part of subcall function 0040AEA0: SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 0040AEC2

Part of subcall function 004099C0: InterlockedIncrement.KERNEL32(-00000008), ref: 004099FA

InterlockedDecrement.KERNEL32(?), ref: 0040CF7E
SysFreeString.OLEAUT32(00000000), ref: 0040CF93
InterlockedDecrement.KERNEL32(?), ref: 0040CFCB
SysFreeString.OLEAUT32(00000000), ref: 0040CFDC
SysAllocString.OLEAUT32(English), ref: 0040D065
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040D091
VariantClear.OLEAUT32(?), ref: 0040D0DF
VariantClear.OLEAUT32(?), ref: 0040D0E6
VariantClear.OLEAUT32(?), ref: 0040D0F3
InterlockedDecrement.KERNEL32(?), ref: 0040D138
SysFreeString.OLEAUT32(00000000), ref: 0040D14D
InterlockedDecrement.KERNEL32(?), ref: 0040D18A
SysFreeString.OLEAUT32(00000000), ref: 0040D197
ShellExecuteA.SHELL32(?,open,00000000,00000000,00477793,0000000A), ref: 0040D1ED
InterlockedDecrement.KERNEL32(?), ref: 0040D1FF
SysFreeString.OLEAUT32(00000000), ref: 0040D20C
InterlockedDecrement.KERNEL32(?), ref: 0040D24C
SysFreeString.OLEAUT32(00000000), ref: 0040D25D

Strings

`<u, xrefs: 0040CF93, 0040CFDC, 0040D14D, 0040D197, 0040D20C, 0040D25D
FlowTracker Quick Start Guide., xrefs: 0040CF38
.pdf, xrefs: 0040D0F5
open, xrefs: 0040D1E7
Language, xrefs: 0040D002
Current, xrefs: 0040D082
English, xrefs: 0040D05B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Interlocked$DecrementFree$ClearVariant$AllocByteConvert_com_util::$ExecuteIncrementShell
String ID: .pdf$Current$English$FlowTracker Quick Start Guide.$Language$`<u$open
API String ID: 3902795958-2223123669
Opcode ID: 9bc93a9ccd91ff2e1dae1955905a40a014859b1c16f39985a287a5be9d205370
Instruction ID: 865ab2867caf0589ff67808220e988bdc1053a9851f194187df410fff771d1d8
Opcode Fuzzy Hash: 9bc93a9ccd91ff2e1dae1955905a40a014859b1c16f39985a287a5be9d205370
Instruction Fuzzy Hash: 5BA194B1A04341DBD710DF65CC45B5BB7E8AF54704F04496EF889A7391EB38E908C7AA

Function 0042F350 Relevance: 40.7, APIs: 15, Strings: 8, Instructions: 443memoryfileCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(SystemInformation), ref: 0042F3F9
VariantClear.OLEAUT32(?), ref: 0042F49A
_com_util::ConvertStringToBSTR.COMSUPP ref: 0042F4C1

Part of subcall function 00401D90: VariantInit.OLEAUT32 ref: 00401DA4
Part of subcall function 00401D90: _com_issue_errorex.COMSUPP ref: 00401E00
Part of subcall function 00401D90: _memcpy_s.LIBCMT ref: 00401E13

VariantClear.OLEAUT32(?), ref: 0042F510
VariantClear.OLEAUT32(?), ref: 0042F517
VariantClear.OLEAUT32(?), ref: 0042F526

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

_com_util::ConvertStringToBSTR.COMSUPP ref: 0042F589
VariantClear.OLEAUT32(?), ref: 0042F5D6
VariantClear.OLEAUT32(?), ref: 0042F5DD
VariantClear.OLEAUT32(?), ref: 0042F5EC
_com_util::ConvertStringToBSTR.COMSUPP ref: 0042F6E2
VariantClear.OLEAUT32(?), ref: 0042F72F
VariantClear.OLEAUT32(?), ref: 0042F736
VariantClear.OLEAUT32(?), ref: 0042F745
WriteFile.KERNEL32(00000015,?,?,?,00000000,?,?,?,00000000,00000000), ref: 0042F87D

Strings

Processing, xrefs: 0042F52F
%s, xrefs: 0042F630
CustomCorrection, xrefs: 0042F6D0
MountingType, xrefs: 0042F60B
WRodCorrection, xrefs: 0042F577
OriginalMountingType, xrefs: 0042F7A0
MountingCorrection, xrefs: 0042F4AF
SystemInformation, xrefs: 0042F3EF

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$String$Convert_com_util::$AllocFileInitWrite_com_issue_errorex_memcpy_s
String ID: %s$CustomCorrection$MountingCorrection$MountingType$OriginalMountingType$Processing$SystemInformation$WRodCorrection
API String ID: 309858669-2799903489
Opcode ID: 2114479b3cddc9d971c3ec4ec7aab22e820c38d5f941a313f58b94f357133780
Instruction ID: 2f69192b440733317089168ddf6d24e9f01dd517eb0c4d9fe4cb838a11aae735
Opcode Fuzzy Hash: 2114479b3cddc9d971c3ec4ec7aab22e820c38d5f941a313f58b94f357133780
Instruction Fuzzy Hash: 0402A2712083449FD310DB69C881B5BB7E8BFD9304F548A6EF58987391DB78E809CB66

Function 0042A835 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 438fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405620: _com_issue_errorex.COMSUPP ref: 0040566C

VariantClear.OLEAUT32(?), ref: 00429645

Part of subcall function 00420600: VariantInit.OLEAUT32 ref: 00420613
Part of subcall function 00420600: _com_issue_errorex.COMSUPP ref: 00420636
Part of subcall function 00420600: _memcpy_s.LIBCMT ref: 00420649

VariantClear.OLEAUT32(?), ref: 0042A8C4
VariantClear.OLEAUT32(?), ref: 0042A8F1
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042A91C
VariantClear.OLEAUT32(?), ref: 0042A9E4
VariantClear.OLEAUT32(?), ref: 0042AA09
VariantClear.OLEAUT32(?), ref: 0042AA83

Strings

%6.4f , xrefs: 0042A900
, xrefs: 0042AE17
>, xrefs: 0042ACCA
W, xrefs: 0042AB55
%4.1f , xrefs: 0042AAE0, 0042ABE0
%5.2f , xrefs: 0042ACB4
%6.2f , xrefs: 0042AC4A

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$_com_issue_errorex$FileInitWrite_memcpy_s
String ID: $%4.1f $%5.2f $%6.2f $%6.4f $>$W
API String ID: 2926263878-254900485
Opcode ID: 55b7407106a9e179d2257b8c30beb98d46245ad5e0b9b65eb9c727068e2daf7c
Instruction ID: b5a485bcafb7cb2fdcd4bd043e851bcd708d08d6b2c249c69f6f71f04b7bda2d
Opcode Fuzzy Hash: 55b7407106a9e179d2257b8c30beb98d46245ad5e0b9b65eb9c727068e2daf7c
Instruction Fuzzy Hash: B502AD742083809FD325EB68C994B9FB7E8AFC8304F44895DF58987392CB789904CB67

Function 004129E0 Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 330windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

_com_util::ConvertStringToBSTR.COMSUPP ref: 00412A94
_com_util::ConvertStringToBSTR.COMSUPP ref: 00412AB1
VariantClear.OLEAUT32(?), ref: 00412AEB
VariantClear.OLEAUT32(?), ref: 00412AF7
InterlockedDecrement.KERNEL32(?), ref: 00412B52
SysFreeString.OLEAUT32(00000000), ref: 00412B67
InterlockedDecrement.KERNEL32(?), ref: 00412B96
SysFreeString.OLEAUT32(00000000), ref: 00412BAB
InterlockedDecrement.KERNEL32(?), ref: 00412BDF
SysFreeString.OLEAUT32(00000000), ref: 00412BF0
MessageBoxA.USER32(?,00000000,Error,00000010), ref: 00412C90
InterlockedIncrement.KERNEL32(?), ref: 00412CBD
InterlockedDecrement.KERNEL32(?), ref: 00412D08
SysFreeString.OLEAUT32(00000000), ref: 00412D1D
InterlockedDecrement.KERNEL32(?), ref: 00412D61
SysFreeString.OLEAUT32(00000000), ref: 00412D76

Strings

`<u, xrefs: 00412B67, 00412BAB, 00412BF0, 00412D1D, 00412D76
Start, xrefs: 00412CE0
Language, xrefs: 00412A11
Error opening language file: , xrefs: 00412C51
Current, xrefs: 00412AA2
.xml, xrefs: 00412AF9
Error, xrefs: 00412C89

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Interlocked$DecrementFree$Convert_com_util::$ClearVariant$IncrementMessage
String ID: .xml$Current$Error$Error opening language file: $Language$Start$`<u
API String ID: 261578835-1902624511
Opcode ID: 32686321a8aacd59c83c32061e13930ff533b44fcb2ddcd4d16aba7b3cc649d8
Instruction ID: d9415ea8b9b83c82e227a67b3bf1c6e23f8860bf5c607ca2316e31b60af7a05f
Opcode Fuzzy Hash: 32686321a8aacd59c83c32061e13930ff533b44fcb2ddcd4d16aba7b3cc649d8
Instruction Fuzzy Hash: 1FC1C5B15083849FC610EFA4D94499FBBE5AF84304F14496EF489D3351E7B8EC98CB9A

Function 00419697 Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 310COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0041956A
VariantClear.OLEAUT32(?), ref: 00419574
_com_issue_errorex.COMSUPP ref: 00419600

Part of subcall function 00401B20: VariantInit.OLEAUT32 ref: 00401B34
Part of subcall function 00401B20: _com_issue_errorex.COMSUPP ref: 00401B71
Part of subcall function 00401B20: _memcpy_s.LIBCMT ref: 00401B84

VariantClear.OLEAUT32(?), ref: 004196E2
VariantClear.OLEAUT32(?), ref: 004196E9
PathFindExtensionA.SHLWAPI(00000000), ref: 00419710
InterlockedIncrement.KERNEL32(?), ref: 00419747
PathIsDirectoryA.SHLWAPI(00000000), ref: 00419779
InterlockedDecrement.KERNEL32(?), ref: 00419917
SysFreeString.OLEAUT32(00000000), ref: 00419928

Strings

`<u, xrefs: 00419928, 00419A50
- , xrefs: 004199C1
ErrorFound, xrefs: 004199D6
.WAD, xrefs: 00419724
Complete, xrefs: 00419A0C

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear_com_issue_errorex$InterlockedPath$DecrementDirectoryExtensionFindFreeIncrementInitString_memcpy_s
String ID: - $.WAD$Complete$ErrorFound$`<u
API String ID: 2738603681-3201372374
Opcode ID: 47048afe331b5223cb2de01ff70e72392470ade6aa8032eb1d09abc3396fd1ee
Instruction ID: 9e6b3d7580d9e595969de56e1f390099d53bad5d4c2075d7fce5e27442e93397
Opcode Fuzzy Hash: 47048afe331b5223cb2de01ff70e72392470ade6aa8032eb1d09abc3396fd1ee
Instruction Fuzzy Hash: AEA192B29043419BCB10EF65DC9189FB3E9BF84304B48492EF59593341E739ED88CB9A

Function 0041AE88 Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 299COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0041AECA
InterlockedDecrement.KERNEL32(?), ref: 0041AEED
SysFreeString.OLEAUT32(00000000), ref: 0041AEFE
InterlockedDecrement.KERNEL32(?), ref: 0041AFB7
SysFreeString.OLEAUT32(00000000), ref: 0041AFC8
InterlockedDecrement.KERNEL32(?), ref: 0041AFF7
SysFreeString.OLEAUT32(00000000), ref: 0041B008
InterlockedDecrement.KERNEL32(?), ref: 0041B037
SysFreeString.OLEAUT32(00000000), ref: 0041B048
InterlockedDecrement.KERNEL32(?), ref: 0041B077
SysFreeString.OLEAUT32(00000000), ref: 0041B084
InterlockedIncrement.KERNEL32(?), ref: 0041B0BC
InterlockedDecrement.KERNEL32(?), ref: 0041B0EC
SysFreeString.OLEAUT32(00000000), ref: 0041B109
InterlockedDecrement.KERNEL32(?), ref: 0041B1AD
SysFreeString.OLEAUT32(00000000), ref: 0041B1BE
InterlockedDecrement.KERNEL32(?), ref: 0041B213
SysFreeString.OLEAUT32(00000000), ref: 0041B224

Strings

`<u, xrefs: 0041AEFE, 0041AFC8, 0041B008, 0041B048, 0041B084, 0041B109, 0041B1BE, 0041B224
- , xrefs: 0041AF39
ErrorFound, xrefs: 0041AF4E
Complete, xrefs: 0041AF7D

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeString$Increment
String ID: - $Complete$ErrorFound$`<u
API String ID: 1306932728-1732393029
Opcode ID: 0a9d4ddb6449f02fcd3f7e7f7b2ead3c493ab28dba7478f1928d27b8e2b18b13
Instruction ID: 1b859d585431ef42411deffd6b8c163d12d302fea4da38d2125a0dcb65cec441
Opcode Fuzzy Hash: 0a9d4ddb6449f02fcd3f7e7f7b2ead3c493ab28dba7478f1928d27b8e2b18b13
Instruction Fuzzy Hash: 22A1B4B2A043019BC620EF65CC8599FB7E9AF44744F44092EF959D3341E739ED84CA9A

Function 004568F0 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 296commemoryCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 00456954
GetWindowLongA.USER32(?,000000EC), ref: 00456967
SetWindowLongA.USER32(?,000000EC,00000000), ref: 00456972
GetWindowLongA.USER32(?,000000EB), ref: 00456983
OleUninitialize.OLE32 ref: 00456995
OleInitialize.OLE32(00000000), ref: 004569A2
GetWindowTextLengthA.USER32(?), ref: 004569AC
GetWindowTextA.USER32(?,00000000,00000001), ref: 004569FF
SetWindowTextA.USER32(?,00477793), ref: 00456A0B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00456A29
GlobalLock.KERNEL32(00000000), ref: 00456A45
GlobalUnlock.KERNEL32(00000000), ref: 00456A60
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 00456A6D
SysFreeString.OLEAUT32(00000000), ref: 00456A98
DefWindowProcA.USER32(?,?,?,00000000), ref: 00456C14

Strings

`<u, xrefs: 00456A98, 00456B5B, 00456B97, 00456BE3

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Window$GlobalLong$Text$AllocCreateFreeInitializeLengthLockProcStreamStringUninitializeUnlock
String ID: `<u
API String ID: 2199760997-3367579956
Opcode ID: 2d50ef6a7881acf59c2cb84d6c22576b328e92557dc22997a4ea06812fb26edf
Instruction ID: 2ba22a318e10258cbb83100ee656aacd554cf82938eae18e8196bb51ac98bbab
Opcode Fuzzy Hash: 2d50ef6a7881acf59c2cb84d6c22576b328e92557dc22997a4ea06812fb26edf
Instruction Fuzzy Hash: 67A1BF71900205AFDB01DBA4CC84EAF7BB8EF49305F51416AFD05E7292DB38AD45CBA9

Function 00443E10 Relevance: 37.1, APIs: 16, Strings: 5, Instructions: 363memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Setup), ref: 00443EC0
VariantClear.OLEAUT32(?), ref: 00443F45
SysAllocString.OLEAUT32(KeypadMode), ref: 00443F64
VariantClear.OLEAUT32(?), ref: 00443FB2
VariantClear.OLEAUT32(?), ref: 00443FB9
VariantClear.OLEAUT32(?), ref: 00443FC0
SysAllocString.OLEAUT32(DischargeMethod), ref: 00443FE3
VariantClear.OLEAUT32(?), ref: 0044401F
VariantClear.OLEAUT32(?), ref: 00444026
VariantClear.OLEAUT32(?), ref: 0044402D
SysAllocString.OLEAUT32(Station Summary), ref: 00444044
VariantClear.OLEAUT32(?), ref: 004440C9
_com_issue_errorex.COMSUPP ref: 004440F7
SysAllocString.OLEAUT32(WaterDepth2), ref: 0044410B
VariantClear.OLEAUT32(?), ref: 0044418C
_com_issue_errorex.COMSUPP ref: 004441BF

Strings

DischargeMethod, xrefs: 00443FCC
KeypadMode, xrefs: 00443F51
Station Summary, xrefs: 00444036
Setup, xrefs: 00443EB6
WaterDepth2, xrefs: 00444101

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$AllocString$_com_issue_errorex
String ID: DischargeMethod$KeypadMode$Setup$Station Summary$WaterDepth2
API String ID: 1846812451-1355972454
Opcode ID: 094044b72192f7eb9265b8b3128301de73f7c4ecb62f0da87566bf24ccc5f876
Instruction ID: 411d821ead92bed857fda2ef9fe55123d3f81ee786b0321d2ef7c4fc2fefb844
Opcode Fuzzy Hash: 094044b72192f7eb9265b8b3128301de73f7c4ecb62f0da87566bf24ccc5f876
Instruction Fuzzy Hash: F5C1A0B1604301EFD700EF65C885A5FB7E8AFD8308F10495EFA4597251DB38D949CB9A

Function 0040D420 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 335comCOMMON

Download Yara Rule

APIs

_com_util::ConvertStringToBSTR.COMSUPP ref: 0040D465
_com_issue_errorex.COMSUPP ref: 0040D4B9
VariantClear.OLEAUT32(?), ref: 0040D4C7
InterlockedDecrement.KERNEL32(?), ref: 0040D519
SysFreeString.OLEAUT32(00000000), ref: 0040D52E
InterlockedDecrement.KERNEL32(?), ref: 0040D55D
SysFreeString.OLEAUT32(00000000), ref: 0040D572
CoCreateInstance.OLE32(00478FF8,00000000,00000017,00477D48,?), ref: 0040D5B1
OleRun.OLE32(?), ref: 0040D5C0
InterlockedIncrement.KERNEL32(?), ref: 0040D637
InterlockedIncrement.KERNEL32(?), ref: 0040D672
_com_issue_errorex.COMSUPP ref: 0040D6CB
InterlockedDecrement.KERNEL32(?), ref: 0040D6F7
SysFreeString.OLEAUT32(00000000), ref: 0040D708
InterlockedDecrement.KERNEL32(?), ref: 0040D737
SysFreeString.OLEAUT32(00000000), ref: 0040D748
InterlockedDecrement.KERNEL32(?), ref: 0040D777
SysFreeString.OLEAUT32(00000000), ref: 0040D788

Strings

Application, xrefs: 0040D457
`<u, xrefs: 0040D52E, 0040D572, 0040D708, 0040D748, 0040D788
file:///, xrefs: 0040D4E2

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$String$DecrementFree$Increment_com_issue_errorex$ClearConvertCreateInstanceVariant_com_util::
String ID: Application$`<u$file:///
API String ID: 2639491173-1729505616
Opcode ID: e1ef2ca58f8c861afe2513ab9df00d00c9a7cd15c5abfcb424fc90afa252f867
Instruction ID: 511d24c5e6008309ef75401434285aa5e01ee61327c43d65b68733bd239ee928
Opcode Fuzzy Hash: e1ef2ca58f8c861afe2513ab9df00d00c9a7cd15c5abfcb424fc90afa252f867
Instruction Fuzzy Hash: 9DB1A0B19047409FC211DB68CC8091BB7E9AFD8704F144A6EF999E3391E739EC48CB5A

Function 00457510 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 263COMMON

Download Yara Rule

APIs

LockWindowUpdate.USER32(?,7EE0FD72,00000000,?,?,74DEE860), ref: 00457543
InterlockedIncrement.KERNEL32(?), ref: 00457562

Part of subcall function 00401C00: VariantInit.OLEAUT32 ref: 00401C14
Part of subcall function 00401C00: _com_issue_errorex.COMSUPP ref: 00401C70
Part of subcall function 00401C00: _memcpy_s.LIBCMT ref: 00401C83

_com_util::ConvertStringToBSTR.COMSUPP ref: 00457607
VariantClear.OLEAUT32(74DEE860), ref: 00457654
VariantClear.OLEAUT32(?), ref: 0045765B
VariantClear.OLEAUT32(?), ref: 00457667
_com_util::ConvertStringToBSTR.COMSUPP ref: 004576AD
VariantClear.OLEAUT32(74DEE860), ref: 004576F3
VariantClear.OLEAUT32(?), ref: 004576FA
VariantClear.OLEAUT32(?), ref: 00457706
_com_util::ConvertStringToBSTR.COMSUPP ref: 0045773F
_com_issue_errorex.COMSUPP ref: 00457791
VariantClear.OLEAUT32 ref: 004577A0
LockWindowUpdate.USER32(00000000), ref: 004577C2
InterlockedDecrement.KERNEL32(?), ref: 004577FE
SysFreeString.OLEAUT32(00000000), ref: 00457813

Strings

`<u, xrefs: 00457813
Processing, xrefs: 00457590
Application, xrefs: 00457735
CustomCorrection, xrefs: 0045769E
WRodCorrection, xrefs: 004575F8

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$String$Convert_com_util::$InterlockedLockUpdateWindow_com_issue_errorex$DecrementFreeIncrementInit_memcpy_s
String ID: Application$CustomCorrection$Processing$WRodCorrection$`<u
API String ID: 3709617173-1610277050
Opcode ID: 8521a43282104aa551b30271311b9ea1078b79c2f79568f691ed30cc99223e60
Instruction ID: 1b26a4b992ae22afaa7168f712cb134785c7733aa20afdafbbaaa595663462bb
Opcode Fuzzy Hash: 8521a43282104aa551b30271311b9ea1078b79c2f79568f691ed30cc99223e60
Instruction Fuzzy Hash: E6A18F715083409FD710DB69D844B5BBBE8AF88705F00496EF98997352D778E809CBA6

Function 0040D8B0 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 265memoryCOMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040D916
VariantClear.OLEAUT32(?), ref: 0040D971
SysAllocString.OLEAUT32(00479034), ref: 0040D982
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040D9AB
VariantClear.OLEAUT32(?), ref: 0040D9F8
VariantClear.OLEAUT32(?), ref: 0040D9FF
VariantClear.OLEAUT32(?), ref: 0040DA0E
InterlockedIncrement.KERNEL32(?), ref: 0040DA2D
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040DA9C
_com_issue_errorex.COMSUPP ref: 0040DAFC

Part of subcall function 00459380: GetErrorInfo.OLEAUT32(00000000,00000000,?,00405831,00000000,?,00477D28), ref: 004593D0

VariantClear.OLEAUT32(?), ref: 0040DB06
VariantClear.OLEAUT32(?), ref: 0040DB0D
InterlockedDecrement.KERNEL32(?), ref: 0040DB1D
SysFreeString.OLEAUT32(00000000), ref: 0040DB32
InterlockedDecrement.KERNEL32(?), ref: 0040DB61
SysFreeString.OLEAUT32(00000000), ref: 0040DB73

Strings

`<u, xrefs: 0040DB32, 0040DB73
DisplayUnit, xrefs: 0040D999, 0040DA8A

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$String$Interlocked$ConvertDecrementFree_com_issue_errorex_com_util::$AllocErrorIncrementInfo
String ID: DisplayUnit$`<u
API String ID: 2299441389-2762317869
Opcode ID: efb8fc30a84e4c5d8d9bbb1ebec8ab9c5cfeb55e57aa4455313715f12a3c27dd
Instruction ID: 38fb31c9d91b212a60216b1f84231d42153420913aefd6c5795708805c81846f
Opcode Fuzzy Hash: efb8fc30a84e4c5d8d9bbb1ebec8ab9c5cfeb55e57aa4455313715f12a3c27dd
Instruction Fuzzy Hash: E0918F71508340DFD720DF65C840B5BB7E8AF99704F14896EF98897391EB38E809CB66

Function 0041B6B0 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 169COMMON

Download Yara Rule

APIs

_com_util::ConvertStringToBSTR.COMSUPP ref: 0041B755
VariantClear.OLEAUT32(?), ref: 0041B796
VariantClear.OLEAUT32(?), ref: 0041B79D
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041B7AE
VariantClear.OLEAUT32(?), ref: 0041B7D7
VariantClear.OLEAUT32(?), ref: 0041B7DE
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041B7EF
VariantClear.OLEAUT32(?), ref: 0041B818
VariantClear.OLEAUT32(?), ref: 0041B81F
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041B830
VariantClear.OLEAUT32(?), ref: 0041B859
VariantClear.OLEAUT32(?), ref: 0041B860
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041B871
VariantClear.OLEAUT32(?), ref: 0041B89A
VariantClear.OLEAUT32(?), ref: 0041B8A1

Strings

PeakStart, xrefs: 0041B7E5
RecordsPerSample, xrefs: 0041B7A4
PeakEnd, xrefs: 0041B826
NumberOfBeams, xrefs: 0041B74B
AdvSamplingVolumeWidth, xrefs: 0041B867

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$ConvertString_com_util::
String ID: AdvSamplingVolumeWidth$NumberOfBeams$PeakEnd$PeakStart$RecordsPerSample
API String ID: 1565985208-4037595560
Opcode ID: 77e5849eac0b44b03dc1e0cfd852877cfc1f1f337148296cdea614c87502f0b1
Instruction ID: f2889e981c0136dbd0f0fbc1811630266a0224c502d16698b42bca0470a377db
Opcode Fuzzy Hash: 77e5849eac0b44b03dc1e0cfd852877cfc1f1f337148296cdea614c87502f0b1
Instruction Fuzzy Hash: 7B516DB1504301ABCB05EF75C8859AF77E9FFC8304F04491EB98597281EB38E949CB9A

Function 0042A959 Relevance: 33.6, APIs: 13, Strings: 6, Instructions: 368fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405620: _com_issue_errorex.COMSUPP ref: 0040566C

VariantClear.OLEAUT32(?), ref: 00429645

Part of subcall function 00420600: VariantInit.OLEAUT32 ref: 00420613
Part of subcall function 00420600: _com_issue_errorex.COMSUPP ref: 00420636
Part of subcall function 00420600: _memcpy_s.LIBCMT ref: 00420649

VariantClear.OLEAUT32(?), ref: 0042A9E4
VariantClear.OLEAUT32(?), ref: 0042AA09
VariantClear.OLEAUT32(?), ref: 0042AA83
VariantClear.OLEAUT32(?), ref: 0042AAB0
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0042AAFC

Strings

, xrefs: 0042AE17
>, xrefs: 0042ACCA
W, xrefs: 0042AB55
%4.1f , xrefs: 0042AAE0, 0042ABE0
%5.2f , xrefs: 0042ACB4
%6.2f , xrefs: 0042AC4A

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$_com_issue_errorex$FileInitWrite_memcpy_s
String ID: $%4.1f $%5.2f $%6.2f $>$W
API String ID: 2926263878-1716742959
Opcode ID: c20406c06b965355330c397658dcf47802c844f78b9461cf6af4c55b266802fd
Instruction ID: 0e4c8ee41f1838188cabe3e6b58dcccee6eaa5a7081b648330458fafee94c11a
Opcode Fuzzy Hash: c20406c06b965355330c397658dcf47802c844f78b9461cf6af4c55b266802fd
Instruction Fuzzy Hash: BDE1AE342083809FD325EB68C894B9BB7E9BFC9304F04894DF58987392CB789944CB67

Function 0040E780 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 278COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0040E799
SysFreeString.OLEAUT32(00000000), ref: 0040E7AA
InterlockedDecrement.KERNEL32(?), ref: 0040E7D7
SysFreeString.OLEAUT32(00000000), ref: 0040E7E8
InterlockedDecrement.KERNEL32(?), ref: 0040E815
SysFreeString.OLEAUT32(00000000), ref: 0040E826
InterlockedDecrement.KERNEL32(?), ref: 0040E853
SysFreeString.OLEAUT32(00000000), ref: 0040E864
InterlockedDecrement.KERNEL32(?), ref: 0040E891
SysFreeString.OLEAUT32(00000000), ref: 0040E8A2
InterlockedDecrement.KERNEL32(?), ref: 0040E8CF
SysFreeString.OLEAUT32(00000000), ref: 0040E8E0
InterlockedDecrement.KERNEL32(?), ref: 0040E94B
SysFreeString.OLEAUT32(00000000), ref: 0040E95C
InterlockedDecrement.KERNEL32(?), ref: 0040E989
SysFreeString.OLEAUT32(00000000), ref: 0040E99A
InterlockedDecrement.KERNEL32(?), ref: 0040E9C7
SysFreeString.OLEAUT32(00000000), ref: 0040E9D8

Strings

`<u, xrefs: 0040E7AA, 0040E7E8, 0040E826, 0040E864, 0040E8A2, 0040E8E0, 0040E95C, 0040E99A, 0040E9D8

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString
String ID: `<u
API String ID: 3298718523-3367579956
Opcode ID: 25e5f65dc325b0580a3476a3310ba6b57bbe2f6738407d1de06324dda7fecf91
Instruction ID: 88e4f462748d78bbdbb963fc8eef5b27a95c59ebdcf1b92a3b6782796695ef1e
Opcode Fuzzy Hash: 25e5f65dc325b0580a3476a3310ba6b57bbe2f6738407d1de06324dda7fecf91
Instruction Fuzzy Hash: 6C91A2B39006429BDB20EFA7D8C485BB3E9BE043043484E3EE955E3751E739FC648699

Function 0236208F Relevance: 33.4, APIs: 22, Instructions: 364COMMON

Download Yara Rule

APIs

__kmpc_master.LIBGUIDE40(024E33C4,?), ref: 023620FB
omp_get_num_threads.LIBGUIDE40 ref: 02362108
mptxms.LIBGUIDE40(024E33C4,?), ref: 0236216C
__kmpc_barrier.LIBGUIDE40(024E33B0,?), ref: 0236217A
omp_get_thread_num.LIBGUIDE40 ref: 02362182
ippsConvert_32s64f.IPPSW7(?,?,?), ref: 023622BB
ippsZero_64fc.IPPSW7(?,?), ref: 023622DC
ippsFFTFwd_CToC_64fc.IPPSW7(?,?,?,?,?,?), ref: 023622F7
ippsMul_64fc_I.IPPSW7(?,?,?,?,?,?,?,?,?), ref: 0236232A
ippsFFTInv_CToC_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02362345
ippsConvert_64f32s_Sfs.IPPSW7(?,?,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02362387
ippsConvert_32s64f.IPPSW7(?,?,?), ref: 0236239E
ippsFFTFwd_CToC_64fc.IPPSW7(?,?,?,?), ref: 023623B2
ippsMul_64fc_I.IPPSW7(?,?,?,?,?,?,?), ref: 023623E5
ippsFFTInv_CToC_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?,?), ref: 02362400
ippsConvert_64f32s_Sfs.IPPSW7(?,?,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02362443
ippsConvert_32s64f.IPPSW7(?,?,?), ref: 02362474
ippsFFTFwd_CToC_64fc.IPPSW7(?,?,?,?), ref: 0236248E
ippsMul_64fc_I.IPPSW7(?,?,?,?,?,?,?), ref: 023624BF
ippsFFTInv_CToC_64fc.IPPSW7(?,?,?,?,?,?,?,?,?,?,?), ref: 023624D9
ippsConvert_64f32s_Sfs.IPPSW7(?,?,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02362518
ippsConvert_32s64f.IPPSW7(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02362551

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$C_64fc$Convert_32s64f$Convert_64f32s_Fwd_Inv_Mul_64fc_$Zero_64fc__kmpc_barrier__kmpc_mastermptxmsomp_get_num_threadsomp_get_thread_num
String ID:
API String ID: 3455197378-0
Opcode ID: 346e153e4e0d89e6f697faa4f3ac3dd39caddc6998ee0a64049eadda211f3f16
Instruction ID: 7b19824832ef762239b0b9d6bee67af2f11aad9fe0e53c457cd293c64b7a8f19
Opcode Fuzzy Hash: 346e153e4e0d89e6f697faa4f3ac3dd39caddc6998ee0a64049eadda211f3f16
Instruction Fuzzy Hash: 70F11575204345DFCB64DF58C880BAAB7A6FFC9300F2485ADDA498B319D731A951CF92

Function 02376689 Relevance: 33.3, APIs: 22, Instructions: 344COMMON

Download Yara Rule

APIs

__kmpc_master.LIBGUIDE40(024E4CA0,?), ref: 023766F5
omp_get_num_threads.LIBGUIDE40 ref: 02376702
mptxms.LIBGUIDE40(024E4CA0,?), ref: 02376766
__kmpc_barrier.LIBGUIDE40(024E4C8C,?), ref: 02376774
omp_get_thread_num.LIBGUIDE40 ref: 0237677C
ippsConvert_16s32f.IPPSW7(?,?,?), ref: 023768A2
ippsZero_32f.IPPSW7(?,?,?,?,?), ref: 023768BF
ippsFFTFwd_RToPerm_32f.IPPSW7(?,?,?,?,?,?,?,?,?), ref: 023768DA
ippsMulPerm_32f_I.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0237690D
ippsFFTInv_PermToR_32f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02376928
ippsConvert_32f16s_Sfs.IPPSW7(?,?,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02376968
ippsConvert_16s32f.IPPSW7(?,?,?), ref: 0237697C
ippsFFTFwd_RToPerm_32f.IPPSW7(?,?,?,?,?,?,?), ref: 02376997
ippsMulPerm_32f_I.IPPSW7(?,?,?,?,?,?,?,?,?,?), ref: 023769CA
ippsFFTInv_PermToR_32f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 023769E5
ippsConvert_32f16s_Sfs.IPPSW7(?,?,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02376A25
ippsConvert_16s32f.IPPSW7(?,?,?), ref: 02376A4C
ippsFFTFwd_RToPerm_32f.IPPSW7(?,?,?,?,?,?,?), ref: 02376A66
ippsMulPerm_32f_I.IPPSW7(?,?,?,?,?,?,?,?,?,?), ref: 02376A97
ippsFFTInv_PermToR_32f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02376AB1
ippsConvert_32f16s_Sfs.IPPSW7(?,?,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02376AF0
ippsConvert_16s32f.IPPSW7(?,00000000,?,?,?,?,00000001,?,?,?,?,?,?,?,?,?), ref: 02376B1E

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Convert_16s32f$Convert_32f16s_Fwd_Inv_PermPerm_32fPerm_32f_R_32f$Zero_32f__kmpc_barrier__kmpc_mastermptxmsomp_get_num_threadsomp_get_thread_num
String ID:
API String ID: 2597116984-0
Opcode ID: 4e3d1b57d2f4b6e431c2fdf4c5484bbd4da45c81777e893efa3c14f3a220c12f
Instruction ID: d3ef6ef8b95853b220c6b9e7dae67eece10f4f8ae97a0558050b8942f6585d4f
Opcode Fuzzy Hash: 4e3d1b57d2f4b6e431c2fdf4c5484bbd4da45c81777e893efa3c14f3a220c12f
Instruction Fuzzy Hash: 3AE10475204348DFCB64DF58C880BAAB7A6FFC9300F24869DDA494B359E731A951CF92

Function 0040B0C0 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040B119
SysAllocString.OLEAUT32(Decimals), ref: 0040B15D
_com_issue_errorex.COMSUPP ref: 0040B1D2
VariantClear.OLEAUT32(?), ref: 0040B1E2
VariantClear.OLEAUT32(?), ref: 0040B1E9
VariantClear.OLEAUT32(?), ref: 0040B1F5
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040B206
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040B223

Part of subcall function 00401C00: VariantInit.OLEAUT32 ref: 00401C14
Part of subcall function 00401C00: _com_issue_errorex.COMSUPP ref: 00401C70
Part of subcall function 00401C00: _memcpy_s.LIBCMT ref: 00401C83

VariantClear.OLEAUT32(?), ref: 0040B26B
VariantClear.OLEAUT32(?), ref: 0040B272
VariantClear.OLEAUT32(?), ref: 0040B279
SysStringLen.OLEAUT32(00000000), ref: 0040B28A
InterlockedIncrement.KERNEL32(?), ref: 0040B2A1

Part of subcall function 0040A800: _com_issue_errorex.COMSUPP ref: 0040A850
Part of subcall function 0040A800: InterlockedDecrement.KERNEL32(?), ref: 0040A861
Part of subcall function 0040A800: SysFreeString.OLEAUT32(00000000), ref: 0040A876

InterlockedDecrement.KERNEL32(?), ref: 0040B2BC
SysFreeString.OLEAUT32(00000000), ref: 0040B2CD

Strings

`<u, xrefs: 0040B2CD
DisplayUnit, xrefs: 0040B214
Decimals, xrefs: 0040B14F

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$ClearString$_com_issue_errorex$Interlocked$ConvertDecrementFree_com_util::$AllocIncrementInit_memcpy_s
String ID: Decimals$DisplayUnit$`<u
API String ID: 561277809-462021781
Opcode ID: 7ae079301082973684f4d82dde3e8789bb3b9751ae0317da6b1df1a39e95d34e
Instruction ID: fc0d016a71b6126939b84a2fc067c475840673069f45c6a0d22b2c20234a826f
Opcode Fuzzy Hash: 7ae079301082973684f4d82dde3e8789bb3b9751ae0317da6b1df1a39e95d34e
Instruction Fuzzy Hash: E07192711083419BD710DBA5C844B5FBBE8EFD8744F00496EF985E7291EB78D908CBAA

Function 0040DC10 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 277COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0040DC68
SysFreeString.OLEAUT32(00000000), ref: 0040DC7D
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040DD93
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040DDB0
VariantClear.OLEAUT32(?), ref: 0040DDF8
VariantClear.OLEAUT32(?), ref: 0040DDFF
VariantClear.OLEAUT32(?), ref: 0040DE06

Strings

`<u, xrefs: 0040DC7D, 0040DE4F, 0040DED2, 0040DF33
FileInformation, xrefs: 0040DD53
FilePath, xrefs: 0040DDA1

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearStringVariant$Convert_com_util::$DecrementFreeInterlocked
String ID: FileInformation$FilePath$`<u
API String ID: 1998176527-4215550760
Opcode ID: a1495cd4fa522e53fbc1e51e14cd46010ebd671a0f21d170d676bc64735bb827
Instruction ID: 3de05abef5961d3c5fd8f18d6b7442c0b6e3a496fdac99e14bab650d0d81ce3f
Opcode Fuzzy Hash: a1495cd4fa522e53fbc1e51e14cd46010ebd671a0f21d170d676bc64735bb827
Instruction Fuzzy Hash: 3AA1D4729087819BC710EFA4C88491BB7E9AF94304F14493EF585E7391D738EC49CB9A

Function 00456C40 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 109registrywindowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004960A0,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?), ref: 00456C4C
RegisterWindowMessageA.USER32(WM_ATLGETHOST,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?,?,00000000), ref: 00456C5D
RegisterWindowMessageA.USER32(WM_ATLGETCONTROL,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?,?,00000000), ref: 00456C69
GetClassInfoExA.USER32(00400000,AtlAxWin90,?), ref: 00456C90
LoadCursorA.USER32 ref: 00456CCE
RegisterClassExA.USER32 ref: 00456CF1

Part of subcall function 00451620: __recalloc.LIBCMT ref: 00451666

_memset.LIBCMT ref: 00456D1D
GetClassInfoExA.USER32(00400000,AtlAxWinLic90,?), ref: 00456D3A
LoadCursorA.USER32 ref: 00456D72
RegisterClassExA.USER32 ref: 00456D95
LeaveCriticalSection.KERNEL32(004960A0,?,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?,?), ref: 00456DC4

Strings

WM_ATLGETCONTROL, xrefs: 00456C5F
AtlAxWin90, xrefs: 00456C81, 00456CE5
AtlAxWinLic90, xrefs: 00456D30, 00456D89
WM_ATLGETHOST, xrefs: 00456C58

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClassRegister$CriticalCursorInfoLoadMessageSectionWindow$EnterLeave__recalloc_memset
String ID: AtlAxWin90$AtlAxWinLic90$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 2252124385-2573294316
Opcode ID: e1fb6ec3a855024311b27fa1f9082977b6a552a96dcb242be541294caf57df30
Instruction ID: 289d4165b70e56f406b6dcf064ed2b87efb7a42adacb560cc34a8bfb2a26e8c8
Opcode Fuzzy Hash: e1fb6ec3a855024311b27fa1f9082977b6a552a96dcb242be541294caf57df30
Instruction Fuzzy Hash: E94147B1509310AFC300DF15D984A5BBBE8FB88B44F914A2FF98993251D7799908CF9E

Function 004565E0 Relevance: 25.8, APIs: 17, Instructions: 278commemorystringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 00456644
GetWindowLongA.USER32(?,000000EC), ref: 00456657
SetWindowLongA.USER32(?,000000EC,00000000), ref: 00456662
GetWindowLongA.USER32(?,000000EB), ref: 00456673
OleUninitialize.OLE32 ref: 00456685
OleInitialize.OLE32(00000000), ref: 00456692
GetWindowTextLengthA.USER32(?), ref: 0045669C
GetWindowTextA.USER32(?,00000000,00000001), ref: 004566F2
SetWindowTextA.USER32(?,00477793), ref: 004566FE
GlobalAlloc.KERNEL32(00000042,00000000), ref: 0045671C
GlobalLock.KERNEL32(00000000), ref: 00456736
GlobalUnlock.KERNEL32(00000000), ref: 00456751
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0045675E
lstrlenA.KERNEL32(00000000), ref: 00456771
DefWindowProcA.USER32(?,?,?,?), ref: 004568C0

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Window$GlobalLong$Text$AllocCreateInitializeLengthLockProcStreamUninitializeUnlocklstrlen
String ID:
API String ID: 2367841626-0
Opcode ID: 3f93c57c4e40fe532d822374c72517051f75d7a1ba7c2f398abf0022fc05c2c7
Instruction ID: 229a5d3ede9295726ad44f92ceba6b75c1c6b133cf7de261845a1f8a51df9865
Opcode Fuzzy Hash: 3f93c57c4e40fe532d822374c72517051f75d7a1ba7c2f398abf0022fc05c2c7
Instruction Fuzzy Hash: A3A1AF71900204AFDB00EFA5CC44FAF7BB8AF49305F55416AFD05A7292DB38AD45CBA9

Function 022FA09C Relevance: 25.6, APIs: 17, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

ippsFFTInitAlloc_R_32f.IPPSW7(?,00000000,00000002,00000000,?,?,?,?,?), ref: 022FA0D4
ippsFFTGetBufSize_R_32f.IPPSW7(00000000,00000000,?,00000000,00000002,00000000,?,?,?,?,?), ref: 022FA0EE
ippsMalloc_8u.IPPSW7(00000000,00000000,00000000,?,00000000,00000002,00000000,?,?,?,?,?), ref: 022FA101
ippsMalloc_32u.IPPSW7(00000000,00000000,00000000,?,00000000,00000002,00000000,?,?,?,?,?), ref: 022FA10E
ippsCopy_32f.IPPSW7(?,00000000,?,00000000,00000000,?,00000000,00000002,00000000,?,?,?,?,?), ref: 022FA132
ippsZero_32f.IPPSW7(?,00000001,?,00000000,?,00000000,00000000,?,00000000,00000002,00000000,?,?,?,?,?), ref: 022FA14E
ippsFFTFwd_RToPack_32f.IPPSW7(00000000,00000000,00000000,00000002,?,00000001,?,00000000,?,00000000,00000000,?,00000000,00000002,00000000,?), ref: 022FA15E
ippsZero_32f.IPPSW7(?,?,00000000,00000000,00000000,00000002,?,00000001,?,00000000,?,00000000,00000000,?,00000000,00000002), ref: 022FA17A
ippsCopy_32f.IPPSW7(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000002,?,00000001,?,00000000,?,00000000,00000000), ref: 022FA199
ippsZero_32f.IPPSW7(00000000,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000002,?,00000001,?,00000000,?), ref: 022FA1AD
ippsFFTFwd_RToPack_32f.IPPSW7(00000000,00000000,00000000,00000002,00000000,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000002), ref: 022FA1C1
ippsMulPackConj_32f_I.IPPSW7(00000000,00000000,00000001,00000000,00000000,00000000,00000002,00000000,?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 022FA1D3
ippsFFTInv_PackToR_32f.IPPSW7(00000000,00000000,00000000,00000002,00000000,00000000,00000001,00000000,00000000,00000000,00000002,00000000,?,00000000,00000000,00000000), ref: 022FA1E7
ippsCopy_32f.IPPSW7(00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000001,00000000,00000000,00000000,00000002,00000000,?), ref: 022FA208
ippsFFTFree_R_32f.IPPSW7(?,00000000,00000000,?,00000000,00000002,00000000,?,?,?,?,?), ref: 022FA217
ippsFree.IPPSW7(00000000,?,00000000,00000000,?,00000000,00000002,00000000,?,?,?,?,?), ref: 022FA21D
ippsFree.IPPSW7(00000002,?,00000000,00000000,?,00000000,00000002,00000000,?,?,?,?,?), ref: 022FA227

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$R_32f$Copy_32fZero_32f$FreeFwd_PackPack_32f$Alloc_Conj_32f_Free_InitInv_Malloc_32uMalloc_8uSize_
String ID:
API String ID: 423768038-0
Opcode ID: 34495bb2ae94cf21e2733de5474d8360a67f22d19d20c2b8f5bf181d1a530a7f
Instruction ID: c3e76c912bd62735ed5645f310b9a303a022ee63efe0c28dea04d810d2033a68
Opcode Fuzzy Hash: 34495bb2ae94cf21e2733de5474d8360a67f22d19d20c2b8f5bf181d1a530a7f
Instruction Fuzzy Hash: 86414076218305AFD654EEA4CC80D6FF7AAEFC4704F448A2CB64907218DA75E845DF92

Function 0041BB50 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0041BC6F
SysFreeString.OLEAUT32(00000000), ref: 0041BC80
InterlockedIncrement.KERNEL32(?), ref: 0041BCDE
InterlockedDecrement.KERNEL32(?), ref: 0041BD25
SysFreeString.OLEAUT32(00000000), ref: 0041BD3A
InterlockedIncrement.KERNEL32(-00000008), ref: 0041BD6F
InterlockedDecrement.KERNEL32(?), ref: 0041BD81
SysFreeString.OLEAUT32(00000000), ref: 0041BD96
InterlockedDecrement.KERNEL32(?), ref: 0041BDBD
SysFreeString.OLEAUT32(00000000), ref: 0041BDCE

Strings

`<u, xrefs: 0041BC80, 0041BD3A, 0041BD96, 0041BDCE
,%.1f, xrefs: 0041BC29
%.1f,%.1f, xrefs: 0041BBF6
LowSnr, xrefs: 0041BCEB

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeString$Increment
String ID: %.1f,%.1f$,%.1f$LowSnr$`<u
API String ID: 1306932728-2106796307
Opcode ID: a85eecfd3b77ad98662a6529ebfc85554c0a782de3392aff628b9ca7e6fef68c
Instruction ID: eb14f5123ca9b0d4bf85a56742d3dec87199748f3965431bb91a26788af54730
Opcode Fuzzy Hash: a85eecfd3b77ad98662a6529ebfc85554c0a782de3392aff628b9ca7e6fef68c
Instruction Fuzzy Hash: 2F81E7716043019BD724DF65D985B9BB7E8EF44704F04496EF88997341EB38E844CBDA

Function 0044DF00 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 229COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0044E01F
SysFreeString.OLEAUT32(00000000), ref: 0044E030
InterlockedIncrement.KERNEL32(?), ref: 0044E08E
InterlockedDecrement.KERNEL32(?), ref: 0044E0D5
SysFreeString.OLEAUT32(00000000), ref: 0044E0EA
InterlockedIncrement.KERNEL32(-00000008), ref: 0044E11F
InterlockedDecrement.KERNEL32(?), ref: 0044E131
SysFreeString.OLEAUT32(00000000), ref: 0044E146
InterlockedDecrement.KERNEL32(?), ref: 0044E16D
SysFreeString.OLEAUT32(00000000), ref: 0044E17E

Strings

`<u, xrefs: 0044E030, 0044E0EA, 0044E146, 0044E17E
,%.1f, xrefs: 0044DFD9
%.1f,%.1f, xrefs: 0044DFA6
LowSnr, xrefs: 0044E09B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeString$Increment
String ID: %.1f,%.1f$,%.1f$LowSnr$`<u
API String ID: 1306932728-2106796307
Opcode ID: ec3b98bc3bbf7ea31476100050ae6f1f6368b5dd1fd88012cd2d7e52fa22dd94
Instruction ID: 59fe604cda60370b9495a63837c46441067aff68eac5727d3c456fe08e178321
Opcode Fuzzy Hash: ec3b98bc3bbf7ea31476100050ae6f1f6368b5dd1fd88012cd2d7e52fa22dd94
Instruction Fuzzy Hash: 3B81C9716043419BE720DF66D989B5BB7E8BF44704F04496EF88997341EB38E904CB5A

Function 0044E3F0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0044E50A
InterlockedIncrement.KERNEL32(?), ref: 0044E525
InterlockedDecrement.KERNEL32(?), ref: 0044E569
SysFreeString.OLEAUT32(00000000), ref: 0044E57E
InterlockedIncrement.KERNEL32(-00000008), ref: 0044E5B1
InterlockedDecrement.KERNEL32(?), ref: 0044E5C9
SysFreeString.OLEAUT32(00000000), ref: 0044E5DA
InterlockedDecrement.KERNEL32(?), ref: 0044E601
SysFreeString.OLEAUT32(00000000), ref: 0044E60E
InterlockedDecrement.KERNEL32(?), ref: 0044E639
SysFreeString.OLEAUT32(00000000), ref: 0044E646

Strings

`<u, xrefs: 0044E57E, 0044E5DA, 0044E60E, 0044E646
%.1f, xrefs: 0044E493, 0044E4C8
SnrDifferentFromMean, xrefs: 0044E532

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeString$Increment
String ID: %.1f$SnrDifferentFromMean$`<u
API String ID: 1306932728-705349834
Opcode ID: 1d66caa3b1e933c473bcd8bf9ed091894f157ad87f0dd7aad19b15237c6df50b
Instruction ID: 6cf0f011e8403cc7f39c16903c8712d36a25139b3974611616e55ff7a38a8ef1
Opcode Fuzzy Hash: 1d66caa3b1e933c473bcd8bf9ed091894f157ad87f0dd7aad19b15237c6df50b
Instruction Fuzzy Hash: AC71C8B1A043419BD720EF66DD45A5BB7E8BF94708F44092EF849D3341E738E944C7AA

Function 00457CA0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00415EE0: InterlockedDecrement.KERNEL32(00000008), ref: 00415F41
Part of subcall function 00415EE0: SysFreeString.OLEAUT32(00000000), ref: 00415F52

InterlockedDecrement.KERNEL32(?), ref: 00457D0D
SysFreeString.OLEAUT32(00000000), ref: 00457D1E
InterlockedDecrement.KERNEL32(?), ref: 00457D84
SysFreeString.OLEAUT32(00000000), ref: 00457D95
InterlockedDecrement.KERNEL32(?), ref: 00457DC9
SysFreeString.OLEAUT32(00000000), ref: 00457DD6
InterlockedIncrement.KERNEL32(?), ref: 00457E0E
InterlockedDecrement.KERNEL32(?), ref: 00457E3F
SysFreeString.OLEAUT32(00000000), ref: 00457E50
InterlockedDecrement.KERNEL32(?), ref: 00457E7F
SysFreeString.OLEAUT32(00000000), ref: 00457E90

Strings

`<u, xrefs: 00457D1E, 00457D95, 00457DD6, 00457E50, 00457E90
file:///, xrefs: 00457CE1
.htm, xrefs: 00457D41

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeString$Increment
String ID: .htm$`<u$file:///
API String ID: 1306932728-2705759419
Opcode ID: 25a7608e41f788521648ea3dbb4d2cbce9536b7ece59c47ac3dd9b42ed6eea66
Instruction ID: 472bed3405ce6a5b68d6e23835a5e299100b631dbe992578a7a2c84d8157eb27
Opcode Fuzzy Hash: 25a7608e41f788521648ea3dbb4d2cbce9536b7ece59c47ac3dd9b42ed6eea66
Instruction Fuzzy Hash: 2B61D6B15087409BC711DF28DC8596FB7E99F94705F180A6EF889D3302E739ED4C8A9A

Function 00457ED0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 0040ADF0: InterlockedDecrement.KERNEL32(?), ref: 0040AE51
Part of subcall function 0040ADF0: SysFreeString.OLEAUT32(00000000), ref: 0040AE62

InterlockedDecrement.KERNEL32(?), ref: 00457F3D
SysFreeString.OLEAUT32(00000000), ref: 00457F4E
InterlockedDecrement.KERNEL32(?), ref: 00457FB4
SysFreeString.OLEAUT32(00000000), ref: 00457FC5
InterlockedDecrement.KERNEL32(?), ref: 00457FF9
SysFreeString.OLEAUT32(00000000), ref: 00458006
InterlockedIncrement.KERNEL32(?), ref: 0045803E
InterlockedDecrement.KERNEL32(?), ref: 0045806F
SysFreeString.OLEAUT32(00000000), ref: 00458080
InterlockedDecrement.KERNEL32(?), ref: 004580AF
SysFreeString.OLEAUT32(00000000), ref: 004580C0

Strings

`<u, xrefs: 00457F4E, 00457FC5, 00458006, 00458080, 004580C0
file:///, xrefs: 00457F11
.htm, xrefs: 00457F71

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeString$Increment
String ID: .htm$`<u$file:///
API String ID: 1306932728-2705759419
Opcode ID: 9582b0afd10526871a90aa4b507b4e50908dae2ae129ea3cbd409b879871eb3f
Instruction ID: 612b044f3ef3aee00238714ed8e67411536cdaa104460b2d22299f334047ea56
Opcode Fuzzy Hash: 9582b0afd10526871a90aa4b507b4e50908dae2ae129ea3cbd409b879871eb3f
Instruction Fuzzy Hash: 2D61D7B15047009BC621DF28DC8495FB7D99F94B05F180A2EF899E3343EB39ED4C869A

Function 00401890 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 136registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004960A0), ref: 004018A9
GetClassInfoExA.USER32 ref: 004018EF
GetClassInfoExA.USER32(00000000,?,?), ref: 00401900
LeaveCriticalSection.KERNEL32(004960A0), ref: 0040190B
LoadCursorA.USER32(?,?), ref: 00401950
wsprintfA.USER32 ref: 00401973
GetClassInfoExA.USER32(?,00000000,?), ref: 00401999
LoadImageA.USER32(00400000,00000000,00000001,00000020,00000020,00000000), ref: 004019CA
LoadImageA.USER32(00400000,00000000,00000001,00000010,00000010,00000000), ref: 004019E6
RegisterClassExA.USER32 ref: 004019EC
LeaveCriticalSection.KERNEL32(004960A0), ref: 004019FB

Strings

ATL:%p, xrefs: 0040196D
0, xrefs: 004018E7
0`I, xrefs: 004018BA, 004019B2, 004019D9

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Class$CriticalInfoLoadSection$ImageLeave$CursorEnterRegisterwsprintf
String ID: 0$0`I$ATL:%p
API String ID: 1910430708-693525809
Opcode ID: 8e47ca2b3d97b165823df54b76760af90cb844fbaac39489892bcd5f92bd5be5
Instruction ID: 80af9c6854661441597cc09144c14ed53dabb4760a83309408a0b88c8ec64c9e
Opcode Fuzzy Hash: 8e47ca2b3d97b165823df54b76760af90cb844fbaac39489892bcd5f92bd5be5
Instruction Fuzzy Hash: 23518CB5600301DBDB14CF54C8C4B677BA8FB88750F5045AAFD04AB29AD7B4E885CBA8

Function 0237A1F0 Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 415memoryCOMMON

Download Yara Rule

APIs

omp_get_max_threads.LIBGUIDE40 ref: 0237A233
ippsFFTInitAlloc_R_32f.IPPSW7(00000001,00000000,00000002,00000000), ref: 0237A27C
ippsFFTGetBufSize_R_32f.IPPSW7(?,?), ref: 0237A2D5
ippsFFTFree_R_32f.IPPSW7(?,?,?), ref: 0237A2E7
ippsMalloc_8u.IPPSW7(?,?,?), ref: 0237A342
ippsCopy_32f.IPPSW7(?,?,?), ref: 0237A5B5
ippsZero_32f.IPPSW7(?,?,?,?,?), ref: 0237A5CD
ippsFFTFwd_RToPerm_32f.IPPSW7(?,?,?,?,?,?,?,?,?), ref: 0237A5DF
ippsFFTFree_R_32f.IPPSW7(?,?,?,?,?,?,?,?,?,?), ref: 0237A5EF
ippsFree.IPPSW7(?,?,?,?,?,?,?,?,?,?,?), ref: 0237A5F9
ippsZero_32f.IPPSW7(?,?), ref: 0237A6DA
ippsFFTFree_R_32f.IPPSW7(00000000,?,?), ref: 0237A6EE

Strings

10IF, xrefs: 0237A499

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$R_32f$Free_$Zero_32f$Alloc_Copy_32fFreeFwd_InitMalloc_8uPerm_32fSize_omp_get_max_threads
String ID: 10IF
API String ID: 3387134288-4089230753
Opcode ID: e549a402172f2dbeaae8b7af7930a3be8337b5cd9056f0b3393f27e4cce44856
Instruction ID: db8ceb4a9e50864eb7b285bb7a2e3383629e48430d36bf0b1c9d2afcd1dbcab1
Opcode Fuzzy Hash: e549a402172f2dbeaae8b7af7930a3be8337b5cd9056f0b3393f27e4cce44856
Instruction Fuzzy Hash: 90026A756043068FCB24CF18C880A5AB7F2FF98314F298A6DE9949B365E735E945CF81

Function 00453970 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 004539BA
GetStockObject.GDI32(0000000D), ref: 004539C2

Strings

, xrefs: 004539EF

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ObjectStock
String ID:
API String ID: 3428563643-3916222277
Opcode ID: 1236bbad0d2788f9fdc2ef51e71157239d2326bad7a9d6cb17ec07c253f03661
Instruction ID: 38162af33fda586c22d23e19fcfad072601c7396ddfbaf6f5a8be8aa62e6728d
Opcode Fuzzy Hash: 1236bbad0d2788f9fdc2ef51e71157239d2326bad7a9d6cb17ec07c253f03661
Instruction Fuzzy Hash: C05183B1D002189FCB11DFA5CC45ADEB7B8EF49342F14406AED05EB252E7789E46CB98

Function 0041B8F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0041B940
InterlockedDecrement.KERNEL32(?), ref: 0041BA17
SysFreeString.OLEAUT32(00000000), ref: 0041BA28
InterlockedDecrement.KERNEL32(?), ref: 0041BA53
SysFreeString.OLEAUT32(00000000), ref: 0041BA64
InterlockedDecrement.KERNEL32(?), ref: 0041BA8F
SysFreeString.OLEAUT32(00000000), ref: 0041BAA0
InterlockedDecrement.KERNEL32(?), ref: 0041BACB
SysFreeString.OLEAUT32(00000000), ref: 0041BADC
InterlockedDecrement.KERNEL32(?), ref: 0041BB07
SysFreeString.OLEAUT32(00000000), ref: 0041BB18

Strings

`<u, xrefs: 0041BA09

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeString$Increment
String ID: `<u
API String ID: 1306932728-3367579956
Opcode ID: 506e6493aea4d345f0cfcd56a2dcb932083115e054f7be5c18005af883804e0e
Instruction ID: 8027109dc0e78d7189e3980a7260bc080fc6442e8be8dc148ed5543153e507a7
Opcode Fuzzy Hash: 506e6493aea4d345f0cfcd56a2dcb932083115e054f7be5c18005af883804e0e
Instruction Fuzzy Hash: 6371D1B66043449BC220DF69DC80D9BB3E8EF44744B44492EF895D3351E738ED898ADA

Function 0041DE00 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 183comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 0041DE21
OleRun.OLE32(?), ref: 0041DE32
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041DEB2
VariantClear.OLEAUT32(?), ref: 0041DEF5
VariantClear.OLEAUT32(00000017), ref: 0041DEFC
VariantClear.OLEAUT32(?), ref: 0041DF03
_com_util::ConvertStringToBSTR.COMSUPP ref: 0041DF28
VariantClear.OLEAUT32(?), ref: 0041DF65
VariantClear.OLEAUT32(?), ref: 0041DF6C
VariantClear.OLEAUT32(00000017), ref: 0041DF73

Strings

SnrVariation, xrefs: 0041DF19
LowerSnrThreshold, xrefs: 0041DEA3

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$ConvertString_com_util::$CreateInstance
String ID: LowerSnrThreshold$SnrVariation
API String ID: 290583697-2137459409
Opcode ID: 635de448f6c098eaca7c57ce92d4541e5ffc7c9a1b21d011cd32dc7294c5a804
Instruction ID: 3af92a1055e3e576ad16fc7723e4c08bea81e180e8ba158f1ee0a86f92d8dc85
Opcode Fuzzy Hash: 635de448f6c098eaca7c57ce92d4541e5ffc7c9a1b21d011cd32dc7294c5a804
Instruction Fuzzy Hash: 4A518375A047129FC314DF65C880AABB7A4FFD8704F00891EF9459B251DB38E945CB9A

Function 0045D74C Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048DFF8,0000000C,0045D887,00000000,00000000,?,0045A609,0045DC04,00459ACB,?,?,0045A609,?), ref: 0045D75E
__crt_waiting_on_module_handle.LIBCMT ref: 0045D769

Part of subcall function 0045E8EB: Sleep.KERNEL32(000003E8,?,?,0045D6AF,KERNEL32.DLL,?,0045EE26,?,00459AC5,0045A609,?,?,0045A609,?), ref: 0045E8F7
Part of subcall function 0045E8EB: GetModuleHandleW.KERNEL32(0045A609,?,?,0045D6AF,KERNEL32.DLL,?,0045EE26,?,00459AC5,0045A609,?,?,0045A609,?), ref: 0045E900

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0045D792
GetProcAddress.KERNEL32(0045A609,DecodePointer), ref: 0045D7A2
__lock.LIBCMT ref: 0045D7C4
InterlockedIncrement.KERNEL32(00495184), ref: 0045D7D1
__lock.LIBCMT ref: 0045D7E5
___addlocaleref.LIBCMT ref: 0045D803

Strings

DecodePointer, xrefs: 0045D79A
MI, xrefs: 0045D7F8
EncodePointer, xrefs: 0045D786
KERNEL32.DLL, xrefs: 0045D758, 0045D75D, 0045D768

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: MI$DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-3521789168
Opcode ID: 8f4d4aa569dd61b0d57f9b5aafda099ab9522c61028c7948a87b1bd97bd5edfa
Instruction ID: c6415ef15484896699c0728a57b443ccffa244a1be83f95c60e973d11b793030
Opcode Fuzzy Hash: 8f4d4aa569dd61b0d57f9b5aafda099ab9522c61028c7948a87b1bd97bd5edfa
Instruction Fuzzy Hash: 761181719047019ED720AF76D841B5ABBE0AF04315F20856FE869962A2CB78A549CB5C

Function 0044A600 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 421memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Station Summary), ref: 0044A646
VariantClear.OLEAUT32(?), ref: 0044A6E7
_com_issue_errorex.COMSUPP ref: 0044A71B
SysAllocString.OLEAUT32(Method), ref: 0044A744
VariantClear.OLEAUT32(?), ref: 0044A782
VariantClear.OLEAUT32(?), ref: 0044A7C3

Strings

Station Summary, xrefs: 0044A63C
CorrectionFactor, xrefs: 0044A84D, 0044A8E9, 0044AA66, 0044AAA8, 0044AB0B
Method, xrefs: 0044A73A

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$AllocString$_com_issue_errorex
String ID: CorrectionFactor$Method$Station Summary
API String ID: 1846812451-2626409503
Opcode ID: e25c1233b4d0c387bfecf23a55c8027997f765773f892286bc2aad614659b99c
Instruction ID: 19174b3900bba6fbc6b4ab42998642324528e8afa495dc549ec4f1b396fd4a84
Opcode Fuzzy Hash: e25c1233b4d0c387bfecf23a55c8027997f765773f892286bc2aad614659b99c
Instruction Fuzzy Hash: 1BF1A1712083409BE324DF69C485B5FBBE5BFC8718F14895EF58993281CB789819CB6B

Function 0040B5C0 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 388memoryCOMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040B678
VariantClear.OLEAUT32(?), ref: 0040B6C2
_com_issue_errorex.COMSUPP ref: 0040B77D
_com_issue_errorex.COMSUPP ref: 0040B820
VariantClear.OLEAUT32(?), ref: 0040B86D
SysStringByteLen.OLEAUT32(?), ref: 0040B8B3
SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 0040B8BB
VariantClear.OLEAUT32(?), ref: 0040B8FA
InterlockedDecrement.KERNEL32(?), ref: 0040B955
SysFreeString.OLEAUT32(00000000), ref: 0040B966

Strings

`<u, xrefs: 0040B52B, 0040B966

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearStringVariant_com_issue_errorex$Byte$AllocDecrementFreeInterlocked
String ID: `<u
API String ID: 2173859566-3367579956
Opcode ID: 6e32de7c6a9e68edfd12a3bd0c967179e12be25b91ea46f0bf392c9a685dfb9d
Instruction ID: c88709b4c87725a3375b7ee13ee3a4154b8ebcbede1917eeef88294b848d6bcf
Opcode Fuzzy Hash: 6e32de7c6a9e68edfd12a3bd0c967179e12be25b91ea46f0bf392c9a685dfb9d
Instruction Fuzzy Hash: C2D16C752087409FD310DF69C880B5BBBE8EF88704F14496DF99897391DB39E805CBAA

Function 00449850 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Station Summary), ref: 00449897
VariantClear.OLEAUT32(?), ref: 00449940
_com_issue_errorex.COMSUPP ref: 00449970
SysAllocString.OLEAUT32(Location1), ref: 00449999
VariantClear.OLEAUT32(?), ref: 00449A5C
SysAllocString.OLEAUT32(Method), ref: 00449A6D
VariantClear.OLEAUT32(?), ref: 00449AAB
VariantClear.OLEAUT32(?), ref: 00449AF2

Strings

Station Summary, xrefs: 0044988D
Location1, xrefs: 0044998F
Method, xrefs: 00449A63

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$AllocString$_com_issue_errorex
String ID: Location1$Method$Station Summary
API String ID: 1846812451-781598421
Opcode ID: e98f3c3396d6d750d149555e0a3d3bf2a06ae33c85a9d81c0b04d018db0d2d11
Instruction ID: 5275e3fc1cccff2621470c663702b9a1e6945e80a6860ecc77c1e2c17a1203be
Opcode Fuzzy Hash: e98f3c3396d6d750d149555e0a3d3bf2a06ae33c85a9d81c0b04d018db0d2d11
Instruction Fuzzy Hash: C9C1B1712087809FD721EB69C880B5FB7E8EFC9704F10495EF58997292DB799804C7AB

Function 00444550 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 274memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Station Summary), ref: 0044458D
VariantClear.OLEAUT32(?), ref: 0044462C
_com_issue_errorex.COMSUPP ref: 00444661
SysAllocString.OLEAUT32(WaterDepth), ref: 0044468B
VariantClear.OLEAUT32(?), ref: 00444735
SysAllocString.OLEAUT32(WaterDepth2), ref: 00444746
VariantClear.OLEAUT32(?), ref: 004447F0

Strings

WaterDepth, xrefs: 00444681
4UD, xrefs: 004447BC, 004447CE
Station Summary, xrefs: 00444583
WaterDepth2, xrefs: 0044473C

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: AllocClearStringVariant$_com_issue_errorex
String ID: 4UD$Station Summary$WaterDepth$WaterDepth2
API String ID: 129268359-3691100890
Opcode ID: cc7853af9042c1a68df9cda8d6a33a66a92a225716cacdd7f251746021f1b05a
Instruction ID: f21d0fdba7433b9f10addcbfd3bdb0e42198992a4d0d90e616da6369b26beb92
Opcode Fuzzy Hash: cc7853af9042c1a68df9cda8d6a33a66a92a225716cacdd7f251746021f1b05a
Instruction Fuzzy Hash: AAA1F271208784DFE710EB69C840B1BB7E8AFC8704F10494EFA9997391DB78D805CB6A

Function 0040DCB7 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

_com_util::ConvertStringToBSTR.COMSUPP ref: 0040DD93
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040DDB0
VariantClear.OLEAUT32(?), ref: 0040DDF8
VariantClear.OLEAUT32(?), ref: 0040DDFF
VariantClear.OLEAUT32(?), ref: 0040DE06
__wcsicoll.LIBCMT ref: 0040DE26

Strings

`<u, xrefs: 0040DE4F
FileInformation, xrefs: 0040DD53
FilePath, xrefs: 0040DDA1

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$ConvertString_com_util::$__wcsicoll
String ID: FileInformation$FilePath$`<u
API String ID: 2607815157-4215550760
Opcode ID: 933166540dff59a916d805a92f2976404b75095a761f6ff1b603285cbe8a2a75
Instruction ID: e1e6aaf23d08790dbe77e6534980ec670b2ecc8e447a1dcea1764aaf0710d275
Opcode Fuzzy Hash: 933166540dff59a916d805a92f2976404b75095a761f6ff1b603285cbe8a2a75
Instruction Fuzzy Hash: F5516F71A083819FC710DFA5C880A1FB7E5AF98304F14496EF585AB391D738EC49CB9A

Function 0040DCB5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

_com_util::ConvertStringToBSTR.COMSUPP ref: 0040DD93
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040DDB0
VariantClear.OLEAUT32(?), ref: 0040DDF8
VariantClear.OLEAUT32(?), ref: 0040DDFF
VariantClear.OLEAUT32(?), ref: 0040DE06
__wcsicoll.LIBCMT ref: 0040DE26

Strings

`<u, xrefs: 0040DE4F
FileInformation, xrefs: 0040DD53
FilePath, xrefs: 0040DDA1

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$ConvertString_com_util::$__wcsicoll
String ID: FileInformation$FilePath$`<u
API String ID: 2607815157-4215550760
Opcode ID: 69e43c5e1f5d4d5f12433695ad2d02e1551339fbd0c602c609f6cf8b0c42dd20
Instruction ID: 591798a019521c36a4d4793ca1ab960b415d12fef79ef77bb95c277e7b391d66
Opcode Fuzzy Hash: 69e43c5e1f5d4d5f12433695ad2d02e1551339fbd0c602c609f6cf8b0c42dd20
Instruction Fuzzy Hash: 3A515F71A083819FC710DFA5C880A1FB7E5AF98304F54496EF585AB391D738EC49CB9A

Function 0235A2A0 Relevance: 18.2, APIs: 12, Instructions: 207COMMON

Download Yara Rule

APIs

mpptid.LIBGUIDE40(024E2088), ref: 0235A2CF
ippsConvert_32f64f.IPPSW7(?,?,?), ref: 0235A349
ippsConvert_32f64f.IPPSW7(?,?,?), ref: 0235A386
ippsConvert_64f32f.IPPSW7(?,?,?), ref: 0235A397
mppioa.LIBGUIDE40(024E2074), ref: 0235A3C6
__kmpc_fork_call.LIBGUIDE40(024E2074,00000009,Function_0006A516,?,?,?,?,?,?,?,?,?), ref: 0235A409
__kmpc_serialized_parallel.LIBGUIDE40(024E2074,?), ref: 0235A41C
__kmpc_end_serialized_parallel.LIBGUIDE40(024E2074,?,?,024F58AC,?,?,?,?,?,?,?,?,?,024E2074,?), ref: 0235A466
ippsConvert_64f32f.IPPSW7(?,?,?), ref: 0235A4A0
ippsConvert_32f64f.IPPSW7(?,?,?), ref: 0235A4B8
ippsConvert_64f32f.IPPSW7(?,?,?), ref: 0235A4E4
ippsCopy_64f.IPPSW7(-00000008,?,?), ref: 0235A504

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Convert_32f64fConvert_64f32f$Copy_64f__kmpc_end_serialized_parallel__kmpc_fork_call__kmpc_serialized_parallelmppioampptid
String ID:
API String ID: 3521319204-0
Opcode ID: 120b96a30c140c2604af76964820b3e506597282fee0c9eafe16e0dd453ece8f
Instruction ID: 99dcf6bc4de90dbad6b293d2aa24762c19fb1b063c0fc122ea702b3631c25e60
Opcode Fuzzy Hash: 120b96a30c140c2604af76964820b3e506597282fee0c9eafe16e0dd453ece8f
Instruction Fuzzy Hash: 1B712572508306AFDB40DF94CC80D6BFBEAFFC8714F048A2DB98992211D671EA55CB52

Function 0041F4F0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 271registrycomstringCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0047CD1C,00000000,00000001,0047A030,?), ref: 0041F567
StringFromGUID2.OLE32(?,?,00000040), ref: 0041F601
lstrlenW.KERNEL32(?), ref: 0041F60E

Part of subcall function 004030E0: _malloc.LIBCMT ref: 004030F5

Part of subcall function 00401430: RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00401452
Part of subcall function 00401430: RegCloseKey.ADVAPI32 ref: 00401463

RegDeleteKeyA.ADVAPI32(80000000,?), ref: 0041F72D
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041F70F

Part of subcall function 00401400: RegCloseKey.ADVAPI32 ref: 0040140C

RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041F797
RegDeleteKeyA.ADVAPI32(80000000,?), ref: 0041F7B5

Strings

\Implemented Categories, xrefs: 0041F755
\Required Categories, xrefs: 0041F6AA
CLSID\, xrefs: 0041F688, 0041F733

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CloseDeleteInfoQuery$CreateFromInstanceOpenString_malloclstrlen
String ID: CLSID\$\Implemented Categories$\Required Categories
API String ID: 2967690725-4092563799
Opcode ID: 144d7ad323c725f15cd03ac8c587ad901ae0e8194d57e3ad5a67b70723c41dfb
Instruction ID: a0eb44cccef358c45b721e8894981ee1767a70543cd7d6ceb8fa1b41ac120c63
Opcode Fuzzy Hash: 144d7ad323c725f15cd03ac8c587ad901ae0e8194d57e3ad5a67b70723c41dfb
Instruction Fuzzy Hash: 1C915671A00204DFDB24DFA5CC81FEEB379AF44704F10452AF919AB291E778A986CB59

Function 00444250 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Station Summary), ref: 00444272
VariantClear.OLEAUT32(?), ref: 004442F9
_com_issue_errorex.COMSUPP ref: 0044432D
SysAllocString.OLEAUT32(SNR), ref: 004443F9
VariantClear.OLEAUT32(?), ref: 00444420
_com_issue_errorex.COMSUPP ref: 004443AE

Part of subcall function 00459380: GetErrorInfo.OLEAUT32(00000000,00000000,?,00405831,00000000,?,00477D28), ref: 004593D0

_com_issue_errorex.COMSUPP ref: 004444AC
VariantClear.OLEAUT32(?), ref: 004444D6

Strings

SNR, xrefs: 004443EF
Station Summary, xrefs: 00444268

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant_com_issue_errorex$AllocString$ErrorInfo
String ID: SNR$Station Summary
API String ID: 1120245337-3150243165
Opcode ID: 60c3b1d8bd5c1220d683aaa43d52886187cee49ca41a11c48b2f39a61dffb4be
Instruction ID: ba106b68050bd1cf41c3b9579289e66f4a7eab6a2a3055a9673fe47dd70490b1
Opcode Fuzzy Hash: 60c3b1d8bd5c1220d683aaa43d52886187cee49ca41a11c48b2f39a61dffb4be
Instruction Fuzzy Hash: D1917A716042029FD700EF65C880A6FB3E9FFC8704B50495EFA4997251DB38ED49CBAA

Function 0044CD90 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 259memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Station Summary), ref: 0044CDE8
VariantClear.OLEAUT32(?), ref: 0044CE8F
_com_issue_errorex.COMSUPP ref: 0044CEBF
_com_issue_errorex.COMSUPP ref: 0044CF80
SysAllocString.OLEAUT32(StdErr), ref: 0044CFA0
VariantClear.OLEAUT32(?), ref: 0044D003
VariantClear.OLEAUT32(?), ref: 0044D02A

Strings

StdErr, xrefs: 0044CF96
Station Summary, xrefs: 0044CDD6
Method, xrefs: 0044CEEF

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$AllocString_com_issue_errorex
String ID: Method$Station Summary$StdErr
API String ID: 2610079620-1151616
Opcode ID: d3611698273efeb2f5d4b47a98b9807c97d25b444412d57ad0a9368de2324cb9
Instruction ID: ee7d320e51fc27a580e4388f3a3b6dd9404bf4bc10a673f1fa2b768823c29555
Opcode Fuzzy Hash: d3611698273efeb2f5d4b47a98b9807c97d25b444412d57ad0a9368de2324cb9
Instruction Fuzzy Hash: A9A1BD706087409FD721DB65C884A5BB7E9FFC9704F24894EF58983391CB38D84ACB9A

Function 0040BA40 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

APIs

_com_util::ConvertStringToBSTR.COMSUPP ref: 0040BBD4
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040BBF4
VariantClear.OLEAUT32(?), ref: 0040BC2C
VariantClear.OLEAUT32(?), ref: 0040BC33
_com_issue_errorex.COMSUPP ref: 0040BCA3
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040BCCE
VariantClear.OLEAUT32(?), ref: 0040BD04
VariantClear.OLEAUT32(?), ref: 0040BD0B

Strings

Decimals, xrefs: 0040BCBF
DisplayUnit, xrefs: 0040BBE2

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$ConvertString_com_util::$_com_issue_errorex
String ID: Decimals$DisplayUnit
API String ID: 2212467550-1201377615
Opcode ID: 4f0a149393d9e4ef0c23d1b0deb2c962c98d869223c48d145da4a958b6ce30c3
Instruction ID: 2043784b80e7524ce6f353e4d30a3496f864ae595f0ea98c92592ef38a6967bf
Opcode Fuzzy Hash: 4f0a149393d9e4ef0c23d1b0deb2c962c98d869223c48d145da4a958b6ce30c3
Instruction Fuzzy Hash: EA916175108341DFD710EBA5C441B5BB7E9EF98308F00496EF985A7392DBB8E805CB9A

Function 00445DD0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 241memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00445E10
VariantClear.OLEAUT32(?), ref: 00445EAE
_com_issue_errorex.COMSUPP ref: 00445EDE
VariantClear.OLEAUT32(?), ref: 00445F22
InterlockedIncrement.KERNEL32(?), ref: 00445F3D

Part of subcall function 00420C90: _com_issue_errorex.COMSUPP ref: 00420CF4
Part of subcall function 00420C90: InterlockedDecrement.KERNEL32(?), ref: 00420D0F
Part of subcall function 00420C90: SysFreeString.OLEAUT32(00000000), ref: 00420D24

InterlockedDecrement.KERNEL32(?), ref: 0044601B
SysFreeString.OLEAUT32(00000000), ref: 0044602C
InterlockedDecrement.KERNEL32(?), ref: 00446057
SysFreeString.OLEAUT32(00000000), ref: 00446068

Strings

Station Summary, xrefs: 00445DFE

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: InterlockedString$DecrementFree$ClearVariant_com_issue_errorex$AllocIncrement
String ID: Station Summary
API String ID: 2356150787-3045476099
Opcode ID: 062d7cb49ef2e35520fd19f44fdc16c7eebfc266212572492f59c0d888e772cf
Instruction ID: 6c9ff3c3e78a2cf1f5c7f28cd67d2ce8329833d45774d03b8b107fc1c8c4404f
Opcode Fuzzy Hash: 062d7cb49ef2e35520fd19f44fdc16c7eebfc266212572492f59c0d888e772cf
Instruction Fuzzy Hash: 4E81B1711083809FD710EFA9C880A5BB7E9AF98304F14496EF58993352D778ED48CB56

Function 0044E6A0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 191COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0044E810

Strings

`<u, xrefs: 0044E885, 0044E8B9
,%.1f, xrefs: 0044E78E
HighAmpStdDev, xrefs: 0044E81D
%.1f,%.1f, xrefs: 0044E75F

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: IncrementInterlocked
String ID: %.1f,%.1f$,%.1f$HighAmpStdDev$`<u
API String ID: 3508698243-1465269511
Opcode ID: dfb68e7e5683243535f276ed96f3b60f998a2070c53ca1ee5bd59e505ceb750a
Instruction ID: 54cdddcc5d12bc090f7a56995fcf9d4c7c1bbdc76e794fb06356e94241c9ad86
Opcode Fuzzy Hash: dfb68e7e5683243535f276ed96f3b60f998a2070c53ca1ee5bd59e505ceb750a
Instruction Fuzzy Hash: B161F971508741DBD720EF26C845A5BB7E8FF88704F044A6EF48993391DB38E904CB9A

Function 0040C7D0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

SysAllocString.OLEAUT32(FlowTrackerSoftware), ref: 0040C8C3
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040C8EF
VariantClear.OLEAUT32(?), ref: 0040C93D
VariantClear.OLEAUT32(?), ref: 0040C944
VariantClear.OLEAUT32(?), ref: 0040C950
InterlockedIncrement.KERNEL32(?), ref: 0040C96D
InterlockedIncrement.KERNEL32(?), ref: 0040C987

Part of subcall function 00409730: InterlockedDecrement.KERNEL32(?), ref: 0040973E
Part of subcall function 00409730: SysFreeString.OLEAUT32(00000000), ref: 00409753

Strings

Language, xrefs: 0040C860
FlowTrackerSoftware, xrefs: 0040C8B9
ApplicationName, xrefs: 0040C8E0

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$ClearInterlockedVariant$ConvertIncrement_com_util::$AllocDecrementFree
String ID: ApplicationName$FlowTrackerSoftware$Language
API String ID: 1287706641-2090416642
Opcode ID: dbba2b62227b5adf4e99021dab0c6ff183326807c453211d12c7ca152b99cd41
Instruction ID: 6c4fd5ebc014cb1c52cc9fec50be2df91fecbfbced25e53c84ec458174c9d00c
Opcode Fuzzy Hash: dbba2b62227b5adf4e99021dab0c6ff183326807c453211d12c7ca152b99cd41
Instruction Fuzzy Hash: 14519372208340DFD704EB6AC841B5FB7E9AF88704F04496EF94597391DB78E805CB6A

Function 0040CD90 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 0040AEA0: SysStringByteLen.OLEAUT32 ref: 0040AEB8
Part of subcall function 0040AEA0: SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 0040AEC2

Part of subcall function 004099C0: InterlockedIncrement.KERNEL32(-00000008), ref: 004099FA

InterlockedDecrement.KERNEL32(7EE0FD6A), ref: 0040CE04
SysFreeString.OLEAUT32(00000000), ref: 0040CE15
InterlockedDecrement.KERNEL32(?), ref: 0040CE4D
SysFreeString.OLEAUT32(00000000), ref: 0040CE5A
ShellExecuteA.SHELL32(?,open,00000000,00000000,00477793,0000000A), ref: 0040CEB0
InterlockedDecrement.KERNEL32(7EE0FD7A), ref: 0040CEC2
SysFreeString.OLEAUT32(00000000), ref: 0040CED3

Strings

`<u, xrefs: 0040CE15, 0040CE5A, 0040CED3
open, xrefs: 0040CEAA
FlowTracker Technical Manual.pdf, xrefs: 0040CDB8

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Interlocked$DecrementFree$Byte$AllocConvertExecuteIncrementShell_com_util::
String ID: FlowTracker Technical Manual.pdf$`<u$open
API String ID: 3932119087-1641499333
Opcode ID: 2b1ba612aaa6efbec251d11cb92cfdf935d87917e881a599c131f39abe9056be
Instruction ID: a70c6b2c043643d7ed6122add56bde4c6726aba30df7f09381d80190ea83fbf4
Opcode Fuzzy Hash: 2b1ba612aaa6efbec251d11cb92cfdf935d87917e881a599c131f39abe9056be
Instruction Fuzzy Hash: 6C414EB1604311DBD620DF65DD85B5BB7D8AF54744F040A3EF845E7382E738E90886EA

Function 0040D2A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 00401380: SHGetSpecialFolderLocation.SHELL32(00000000,?,?), ref: 00401397
Part of subcall function 00401380: SHGetSpecialFolderLocation.SHELL32(00000000,?,?), ref: 004013A5
Part of subcall function 00401380: SHGetPathFromIDListA.SHELL32(?,?), ref: 004013B5
Part of subcall function 00401380: SHGetMalloc.SHELL32(?), ref: 004013C0

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0040D2E3
GetFileAttributesA.KERNEL32(?), ref: 0040D323
CreateDirectoryA.KERNEL32(?,00000000), ref: 0040D33B
GetFileAttributesA.KERNEL32(?), ref: 0040D37D
CreateDirectoryA.KERNEL32(?,00000000), ref: 0040D38F
GetFileAttributesA.KERNEL32(?), ref: 0040D3C6
CreateDirectoryA.KERNEL32(?,00000000), ref: 0040D3D8

Strings

\SonTek Shared, xrefs: 0040D34A
:\Program files\Common files, xrefs: 0040D310
\MultiLanguage2, xrefs: 0040D39E

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Directory$AttributesCreateFile$FolderLocationSpecial$FromListMallocPathWindows
String ID: :\Program files\Common files$\MultiLanguage2$\SonTek Shared
API String ID: 2265502974-165989361
Opcode ID: d1b7e3cbf584fa5d936cf41c4839f589b2674c438108367a81d39096eae455c4
Instruction ID: ba0f7d4810ef13f988c23d80936593b41ce51229b1184f6f242dad284f3e8314
Opcode Fuzzy Hash: d1b7e3cbf584fa5d936cf41c4839f589b2674c438108367a81d39096eae455c4
Instruction Fuzzy Hash: 3241D4704083418FC714DF24E884A9BB7E5EF98310F04892EE899973E1DB74E84DCB9A

Function 0040E080 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 122filememoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 0040E09C
GdipLoadImageFromFile.GDIPLUS(?,00000004,00000010), ref: 0040E0B8
InterlockedDecrement.KERNEL32(00000018), ref: 0040E10A
SysFreeString.OLEAUT32(00000000), ref: 0040E117
GdipSaveImageToFile.GDIPLUS(?,00000000,00000000,00000000,00000010,logo.gif,00000010), ref: 0040E161
InterlockedDecrement.KERNEL32(?), ref: 0040E183
SysFreeString.OLEAUT32(00000000), ref: 0040E194

Strings

`<u, xrefs: 0040E117, 0040E194
logo.gif, xrefs: 0040E0DC
image/gif, xrefs: 0040E13B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Gdip$DecrementFileFreeImageInterlockedString$AllocFromLoadSave
String ID: `<u$image/gif$logo.gif
API String ID: 3762964844-2270494874
Opcode ID: f003e14b0e7628b81458876142223a30dcd1f13b8727ff8558a49f594d958ea7
Instruction ID: e1c4de1bc59793d22260744315e47fdf940b90e4ea8253d12f2eede4246f5cf5
Opcode Fuzzy Hash: f003e14b0e7628b81458876142223a30dcd1f13b8727ff8558a49f594d958ea7
Instruction Fuzzy Hash: 594165716043019BD620EF66DC41A6BB3E8AF44744F044D3EF955E7281EB38ED18C7AA

Function 022F83F8 Relevance: 16.7, APIs: 11, Instructions: 195COMMON

Download Yara Rule

APIs

__kmpc_master.LIBGUIDE40(024DC6A0,?), ref: 022F8449
omp_get_num_threads.LIBGUIDE40 ref: 022F8456
mptxms.LIBGUIDE40(024DC6A0,?), ref: 022F84A6
__kmpc_barrier.LIBGUIDE40(024DC68C,?), ref: 022F84B4
omp_get_thread_num.LIBGUIDE40 ref: 022F84BC
ippsConvert_16s32f.IPPSW7(?,?,?), ref: 022F8590
ippsZero_32f.IPPSW7(?,?,?,?,?), ref: 022F85AE
ippsFFTFwd_RToPerm_32f.IPPSW7(?,?,?,?,?,?,?,?,?), ref: 022F85C2
ippsMulPerm_32f_I.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?), ref: 022F85E5
ippsFFTInv_PermToR_32f.IPPSW7(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 022F85F9
ippsConvert_32f16s_Sfs.IPPSW7(?,?,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 022F8634

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Convert_16s32fConvert_32f16s_Fwd_Inv_PermPerm_32fPerm_32f_R_32fZero_32f__kmpc_barrier__kmpc_mastermptxmsomp_get_num_threadsomp_get_thread_num
String ID:
API String ID: 2223111530-0
Opcode ID: 49187d74bf456cf853a8361272c48c856db335683484a41f2d27ec48b4aa7df4
Instruction ID: 6c557581ec4a7dbd8f12056e6e065e6f7e7e01f62800982597809b02f1af8239
Opcode Fuzzy Hash: 49187d74bf456cf853a8361272c48c856db335683484a41f2d27ec48b4aa7df4
Instruction Fuzzy Hash: 8F815D742053418FD768DF18C890AAAB7E6FFC9310F2586ADD9498B359D730A841CF92

Function 02394014 Relevance: 15.1, APIs: 10, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

ippsMalloc_8u.IPPSW7(00000018), ref: 02394033
ippsDFTInitAlloc_C_32fc.IPPSW7(?,?,00000002,?), ref: 0239405C

Part of subcall function 02324BE0: ippsMalloc_8u.IPPSW7(00000234,?,?,?,00000000,02322DE6,00000010,?,?,00000001), ref: 02324C05

ippsDFTInitAlloc_R_32f.IPPSW7(00000014,?,00000002,?,?,?,00000002,?), ref: 0239407B
ippsDFTFree_C_32fc.IPPSW7(00000002,00000014,?,00000002,?,?,?,00000002,?), ref: 0239408B

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Alloc_C_32fcInitMalloc_8u$Free_R_32f
String ID:
API String ID: 1079498264-0
Opcode ID: 08be224dbdaeb7a27c56ca35badfdc7c8df3c5f6ca4391b582cc2e31b8d9c262
Instruction ID: 5e8d9daf022f2a32ca0cb8dd35b67bdce1efdb7b534935d317571f2a0d07a1b4
Opcode Fuzzy Hash: 08be224dbdaeb7a27c56ca35badfdc7c8df3c5f6ca4391b582cc2e31b8d9c262
Instruction Fuzzy Hash: AB315E32604511DFCB05DF58EC80E0AB7A6BFD9310B558666E5148F268D732E856CFA2

Function 00403B70 Relevance: 15.1, APIs: 10, Instructions: 105threadCOMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C0000005,00000001,?,?), ref: 00403B82
GetCurrentThreadId.KERNEL32 ref: 00403B9C
EnterCriticalSection.KERNEL32(?), ref: 00403BA9
LeaveCriticalSection.KERNEL32(?), ref: 00403BB9
RaiseException.KERNEL32(C0000005,00000001,00000000,00000000), ref: 00403BD0
EnterCriticalSection.KERNEL32(?,?,?,?), ref: 00403BF8
GetCurrentThreadId.KERNEL32 ref: 00403C05
LeaveCriticalSection.KERNEL32(?,?,?), ref: 00403C1F

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CriticalSection$CurrentEnterExceptionLeaveRaiseThread
String ID:
API String ID: 2662421713-0
Opcode ID: a1821b291667185a243cb1092d77e4041b141e35ad6bb27d1ef41217be054819
Instruction ID: 1894f92dbcf44203cdd5bf73ff0d1146089c5cf42ec8c3476d6580bc5627eb0e
Opcode Fuzzy Hash: a1821b291667185a243cb1092d77e4041b141e35ad6bb27d1ef41217be054819
Instruction Fuzzy Hash: 42319F722092019FD7208F59EC84A57FBACFF54B15B40897FF969E7251C730A880CB68

Function 00420080 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 163windowCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0042009A
GetModuleFileNameA.KERNEL32(00400000,?,00000208), ref: 004200F7
FindWindowA.USER32(FlowTrackerExportMainWindow,00000000), ref: 00420185
_sprintf.LIBCMT ref: 0042019F
SendMessageA.USER32 ref: 004201D2
CoUninitialize.OLE32(?), ref: 0042024C

Strings

0`I, xrefs: 004200E0
FlowTrackerExportMainWindow, xrefs: 00420180

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: FileFindInitializeMessageModuleNameSendUninitializeWindow_sprintf
String ID: 0`I$FlowTrackerExportMainWindow
API String ID: 4175197331-3119018409
Opcode ID: 0e2e937af936a64ccccf3ac889dffa2feca82b5ad72e091d44f0aa58d0317daf
Instruction ID: 2fa4379badbc460e2263857f718da8f8b5e773da62bfa97fc3e1474e649ea161
Opcode Fuzzy Hash: 0e2e937af936a64ccccf3ac889dffa2feca82b5ad72e091d44f0aa58d0317daf
Instruction Fuzzy Hash: AE519B313043019FD314DB64DC85F6BB7E4AF84314F448A6EF5198B292EB79E809CBA9

Function 02394380 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

XSML, xrefs: 023943B6

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID: XSML
API String ID: 0-2075808843
Opcode ID: 95f8fa9c2512750475d7dbdd6ecc75a0adf73fab44755e4512723b53e842a901
Instruction ID: ed605ba1e2258ede4404d85d95b5bbf9699cdce2ea46a421fcf5c12b7e3bca0f
Opcode Fuzzy Hash: 95f8fa9c2512750475d7dbdd6ecc75a0adf73fab44755e4512723b53e842a901
Instruction Fuzzy Hash: 1C41C4767006059BC720DE59D88092BF3A9EFD6724B18C66DEE588B354D732E812CBA0

Function 004214E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98memorytimeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 0042153A
_sprintf.LIBCMT ref: 0042156E

Part of subcall function 004097B0: _com_util::ConvertStringToBSTR.COMSUPP ref: 00409831

SysStringByteLen.OLEAUT32(00000000), ref: 004215A6
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 004215B0
InterlockedDecrement.KERNEL32(00000008), ref: 004215D6
SysFreeString.OLEAUT32(00000000), ref: 004215E7

Strings

`<u, xrefs: 004215E7
%4d/%02d/%02d %02d:%02d:%02d, xrefs: 00421568

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$ByteTime$AllocConvertDecrementFreeInterlockedSystemVariant_com_util::_sprintf
String ID: %4d/%02d/%02d %02d:%02d:%02d$`<u
API String ID: 335472935-2209271904
Opcode ID: a0fab9b9607b93523e648ea63801bd502df3ef0e344b48a2cb55466594d5086d
Instruction ID: a7e7eb344010d60d334a5ba18bc46c95bb77a8d4ee5fec0622c4564cfc757151
Opcode Fuzzy Hash: a0fab9b9607b93523e648ea63801bd502df3ef0e344b48a2cb55466594d5086d
Instruction Fuzzy Hash: 2331A571608350ABC324DF65DC45BABB7E8FF88701F40492EF885C2290EB38D584C7A6

Function 00410500 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

SysStringByteLen.OLEAUT32(00000000), ref: 00410552
SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 0041055C
InterlockedDecrement.KERNEL32(?), ref: 00410580
SysFreeString.OLEAUT32(00000000), ref: 00410591

Strings

108, xrefs: 00410512
`<u, xrefs: 00410591
Mar 23 2009, xrefs: 0041051A
%s (Build %s), xrefs: 00410527

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Byte$AllocConvertDecrementFreeInterlocked_com_util::
String ID: %s (Build %s)$108$Mar 23 2009$`<u
API String ID: 3445928834-1467906416
Opcode ID: 0dbdf79efd05ebbbce46800e14f875aca225027526c3503897e533c7e416ec5f
Instruction ID: c675c521a45f5552dd1a251d57d243eff7d46ff7dca373bced6ca970f953f61f
Opcode Fuzzy Hash: 0dbdf79efd05ebbbce46800e14f875aca225027526c3503897e533c7e416ec5f
Instruction Fuzzy Hash: A621BD71600301EBC310DF69CC44E9BB7E9AF847107148A2AF859D7292EB38E884CA98

Function 0041ED40 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

CharUpperA.USER32 ref: 0041ED52
CharUpperA.USER32 ref: 0041ED5E
CharNextA.USER32(?), ref: 0041ED79
CharNextA.USER32(?), ref: 0041ED7E
CharUpperA.USER32 ref: 0041ED86
CharUpperA.USER32(00000000), ref: 0041ED8E

Strings

, xrefs: 0041ED68
, xrefs: 0041ED9A

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Char$Upper$Next
String ID: $
API String ID: 3006421506-227171996
Opcode ID: 4c2e138976b07025b26ce3785d4966787dee677e25e9faffb7108ea983440d29
Instruction ID: b9a6e3d49dd20ab96792aa8deae0e37653ffae39fd93807a7b9485376a366dea
Opcode Fuzzy Hash: 4c2e138976b07025b26ce3785d4966787dee677e25e9faffb7108ea983440d29
Instruction Fuzzy Hash: 2501E136A8635A0ADB3086AABC417FBB7998F86351F4C045BAC8483282E51D89C5971E

Function 023642B8 Relevance: 13.8, APIs: 9, Instructions: 335COMMON

Download Yara Rule

APIs

mpptid.LIBGUIDE40(024E3AF0), ref: 023642DF
ippsCopy_8u.IPPSW7(?,?,?), ref: 0236435F
ippsCopy_8u.IPPSW7(?,?,?), ref: 023643D9
mppioa.LIBGUIDE40(024E3ADC,?,?,?), ref: 02364412
__kmpc_fork_call.LIBGUIDE40(024E3ADC,00000010,Function_000746E3,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02364481
__kmpc_serialized_parallel.LIBGUIDE40(024E3ADC,?,?,?,?), ref: 02364497
__kmpc_end_serialized_parallel.LIBGUIDE40(024E3ADC,?,?,024F58E8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02364510
ippsCopy_8u.IPPSW7(?,?,?), ref: 02364618
ippsCopy_8u.IPPSW7(?,?,?), ref: 023646D0

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Copy_8uipps$__kmpc_end_serialized_parallel__kmpc_fork_call__kmpc_serialized_parallelmppioampptid
String ID:
API String ID: 3591959102-0
Opcode ID: 7fa78b4105eb2b46bfbee9f9374e72ccd4cf79e7dec8b852c06d23ba9a35bee4
Instruction ID: c001067e60ec67c22e95646dc1427451cda7da3c822a11c073b7148514be0789
Opcode Fuzzy Hash: 7fa78b4105eb2b46bfbee9f9374e72ccd4cf79e7dec8b852c06d23ba9a35bee4
Instruction Fuzzy Hash: 52D10872508345AFDB158F94CC80AAFFBFAFFC8704F04892DF69582220D676A9558F52

Function 00458570 Relevance: 13.8, APIs: 9, Instructions: 324comCOMMON

Download Yara Rule

APIs

Part of subcall function 00456C40: EnterCriticalSection.KERNEL32(004960A0,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?), ref: 00456C4C
Part of subcall function 00456C40: RegisterWindowMessageA.USER32(WM_ATLGETHOST,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?,?,00000000), ref: 00456C5D
Part of subcall function 00456C40: RegisterWindowMessageA.USER32(WM_ATLGETCONTROL,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?,?,00000000), ref: 00456C69
Part of subcall function 00456C40: GetClassInfoExA.USER32(00400000,AtlAxWin90,?), ref: 00456C90
Part of subcall function 00456C40: LoadCursorA.USER32 ref: 00456CCE
Part of subcall function 00456C40: RegisterClassExA.USER32 ref: 00456CF1
Part of subcall function 00456C40: _memset.LIBCMT ref: 00456D1D
Part of subcall function 00456C40: GetClassInfoExA.USER32(00400000,AtlAxWinLic90,?), ref: 00456D3A
Part of subcall function 00456C40: LoadCursorA.USER32 ref: 00456D72
Part of subcall function 00456C40: RegisterClassExA.USER32 ref: 00456D95

Part of subcall function 00456C40: LeaveCriticalSection.KERNEL32(004960A0,?,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?,?), ref: 00456DC4

CoCreateInstance.OLE32(0047CCCC,00000000,00000017,00477D48,0047CCA0), ref: 00458665
OleRun.OLE32(0047CCA0), ref: 00458674
_com_issue_errorex.COMSUPP ref: 004586CE
CoCreateInstance.OLE32(00479084,00000000,00000017,00477D48,00000008), ref: 0045878F
OleRun.OLE32(00000008), ref: 0045879E
CoCreateInstance.OLE32(0047CC3C,00000000,00000017,00477D48,00000008), ref: 004587F4
OleRun.OLE32(00000008), ref: 00458803
CoCreateInstance.OLE32(0047CC3C,00000000,00000017,00477D48,00000008), ref: 00458859
OleRun.OLE32(00000008), ref: 00458868

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClassCreateInstanceRegister$CriticalCursorInfoLoadMessageSectionWindow$EnterLeave_com_issue_errorex_memset
String ID:
API String ID: 3045615106-0
Opcode ID: c501801efecac8021cda0243c4830fee66b6546db63d34c3b298d538c77cf521
Instruction ID: 93e8dc6b06a5e9b386a6115751f1771d207c8392ad73c40705237f4e06e3e937
Opcode Fuzzy Hash: c501801efecac8021cda0243c4830fee66b6546db63d34c3b298d538c77cf521
Instruction Fuzzy Hash: 3EC149752047059FC320EF69C8C095AB7E5FF8C309B60892EE98AD7751CB34E84ACB55

Function 0235E3C4 Relevance: 13.8, APIs: 9, Instructions: 307COMMON

Download Yara Rule

APIs

mpptid.LIBGUIDE40(024E2B08), ref: 0235E3F7
ippsCopy_32f.IPPSW7(?,?,?), ref: 0235E46D
ippsCopy_32f.IPPSW7(?,?,?), ref: 0235E506
mppioa.LIBGUIDE40(024E2AF4,?,?,?), ref: 0235E51F
__kmpc_fork_call.LIBGUIDE40(024E2AF4,00000010,Function_0006E7A9,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235E591
__kmpc_serialized_parallel.LIBGUIDE40(024E2AF4,?,?,?,?), ref: 0235E5A7
__kmpc_end_serialized_parallel.LIBGUIDE40(024E2AF4,?,?,024F58C4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235E623
ippsCopy_32f.IPPSW7(?,?,?), ref: 0235E700
ippsCopy_32f.IPPSW7(?,?,?), ref: 0235E796

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Copy_32fipps$__kmpc_end_serialized_parallel__kmpc_fork_call__kmpc_serialized_parallelmppioampptid
String ID:
API String ID: 1877313756-0
Opcode ID: 2123835c4226c85bd4fc407c636e3a4e17eb6ec89ed4a05a1629359a3b18fc96
Instruction ID: 91841a85495cc034c0e18c20cbb25dc073d68ac312853c39166a4c03d133f5f2
Opcode Fuzzy Hash: 2123835c4226c85bd4fc407c636e3a4e17eb6ec89ed4a05a1629359a3b18fc96
Instruction Fuzzy Hash: B8C1E472508345AFD725DF95C880A9BFBFAFFC8310F04891EF69982220D6B1E9558F52

Function 02370330 Relevance: 13.7, APIs: 9, Instructions: 182COMMON

Download Yara Rule

APIs

mpptid.LIBGUIDE40(024E4048), ref: 02370353
ippsCopy_64fc.IPPSW7(?,?,?), ref: 023703B1
ippsCopy_64fc.IPPSW7(?,?,?,?,?,?,?,?), ref: 023703FE
mppioa.LIBGUIDE40(024E4034,?,?,?,?,?,?,?,?), ref: 02370431
__kmpc_fork_call.LIBGUIDE40(024E4034,00000008,Function_00080541,?,?,?,?,?,?,?,?,?,?,?), ref: 0237046F
__kmpc_serialized_parallel.LIBGUIDE40(024E4034,?,?,?,?,?,?,?,?,?), ref: 02370482
__kmpc_end_serialized_parallel.LIBGUIDE40(024E4034,024F58F4,024F58F4,024F58F4,?,?,?,?,?,?,?,?,024E4034,?,?,?), ref: 023704C7
ippsCopy_64fc.IPPSW7(?,?,?), ref: 02370502
ippsCopy_64fc.IPPSW7(?,?,?,?,?,?,?,?), ref: 02370532

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Copy_64fcipps$__kmpc_end_serialized_parallel__kmpc_fork_call__kmpc_serialized_parallelmppioampptid
String ID:
API String ID: 1782433240-0
Opcode ID: 90bb78e31ed54ad56a392bfe2c941b75427627614496d28b3bb4c0d0c36b532e
Instruction ID: 537a3d2c5273b549fae096ea9630d381232d87c04a44c5037d3d35bb0312a683
Opcode Fuzzy Hash: 90bb78e31ed54ad56a392bfe2c941b75427627614496d28b3bb4c0d0c36b532e
Instruction Fuzzy Hash: 2851AF72508306AFDB04DF54CC809ABBBEAEBC8354F08892DF58586214E275E65ACF52

Function 02384284 Relevance: 13.7, APIs: 9, Instructions: 176COMMON

Download Yara Rule

APIs

mpptid.LIBGUIDE40(024E5CA8), ref: 023842A7
ippsCopy_64f.IPPSW7(?,?,?), ref: 02384301
ippsCopy_64f.IPPSW7(?,?,?,?,?,?,?,?), ref: 0238434C
mppioa.LIBGUIDE40(024E5C94,?,?,?,?,?,?,?,?), ref: 0238437D
__kmpc_fork_call.LIBGUIDE40(024E5C94,00000008,Function_00094489,?,?,?,?,?,?,?,?,?,?,?), ref: 023843BB
__kmpc_serialized_parallel.LIBGUIDE40(024E5C94,?,?,?,?,?,?,?,?,?), ref: 023843CE
__kmpc_end_serialized_parallel.LIBGUIDE40(024E5C94,024F5934,024F5934,024F5934,?,?,?,?,?,?,?,?,024E5C94,?,?,?), ref: 02384413
ippsCopy_64f.IPPSW7(?,?,?), ref: 0238444C
ippsCopy_64f.IPPSW7(?,?,?,?,?,?,?,?), ref: 0238447A

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Copy_64fipps$__kmpc_end_serialized_parallel__kmpc_fork_call__kmpc_serialized_parallelmppioampptid
String ID:
API String ID: 3553842358-0
Opcode ID: 4bf369946eeec93b6707f2046de07e659f5f95a4c6eb7fa4643e70ee248c41e4
Instruction ID: acda1417fcebf7ac2fb37660ac212c92369345b8c5d7b50832cad57942b3c0c5
Opcode Fuzzy Hash: 4bf369946eeec93b6707f2046de07e659f5f95a4c6eb7fa4643e70ee248c41e4
Instruction Fuzzy Hash: 02519D72508306AFDB04DF54CC80DABBBEAEFC8318F048A1DF58586214E275E64ACB52

Function 00458100 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00458122
GetWindowRect.USER32(?,?), ref: 0045815F
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00458197
ShowWindow.USER32(?,00000005), ref: 004581B2
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00458201
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00458219
ShowWindow.USER32(?,00000005), ref: 00458227
ShowWindow.USER32(?,00000005), ref: 0045822F
InvalidateRect.USER32(?,00000000,00000000,?), ref: 00458244

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Window$MoveRectShow$ClientInvalidate
String ID:
API String ID: 3463649288-0
Opcode ID: 610f226bd6ccbf6eabd44d8916fe6f0226701c879dc9f567fbd45ecec669eaaf
Instruction ID: 3c03a1200fb97eb595cbf22fdafece029485466419a2f5d776454c452a8decc4
Opcode Fuzzy Hash: 610f226bd6ccbf6eabd44d8916fe6f0226701c879dc9f567fbd45ecec669eaaf
Instruction Fuzzy Hash: 0341F5B5208301AFD314DF68D984E2BBBF9FBC8704F40492DF98A87255DA74E845CB66

Function 00423680 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 004236BB
_memcpy_s.LIBCMT ref: 004236CE

Part of subcall function 00401090: __CxxThrowException@8.LIBCMT ref: 004010A2

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

_com_util::ConvertStringToBSTR.COMSUPP ref: 004237E3
_com_issue_errorex.COMSUPP ref: 0042387B

Part of subcall function 00459380: GetErrorInfo.OLEAUT32(00000000,00000000,?,00405831,00000000,?,00477D28), ref: 004593D0

VariantClear.OLEAUT32(?), ref: 00423885

Strings

System, xrefs: 004237D9
Collection, xrefs: 00423732

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ConvertString_com_util::_memcpy_s$ClearErrorException@8InfoThrowVariant_com_issue_errorex
String ID: Collection$System
API String ID: 4086087376-4228405856
Opcode ID: aa6671d2d22ebbd5ba6bba46d20af5db9e67df261159c736f13379a2a8ccf6da
Instruction ID: c44505df120c31a0ca3dd326e941f7f765e2ebc4a26f76efde1b08edb2c4eaa5
Opcode Fuzzy Hash: aa6671d2d22ebbd5ba6bba46d20af5db9e67df261159c736f13379a2a8ccf6da
Instruction Fuzzy Hash: 44719DB1204340AFC710EF69C885A1FB7E8EF89704F50496EFA459B352C639ED05CB9A

Function 00449590 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 216memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Station Summary), ref: 004495D1
VariantClear.OLEAUT32(?), ref: 0044966A
_com_issue_errorex.COMSUPP ref: 004496A2
SysAllocString.OLEAUT32(IceDepth), ref: 004496CC
VariantClear.OLEAUT32(?), ref: 00449773

Strings

IceDepth, xrefs: 004496C2
Station Summary, xrefs: 004495C7

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: AllocClearStringVariant$_com_issue_errorex
String ID: IceDepth$Station Summary
API String ID: 129268359-3264340963
Opcode ID: ac40366b5a61d427c32bbc168713013b8fb2c14d22fe56463491d8d9197961d2
Instruction ID: ba79f1138b191a51190df29bd80785b053578ce652aaca2d579e6c2f62d7ea7c
Opcode Fuzzy Hash: ac40366b5a61d427c32bbc168713013b8fb2c14d22fe56463491d8d9197961d2
Instruction Fuzzy Hash: DE817B71208381DFE701DB6AC844B1BB7E8AFD8704F14495EF98597391DB78D809CBAA

Function 0040FC70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

_com_util::ConvertStringToBSTR.COMSUPP ref: 0040FD00
VariantClear.OLEAUT32(?), ref: 0040FD4D
VariantClear.OLEAUT32(?), ref: 0040FD54
VariantClear.OLEAUT32(?), ref: 0040FD5F

Strings

Columns, xrefs: 0040FD80
UnitSystem, xrefs: 0040FCF1
Units, xrefs: 0040FCA0

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$ConvertString_com_util::
String ID: Columns$UnitSystem$Units
API String ID: 1565985208-2367981217
Opcode ID: b1b71d7c2817acbd06dcabb72a5f1063dc877644e2e538f1b11ab35b6caddd54
Instruction ID: 625b63da415673899a724b34db332e26717a6a889d2dee6b1c0998314b8c25be
Opcode Fuzzy Hash: b1b71d7c2817acbd06dcabb72a5f1063dc877644e2e538f1b11ab35b6caddd54
Instruction Fuzzy Hash: 7B6181712083419FD714DB69C841A1BB7E9FFC9304F044A6EF98997391DB78E805CB6A

Function 0041E3E0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0041E44C
VariantClear.OLEAUT32(?), ref: 0041E45D
SysAllocString.OLEAUT32(?), ref: 0041E46D
VariantClear.OLEAUT32(?), ref: 0041E552

Strings

Failed to load %s:%s, xrefs: 0041E52E
XML DOM loaded from %s:%s, xrefs: 0041E5AD

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$AllocInitString
String ID: Failed to load %s:%s$XML DOM loaded from %s:%s
API String ID: 347172062-2957115522
Opcode ID: 72aa63e972a1c985f422746932e04a6c569cff7472c41517c8b9e907ee6cd2eb
Instruction ID: ce92cdcb263929de4e4af346ebd9c769ac7a31c41ed2fd74a7f5c5842f0e4acf
Opcode Fuzzy Hash: 72aa63e972a1c985f422746932e04a6c569cff7472c41517c8b9e907ee6cd2eb
Instruction Fuzzy Hash: 40517E75900209EFDB10DFA9C885EEEB7B4FF5C304F1085AEE909A7241D7399945CB64

Function 004166B6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

PathRemoveFileSpecA.SHLWAPI(?,?,?,?,?,?,?,?,?,?,00000000,00010810,?), ref: 00416756
PathAddBackslashA.SHLWAPI(?,?,?,?,?,?,?,?,?,?,00000000,00010810,?), ref: 00416764
InterlockedDecrement.KERNEL32(?), ref: 0041694A
SysFreeString.OLEAUT32(00000000), ref: 0041695B
InterlockedDecrement.KERNEL32(?), ref: 00416986
SysFreeString.OLEAUT32(00000000), ref: 0041699B

Strings

`<u, xrefs: 0041695B, 0041699B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedPathString$BackslashFileRemoveSpec
String ID: `<u
API String ID: 2397080376-3367579956
Opcode ID: e06a780beeced349bcb7132950a833679b11d473aa723e8d9e09e22986c406d2
Instruction ID: 0a48b3a30935e76de54c74165f306f97d2d1aa746a448759608aa8f59ce20fd7
Opcode Fuzzy Hash: e06a780beeced349bcb7132950a833679b11d473aa723e8d9e09e22986c406d2
Instruction Fuzzy Hash: C441F7B16083418FD720CF34D955ADBB7E8AF84308F04496DF88987352EB38D849CB86

Function 02394230 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

WSML, xrefs: 02394266

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID: WSML
API String ID: 0-601441309
Opcode ID: 79c7ed731aee900fbd83bf05e21d760995ca2d6cce31deead93d0c685d591e91
Instruction ID: ceff9d5dd57d383f1b1aff058eda0db14b0dda40e1586e8d7fe3038bbbe3f075
Opcode Fuzzy Hash: 79c7ed731aee900fbd83bf05e21d760995ca2d6cce31deead93d0c685d591e91
Instruction Fuzzy Hash: 7A3186B66042059BDB10EE68ECC096AF369EF95320F18C665EE18CF355D731E861CBE4

Function 024CA0CB Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 024CA138
GetStdHandle.KERNEL32(000000F4,024CE3BC,00000000,?,00000000,?), ref: 024CA20E
WriteFile.KERNEL32(00000000), ref: 024CA215

Strings

Microsoft Visual C++ Runtime Library, xrefs: 024CA1E4
Runtime Error!Program: , xrefs: 024CA19E
<program name unknown>, xrefs: 024CA148
..., xrefs: 024CA18A

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 46c1fcfa7bfeb553124d3076db33b44d12c00c272a7300fafff818b7b9727914
Instruction ID: 0e616b272866423ee7d0b4cc9ac68a7a198a9dbf079ced8c49072885d4d7ff8a
Opcode Fuzzy Hash: 46c1fcfa7bfeb553124d3076db33b44d12c00c272a7300fafff818b7b9727914
Instruction Fuzzy Hash: A531F676B4012C5EEFA0EE69CC45F9B736DEB88310F30045FF645D6140EB70A9458E51

Function 004512D0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 004513A2
SysFreeString.OLEAUT32(?), ref: 004513AD
_memset.LIBCMT ref: 004513C9
SysFreeString.OLEAUT32(?), ref: 004513EE

Strings

`<u, xrefs: 004513AD, 004513EE, 0045140B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Free$_memset
String ID: `<u
API String ID: 1104572413-3367579956
Opcode ID: 2f79a67cab0ad8215f477fe68714efb60fbf9f746998f0def7bfbeae25f3d4b4
Instruction ID: 3b7eb2caccdd0d387952cb7136ea4c15a3d8fca9ce3c6dbe7da7dd16f4625b07
Opcode Fuzzy Hash: 2f79a67cab0ad8215f477fe68714efb60fbf9f746998f0def7bfbeae25f3d4b4
Instruction Fuzzy Hash: D65153B52082469FD714DF14C980F6BB3E8EB89714F404A2EFA45D7391D738D909CBAA

Function 0042AFB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0042B020
InterlockedDecrement.KERNEL32(-00000008), ref: 0042B095
SysFreeString.OLEAUT32(00000000), ref: 0042B0A6
InterlockedDecrement.KERNEL32(0047B070), ref: 0042B0DE
SysFreeString.OLEAUT32(00000000), ref: 0042B0EF

Strings

`<u, xrefs: 0042B085

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeString$Increment
String ID: `<u
API String ID: 1306932728-3367579956
Opcode ID: 61cd1badcac7883ca9c83c9b12f8265586c1d5ec760b8228d646161bf75909e3
Instruction ID: 3b557625ebf198c86a8a1f686b03f307d054d204bbbcde530e714cc34b275762
Opcode Fuzzy Hash: 61cd1badcac7883ca9c83c9b12f8265586c1d5ec760b8228d646161bf75909e3
Instruction Fuzzy Hash: D241AC71B057219BC721DF29A840A1BB7E8EF54B44F44492EFC59D7341EB38EC0886E9

Function 0040C650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,7EE0FD72,?,?,?,?,?,?,0046EE68,000000FF), ref: 0040C68A
InterlockedDecrement.KERNEL32(?), ref: 0040C704
SysFreeString.OLEAUT32(00000000), ref: 0040C715
InterlockedDecrement.KERNEL32(?), ref: 0040C742
SysFreeString.OLEAUT32(00000000), ref: 0040C753

Strings

`<u, xrefs: 0040C715, 0040C753

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString$CriticalDeleteSection
String ID: `<u
API String ID: 1791083894-3367579956
Opcode ID: a767d1f1f61f6d5192d953c9e9542f99541f1367e215b846099f747af1f0a03f
Instruction ID: 0fcdc7c1b62f8e28a94460821724805d250120a264e3ef48b2603972709a8768
Opcode Fuzzy Hash: a767d1f1f61f6d5192d953c9e9542f99541f1367e215b846099f747af1f0a03f
Instruction Fuzzy Hash: E7416CB6500641DFC720DF65C8C0A5BB7E9BB48304F544A3EE58AD3351D739E848CB95

Function 00409C30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 00409C9C
InterlockedDecrement.KERNEL32(?), ref: 00409CBA
SysFreeString.OLEAUT32(00000000), ref: 00409CCB
InterlockedDecrement.KERNEL32(?), ref: 00409CFE
SysFreeString.OLEAUT32(00000000), ref: 00409D0F

Strings

`<u, xrefs: 00409CCB, 00409D0F

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString$_com_issue_errorex
String ID: `<u
API String ID: 2158521109-3367579956
Opcode ID: 946d207642db1ef64bc6275fe1a40fd204d0b0b634ba376e9014014b178253c0
Instruction ID: 2c50bf1ebcf58fa338569bc1fc5ca4bf4f6721f895993165e15ec0f5e9d8c645
Opcode Fuzzy Hash: 946d207642db1ef64bc6275fe1a40fd204d0b0b634ba376e9014014b178253c0
Instruction Fuzzy Hash: 2C3150B1A082029BE724DF25D944F5773D8AF54B54F040A3EF855E7381E738ED05C6A9

Function 00409D50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 00409DBC
InterlockedDecrement.KERNEL32(?), ref: 00409DDA
SysFreeString.OLEAUT32(00000000), ref: 00409DEB
InterlockedDecrement.KERNEL32(?), ref: 00409E1E
SysFreeString.OLEAUT32(00000000), ref: 00409E2F

Strings

`<u, xrefs: 00409DEB, 00409E2F

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString$_com_issue_errorex
String ID: `<u
API String ID: 2158521109-3367579956
Opcode ID: c9bc011a700b6f378b3a019280a0faad042944d63e49189663d256e8b3284e05
Instruction ID: e02cff51a4731f5c236c7df73faeb418397630d87a5d42eeb2da019f082eaad3
Opcode Fuzzy Hash: c9bc011a700b6f378b3a019280a0faad042944d63e49189663d256e8b3284e05
Instruction Fuzzy Hash: 06314DB16043129BD720DF25CD45B5777E8AF84B54F040A3EF859E7382E738ED058AA9

Function 00410430 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

SysStringByteLen.OLEAUT32(00000000), ref: 0041047D
SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 00410487
InterlockedDecrement.KERNEL32(?), ref: 004104AB
SysFreeString.OLEAUT32(00000000), ref: 004104BC

Strings

`<u, xrefs: 004104BC
2.30, xrefs: 00410445

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Byte$AllocConvertDecrementFreeInterlocked_com_util::
String ID: 2.30$`<u
API String ID: 3445928834-2599244320
Opcode ID: 3a2c911b49bc9402d70360411ea16f7fe515742cb6219058a6447e0c51de6799
Instruction ID: 35bd7f2d3c0ad8ffdcbffd004a04f0f4286a1c0bda22e6949acb08ad0d910a0c
Opcode Fuzzy Hash: 3a2c911b49bc9402d70360411ea16f7fe515742cb6219058a6447e0c51de6799
Instruction Fuzzy Hash: 0121B071604201AFC710DF69DC84E87B3E8AF84720714CA6AF959D7251EB78E884CB99

Function 004105E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

SysStringByteLen.OLEAUT32(00000000), ref: 0041062D
SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 00410637
InterlockedDecrement.KERNEL32(?), ref: 0041065B
SysFreeString.OLEAUT32(00000000), ref: 0041066C

Strings

SonTek FlowTracker, xrefs: 004105F5
`<u, xrefs: 0041066C

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Byte$AllocConvertDecrementFreeInterlocked_com_util::
String ID: SonTek FlowTracker$`<u
API String ID: 3445928834-1904252541
Opcode ID: 01a42461b50e190959a179e366e1067bedefb207b3929deb66a3cabc4a6e018c
Instruction ID: 2f33333b24908a28a30256506eed25848cdeb15eec10af63de08a3c94c0df38f
Opcode Fuzzy Hash: 01a42461b50e190959a179e366e1067bedefb207b3929deb66a3cabc4a6e018c
Instruction Fuzzy Hash: 6221B0716043019FC720EF69DC44E87B7E8AF84724714862BF859D7251EB38E894CB99

Function 0041F810 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 71libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0041F1F0: GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0041F259

GetModuleHandleW.KERNEL32(OLEAUT32.DLL), ref: 0041F868
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 0041F878
SysFreeString.OLEAUT32(?), ref: 0041F8C8

Strings

`<u, xrefs: 0041F8C8
UnRegisterTypeLibForUser, xrefs: 0041F872
OLEAUT32.DLL, xrefs: 0041F863

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Module$AddressFileFreeHandleNameProcString
String ID: OLEAUT32.DLL$UnRegisterTypeLibForUser$`<u
API String ID: 815855407-1636296419
Opcode ID: 38d73e960cbcd7e3416f185d188c20ab597c160b8dfece0f53b975c9c74ac0b6
Instruction ID: efc0e2edfaeae96625011aaf05391fd3fda0475404271211c40b02a103bfa777
Opcode Fuzzy Hash: 38d73e960cbcd7e3416f185d188c20ab597c160b8dfece0f53b975c9c74ac0b6
Instruction Fuzzy Hash: 96212871608211AFC614EF68D980E6B73E8AFC8B04F20896DF448D7350D734DD4ACBA6

Function 0040D7E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_com_util::ConvertStringToBSTR.COMSUPP ref: 0040D839
VariantClear.OLEAUT32(?), ref: 0040D87E
VariantClear.OLEAUT32(?), ref: 0040D885
VariantClear.OLEAUT32(?), ref: 0040D88C

Strings

UnitSystem, xrefs: 0040D822
Units, xrefs: 0040D802

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$ConvertString_com_util::
String ID: UnitSystem$Units
API String ID: 1565985208-3616490888
Opcode ID: 9bba762af0965beda70dbc7844f1ca621f9e15c4a9cd4dbe8736d7f7798cb69f
Instruction ID: cb2dd578198a0bfcbeb3bb0c5f40c16e488ca6f112b4835cfeb8a554971dd40e
Opcode Fuzzy Hash: 9bba762af0965beda70dbc7844f1ca621f9e15c4a9cd4dbe8736d7f7798cb69f
Instruction Fuzzy Hash: 2A11A276618311ABC705EBA4C841E5FB3E8BFD8704F00491EF984A7281DB78ED09C79A

Function 004219D5 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0041B2C0: VariantInit.OLEAUT32 ref: 0041B2D4
Part of subcall function 0041B2C0: _com_issue_errorex.COMSUPP ref: 0041B311
Part of subcall function 0041B2C0: _memcpy_s.LIBCMT ref: 0041B324

Part of subcall function 00401BA0: _com_issue_errorex.COMSUPP ref: 00401BF5

VariantClear.OLEAUT32(?), ref: 00421A10
VariantClear.OLEAUT32(?), ref: 00421A17
VariantClear.OLEAUT32(?), ref: 00421A1E
InterlockedDecrement.KERNEL32(?), ref: 00421A38
SysFreeString.OLEAUT32(00000000), ref: 00421A49

Strings

`<u, xrefs: 00421A49

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Variant$Clear$_com_issue_errorex$DecrementFreeInitInterlockedString_memcpy_s
String ID: `<u
API String ID: 1941946245-3367579956
Opcode ID: bc07eee50946c7b000bd0bd583ca5ccae899a6d8db96993da8dd510e9be42310
Instruction ID: e09090a0f91a8e928f4393dd755fb194ff545edc0bef270e88668ddd989f91e3
Opcode Fuzzy Hash: bc07eee50946c7b000bd0bd583ca5ccae899a6d8db96993da8dd510e9be42310
Instruction Fuzzy Hash: E011A1716043859BD720EB71D844B9BB7ACAF94704F44491EF54983201EB38E504CBAA

Function 02328098 Relevance: 9.2, APIs: 6, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

ippsMalloc_8u.IPPSW7(?,?,?,?,?,00000000,?,00000000,02324F77,00000000,?,00000000,?), ref: 023280DA
ippsMalloc_8u.IPPSW7(00000000,?,?,?,?,00000000,?,00000000,02324F77,00000000,?,00000000,?), ref: 023280FC
ippsFree.IPPSW7(?,?,?,?,?,00000000,?,00000000,02324F77,00000000,?,00000000,?), ref: 023281A0
ippsFFTInitAlloc_C_32fc.IPPSW7(?,00000000,00000008,00000000,?,?,?,?,?,?,?,00000000,?,00000000,02324F77,00000000), ref: 023282C4
ippsFFTFwd_CToC_32fc.IPPSW7(?,?,?,00000000,?,00000000,00000008,00000000,?,?,?,?,?,?,?,00000000), ref: 023282DF
ippsFFTGetBufSize_C_32fc.IPPSW7(?,00000000,?,?,?,00000000,?,00000000,00000008,00000000), ref: 0232831F

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$C_32fc$Malloc_8u$Alloc_FreeFwd_InitSize_
String ID:
API String ID: 2705029650-0
Opcode ID: c78c61d12034f6e0f12ee22d920b1b088bd9af7032412cf48a1cb8d9bf9bcab2
Instruction ID: 95b6c845784b8927ca8b8d19455c8a503727eacc8390e03d6b1e686f83bdc220
Opcode Fuzzy Hash: c78c61d12034f6e0f12ee22d920b1b088bd9af7032412cf48a1cb8d9bf9bcab2
Instruction Fuzzy Hash: 2591A87590571A8FC720CF18C88095AF7E5FF88314F548A6EE98497345E732FA298BA1

Function 00408620 Relevance: 9.2, APIs: 6, Instructions: 235stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00495DF0,7EE0FD72,?,?,?,?,?,?,00000000,0046E658,000000FF), ref: 0040867D
GetModuleFileNameA.KERNEL32(00400000,00495D64,00000104,?,?,?,00000000,0046E658,000000FF), ref: 00408701
lstrlenA.KERNEL32(?,?,?,?,00000000,0046E658,000000FF), ref: 00408725
LoadTypeLib.OLEAUT32(00000000,?), ref: 004087A0

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CriticalEnterFileLoadModuleNameSectionTypelstrlen
String ID:
API String ID: 4054831426-0
Opcode ID: 34de3e023341d99634d2475d87b27591b4e9c4cb2b44d48ab6b804b16fad09de
Instruction ID: 1627417e2c2121431c3d8563cb2e7280cee409840ccd17aff71a11d1a09824cd
Opcode Fuzzy Hash: 34de3e023341d99634d2475d87b27591b4e9c4cb2b44d48ab6b804b16fad09de
Instruction Fuzzy Hash: DF91A175A002059FCB10EFA4CD84EAFB7B5EF98304F64857EE545A7390DA38AD41CB64

Function 022F40E4 Relevance: 9.2, APIs: 6, Instructions: 175memoryCOMMON

Download Yara Rule

APIs

ippsZero_64f.IPPSW7(?,?), ref: 022F414B
ippsFFTInitAlloc_R_64f.IPPSW7(00000000,00000000,00000002,00000000), ref: 022F41A2
ippsFFTGetBufSize_R_64f.IPPSW7(00000000,00000000,00000000,00000000,00000002,00000000), ref: 022F41BE
ippsMalloc_64s.IPPSW7(00000002,00000000,00000000,00000000,00000000,00000002,00000000), ref: 022F41DF
ippsCopy_64f.IPPSW7(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,00000002), ref: 022F424F
ippsFree.IPPSW7(00000000,?,00000000,00000000,00000000,00000000,00000002,00000000), ref: 022F4287

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$R_64f$Alloc_Copy_64fFreeInitMalloc_64sSize_Zero_64f
String ID:
API String ID: 3605931290-0
Opcode ID: a3302239eeaca9c5e8f97bda836b0c027352abae5e46f910143ead62c67fa5f5
Instruction ID: f0194feef4a324c1eff9234af4e7d0e93e40da3565327e5b924cf4b1d4e4b461
Opcode Fuzzy Hash: a3302239eeaca9c5e8f97bda836b0c027352abae5e46f910143ead62c67fa5f5
Instruction Fuzzy Hash: AF51C5726143056BD750FAA8CC80E6BF7AAEFC0754F54CA3DF65447248DAB5E801CBA1

Function 004624FA Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00462522

Part of subcall function 0045A9BF: __getptd.LIBCMT ref: 0045A9CD
Part of subcall function 0045A9BF: __getptd.LIBCMT ref: 0045A9DB

__getptd.LIBCMT ref: 0046252C

Part of subcall function 0045D8AC: __getptd_noexit.LIBCMT ref: 0045D8AF
Part of subcall function 0045D8AC: __amsg_exit.LIBCMT ref: 0045D8BC

__getptd.LIBCMT ref: 0046253A
__getptd.LIBCMT ref: 00462548
__getptd.LIBCMT ref: 00462553
_CallCatchBlock2.LIBCMT ref: 00462579

Part of subcall function 0045AA64: __CallSettingFrame@12.LIBCMT ref: 0045AAB0

Part of subcall function 00462620: __getptd.LIBCMT ref: 0046262F
Part of subcall function 00462620: __getptd.LIBCMT ref: 0046263D

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 2cf7474dde691414ff188c11d53633e8bc678d47ea202ef8f9c4bfa846b8fb45
Instruction ID: dc6e921857d4a4615b14c37950a8abe277740d51c1e52c2c43f6c26405c85841
Opcode Fuzzy Hash: 2cf7474dde691414ff188c11d53633e8bc678d47ea202ef8f9c4bfa846b8fb45
Instruction Fuzzy Hash: 541107B5C00309EFDB00EFA5C546AAD7BB0FF08315F14846AF814A7252DB389A159F59

Function 0044AD10 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 250memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Station Summary), ref: 0044AD4D
VariantClear.OLEAUT32(?), ref: 0044ADE4
_com_issue_errorex.COMSUPP ref: 0044AE18

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 00402B00: SysAllocString.OLEAUT32(?), ref: 00402B55

Part of subcall function 00445DD0: SysAllocString.OLEAUT32 ref: 00445E10
Part of subcall function 00445DD0: VariantClear.OLEAUT32(?), ref: 00445EAE
Part of subcall function 00445DD0: _com_issue_errorex.COMSUPP ref: 00445EDE

Part of subcall function 00449C90: SysAllocString.OLEAUT32(Station Summary), ref: 00449CDA
Part of subcall function 00449C90: VariantClear.OLEAUT32(?), ref: 00449D81
Part of subcall function 00449C90: _com_issue_errorex.COMSUPP ref: 00449DB1

Part of subcall function 00445DD0: VariantClear.OLEAUT32(?), ref: 00445F22
Part of subcall function 00445DD0: InterlockedIncrement.KERNEL32(?), ref: 00445F3D

Part of subcall function 00449C90: _com_issue_errorex.COMSUPP ref: 00449E48
Part of subcall function 00449C90: SysAllocString.OLEAUT32(Method), ref: 00449E5C
Part of subcall function 00449C90: VariantClear.OLEAUT32(?), ref: 00449E9A
Part of subcall function 00449C90: SysAllocString.OLEAUT32(Velocity), ref: 00449EAB
Part of subcall function 00449C90: VariantClear.OLEAUT32(?), ref: 00449EEB

Strings

Station Summary, xrefs: 0044AD43
CorrectionFactor, xrefs: 0044AE6A, 0044AEB5, 0044AF08, 0044AF44, 0044AF93

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$AllocClearVariant$_com_issue_errorex$ConvertIncrementInterlocked_com_util::
String ID: CorrectionFactor$Station Summary
API String ID: 1301997180-3751505898
Opcode ID: c0bd39ec1d6f01b2d2ff3affc24f92f6e3ad89ae32e645037a652f7832e6123e
Instruction ID: ef387336d60c2099e09c12800ddb9baa1f81adb07b8ca66f4c4b740fbc1fe1df
Opcode Fuzzy Hash: c0bd39ec1d6f01b2d2ff3affc24f92f6e3ad89ae32e645037a652f7832e6123e
Instruction Fuzzy Hash: 8D91C2B02087009BD705EB69C886A1FBBE9EFC9B18F10494EF18953391CB789815C76F

Function 00410880 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 174comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004793B8,00000000,00000017,00477D48,?,7EE0FD72), ref: 004108C5
OleRun.OLE32(?), ref: 004108D4
_com_issue_errorex.COMSUPP ref: 00410A61

Strings

Application, xrefs: 00410941
DataSession[%02d], xrefs: 004109AB

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CreateInstance_com_issue_errorex
String ID: Application$DataSession[%02d]
API String ID: 1847152134-4106691850
Opcode ID: b403970bdb61c3010963ab3cfd201708ba5db8ba212ae4ce48b6e459809e58d5
Instruction ID: 4c61271f561a592c38246f4e2b1ddfd09c81967bc99107a4626dfe813143b440
Opcode Fuzzy Hash: b403970bdb61c3010963ab3cfd201708ba5db8ba212ae4ce48b6e459809e58d5
Instruction Fuzzy Hash: A351A0712043419FD310DF69C881F5BB7E8FF98354F14462EF89997291CB789885CBAA

Function 0044E1D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0044E357

Strings

,%.1f, xrefs: 0044E2D5
%.1f,%.1f, xrefs: 0044E2A6
HighSnrBeamDifference, xrefs: 0044E364

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: IncrementInterlocked
String ID: %.1f,%.1f$,%.1f$HighSnrBeamDifference
API String ID: 3508698243-569639253
Opcode ID: 16fe75eedeaaf7239be3bfc398db5b854532e4fb99400bcb95a22c27f71b15b0
Instruction ID: 05b35ea97f63b665f20ccffd2fa23e43c66e65ec23e52c5813ad195e053f00c4
Opcode Fuzzy Hash: 16fe75eedeaaf7239be3bfc398db5b854532e4fb99400bcb95a22c27f71b15b0
Instruction Fuzzy Hash: 75511971518741DBD724EF65C849B9BB7E4FF98304F004A6EF4C953281DB78A508CB9A

Function 0041BE20 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0041BFA7

Strings

,%.1f, xrefs: 0041BF25
%.1f,%.1f, xrefs: 0041BEF6
HighSnrBeamDifference, xrefs: 0041BFB4

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: IncrementInterlocked
String ID: %.1f,%.1f$,%.1f$HighSnrBeamDifference
API String ID: 3508698243-569639253
Opcode ID: f931e5d1eb372ed4dd10267f970fd34e21549316483a1433e4fe3e9085af88e6
Instruction ID: 2961f7a5ce9c37ac63d680d0770d97050c85a22b72d2aae8a60b74bdeaeb44d7
Opcode Fuzzy Hash: f931e5d1eb372ed4dd10267f970fd34e21549316483a1433e4fe3e9085af88e6
Instruction Fuzzy Hash: 1551E371518741DBC724EF65C949A9BBBE4FF98304F004A2EF1C943291DB38A848CB9A

Function 0044CBD0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Station Summary), ref: 0044CC1A
VariantClear.OLEAUT32(?), ref: 0044CCAF
_com_issue_errorex.COMSUPP ref: 0044CCE4

Strings

Station Summary, xrefs: 0044CC0C
Method, xrefs: 0044CD06

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: AllocClearStringVariant_com_issue_errorex
String ID: Method$Station Summary
API String ID: 1026948375-765981908
Opcode ID: 279f8b04f3b15a40a29b4cab49bb673c95cdc436d299a0484c6caa923167684c
Instruction ID: da8a3ef73cf255e537e186a2233dbccc1db352a19fdfa81a5a69e602404cb643
Opcode Fuzzy Hash: 279f8b04f3b15a40a29b4cab49bb673c95cdc436d299a0484c6caa923167684c
Instruction Fuzzy Hash: 6851CE70108304EFD311DF65C885A1FB7E8EBC8704F148A5EF99997291CB78D846CB9A

Function 004136E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 0041372D
GetModuleFileNameA.KERNEL32(00400000,?,00000208,7EE0FD72), ref: 0041374E
SysStringByteLen.OLEAUT32(?), ref: 00413818
SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 00413822

Strings

0`I, xrefs: 0041373B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Byte$AllocFileModuleName
String ID: 0`I
API String ID: 797632172-2983702033
Opcode ID: 805b0ff2ab4295706694536d482d47a007459ac165c0ff0e4cf75da8a27c66ab
Instruction ID: feb2cf3e220d3543b595ec912037810f38ca9fb44cdc54d3e08cdfd4b7d90b25
Opcode Fuzzy Hash: 805b0ff2ab4295706694536d482d47a007459ac165c0ff0e4cf75da8a27c66ab
Instruction Fuzzy Hash: 17418A71204341AFD320DF69C885BABB7E8AF94321F004A2EF465C72D1DB38E945CB95

Function 004142C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 96comCOMMON

Download Yara Rule

APIs

Part of subcall function 00401E30: CreateFileA.KERNEL32(\\.\mailslot\SontekObjectTrack,40000000,00000003,00000000,00000003,00000080,00000000,00404F54), ref: 00401E9C
Part of subcall function 00401E30: WriteFile.KERNEL32(FFFFFFFF,?,?,?,00000000,00404F54), ref: 00401EB6

Part of subcall function 0041E230: CoCreateInstance.OLE32(00479EEC,00000000,00000017,00477D48,7EE0FD72), ref: 0041E28F
Part of subcall function 0041E230: OleRun.OLE32(7EE0FD72), ref: 0041E29E

Part of subcall function 00401660: InitializeCriticalSection.KERNEL32(?,7EE0FD72), ref: 004016A0

CoCreateInstance.OLE32(004794F4,00000000,00000017,00477D48,7EE0FD72), ref: 00414388
OleRun.OLE32(7EE0FD72), ref: 00414397

Strings

FlowTrackerExport.Application, xrefs: 004142ED
0~G, xrefs: 004142F5
T~G, xrefs: 00414307

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Create$FileInstance$CriticalInitializeSectionWrite
String ID: 0~G$FlowTrackerExport.Application$T~G
API String ID: 2364698156-3699296529
Opcode ID: d919a84bcbdb20497affdef7e7a43893fa0c7a28b6f7d731093a98e514615eab
Instruction ID: 9fab6a73f55a6c4203f1b60d5edbd4584a0f23e264e4e9810b1aef863b6655fe
Opcode Fuzzy Hash: d919a84bcbdb20497affdef7e7a43893fa0c7a28b6f7d731093a98e514615eab
Instruction Fuzzy Hash: CA3170B0504B008FC320DF1AC980A57FBE8EF99B14F108A5FE89A83750D7B5A848CB65

Function 004106B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_com_util::ConvertStringToBSTR.COMSUPP ref: 00410709
VariantClear.OLEAUT32(?), ref: 00410740
VariantClear.OLEAUT32(?), ref: 00410747

Strings

UnitSystem, xrefs: 004106F6
Units, xrefs: 004106D2

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$ConvertString_com_util::
String ID: UnitSystem$Units
API String ID: 1565985208-3616490888
Opcode ID: 84ebce0d8544f5b0b28c6e3795afa3394d8336f21c1643822d6696bdd106fba5
Instruction ID: 1bd688f36ab7b6d0e40e47e415335ac48bebef9737a46d5035870013f7a661a9
Opcode Fuzzy Hash: 84ebce0d8544f5b0b28c6e3795afa3394d8336f21c1643822d6696bdd106fba5
Instruction Fuzzy Hash: D2116D72618311ABC614EB65C84199FB3A8BFD8714F00491EF984A7281DB38ED09C7EA

Function 0040E1D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ADF0: InterlockedDecrement.KERNEL32(?), ref: 0040AE51
Part of subcall function 0040ADF0: SysFreeString.OLEAUT32(00000000), ref: 0040AE62

SysStringByteLen.OLEAUT32 ref: 0040E1F0
SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 0040E1FA
InterlockedDecrement.KERNEL32(?), ref: 0040E228
SysFreeString.OLEAUT32(00000000), ref: 0040E23D

Strings

`<u, xrefs: 0040E23D

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$ByteDecrementFreeInterlocked$Alloc
String ID: `<u
API String ID: 1409386706-3367579956
Opcode ID: 1b0b673d1d4d31fba18facbac7edafee63f52af178a7724dcb52760e751b39c2
Instruction ID: cf53e9da5fed87c198b1d62f76c050db682f5d425343f9cabce8eaac63ce604f
Opcode Fuzzy Hash: 1b0b673d1d4d31fba18facbac7edafee63f52af178a7724dcb52760e751b39c2
Instruction Fuzzy Hash: 7A01AD716043029BDB24AB72DD45A2B73DCAF8434170449BEBC4AE3381EB38DD90C699

Function 00403640 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_com_util::ConvertStringToBSTR.COMSUPP ref: 00403663
VariantClear.OLEAUT32(?), ref: 004036B4
VariantClear.OLEAUT32(?), ref: 004036CB
VariantClear.OLEAUT32(?), ref: 004036D2

Strings

AdminMode, xrefs: 0040364F

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClearVariant$ConvertString_com_util::
String ID: AdminMode
API String ID: 1565985208-2388992185
Opcode ID: 6048b1b98f1d97c59bff2ead68cda6e90841015696bff7fbb364cbd62f12ea10
Instruction ID: 864f030cff04e1b39ee3fecf511e03da886e790479b40ddf16a67289e3e3a1c7
Opcode Fuzzy Hash: 6048b1b98f1d97c59bff2ead68cda6e90841015696bff7fbb364cbd62f12ea10
Instruction Fuzzy Hash: B2117076608300ABC704EF65C88099B77E8AFC8304F008D2FF985D7255EA38D909CB9A

Function 0045D56F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0045D57B

Part of subcall function 0045D8AC: __getptd_noexit.LIBCMT ref: 0045D8AF
Part of subcall function 0045D8AC: __amsg_exit.LIBCMT ref: 0045D8BC

__getptd.LIBCMT ref: 0045D592
__amsg_exit.LIBCMT ref: 0045D5A0
__lock.LIBCMT ref: 0045D5B0

Strings

MI, xrefs: 0045D5BD

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: MI
API String ID: 3521780317-2379962254
Opcode ID: f3ca82fe9947f3cb4be9b9d22240adc8a3f7f7692a7c8878742a7f45f5c9b680
Instruction ID: 8aad0ce35775f72b24f7089a628c98bb3349331df90e5f776cded9d70ef7e92a
Opcode Fuzzy Hash: f3ca82fe9947f3cb4be9b9d22240adc8a3f7f7692a7c8878742a7f45f5c9b680
Instruction Fuzzy Hash: 92F04932E01718EBD630BB768402B4D73A06F4472AF14026FAC11972D3DB2C9A09CA6E

Function 00462249 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00462263

Part of subcall function 0045D8AC: __getptd_noexit.LIBCMT ref: 0045D8AF
Part of subcall function 0045D8AC: __amsg_exit.LIBCMT ref: 0045D8BC

__getptd.LIBCMT ref: 00462274
__getptd.LIBCMT ref: 00462282

Strings

MOC, xrefs: 00462255
csm, xrefs: 0046225C

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 716c62ce533dfaa624a0825e0610c3f27ee07dfc9810feca372ca1f4ede27466
Instruction ID: f1d0f53c08c5c95d405bda3dd3debdaed618a455de9bfda48a2d7b6cb4249e1f
Opcode Fuzzy Hash: 716c62ce533dfaa624a0825e0610c3f27ee07dfc9810feca372ca1f4ede27466
Instruction Fuzzy Hash: BAE04F35510504AFDB20BBA9C146B6933A4EF49329F1901E7EC0CC7323E77CD848954B

Function 0234A180 Relevance: 7.7, APIs: 5, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7730fe0f08522b3260feda09db96c8dae1e2c2c563e2372b9d5a6232f51be0d4
Instruction ID: e4ca36227b8eb21a92d5b96a2744e5d16bc491e724df6129c6af7e8ee9b39145
Opcode Fuzzy Hash: 7730fe0f08522b3260feda09db96c8dae1e2c2c563e2372b9d5a6232f51be0d4
Instruction Fuzzy Hash: 4181CB36604309ABC720DF69D88096BB3EAEFC8714F508A5EFC9547365E735E841CB91

Function 0235825C Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

__kmpc_master.LIBGUIDE40(024E1CC4,?,023580AE,?,024F58A4,?,?,?,?,?,?,?,?,?,?,?), ref: 023582A9
omp_get_num_threads.LIBGUIDE40(?,?,023580AE,?,024F58A4,?,?,?,?,?,?,?,?,?,?,?), ref: 023582BA
mptxms.LIBGUIDE40(024E1CC4,?,?,?,023580AE,?,024F58A4,?,?,?,?,?,?,?,?,?), ref: 02358387
__kmpc_barrier.LIBGUIDE40(024E1CB0,?,?,?,023580AE,?,024F58A4,?,?,?,?,?,?,?,?,?), ref: 02358399
omp_get_thread_num.LIBGUIDE40(?,?,?,?,023580AE,?,024F58A4,?,?,?,?,?,?,?,?,?), ref: 023583A1

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: __kmpc_barrier__kmpc_mastermptxmsomp_get_num_threadsomp_get_thread_num
String ID:
API String ID: 1197496998-0
Opcode ID: 84bc35094c43a8f8dfd6c9c0ba7dba9745e167693f8109bc20b75bfe96df3b30
Instruction ID: 760c206afbe56a13335e93087afd668cc5963069691cf88cc99f80852a1a0c01
Opcode Fuzzy Hash: 84bc35094c43a8f8dfd6c9c0ba7dba9745e167693f8109bc20b75bfe96df3b30
Instruction Fuzzy Hash: 7C51D0392083449FD764DF18C880B9ABBE6FFCA310F218959EA8C8B315D731A845CF52

Function 0237233B Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

__kmpc_master.LIBGUIDE40(024E471C,?,?,023721A2,?,024F5904,?,?,?,?,?,?,?,?,?,?), ref: 02372387
omp_get_num_threads.LIBGUIDE40(?,?,?,023721A2,?,024F5904,?,?,?,?,?,?,?,?,?,?), ref: 02372398
mptxms.LIBGUIDE40(024E471C,?,?,?,?,023721A2,?,024F5904,?,?,?,?,?,?,?,?), ref: 02372465
__kmpc_barrier.LIBGUIDE40(024E4708,?,?,?,?,023721A2,?,024F5904,?,?,?,?,?,?,?,?), ref: 02372477
omp_get_thread_num.LIBGUIDE40(?,?,?,?,?,023721A2,?,024F5904,?,?,?,?,?,?,?,?), ref: 0237247F

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: __kmpc_barrier__kmpc_mastermptxmsomp_get_num_threadsomp_get_thread_num
String ID:
API String ID: 1197496998-0
Opcode ID: 6cf6e608054a965259284a06665f7c9152cb4ed3bdd5652980f28f7003b9c3fb
Instruction ID: 9b2070ba0e4b6b298a378d0cbc69415b177a833b38c5efbb9de2ffbb4e61ddd2
Opcode Fuzzy Hash: 6cf6e608054a965259284a06665f7c9152cb4ed3bdd5652980f28f7003b9c3fb
Instruction Fuzzy Hash: CF51DE792083459FD764DF18C880B9AB7E6FF8A314F20896DE9898B311DB31A854CF52

Function 023863A5 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

__kmpc_master.LIBGUIDE40(024E637C,?,?,02386216,?,024F5944,?,?,?,?,?,?,?,?,?,?), ref: 023863F1
omp_get_num_threads.LIBGUIDE40(?,?,?,02386216,?,024F5944,?,?,?,?,?,?,?,?,?,?), ref: 02386402
mptxms.LIBGUIDE40(024E637C,?,?,?,?,02386216,?,024F5944,?,?,?,?,?,?,?,?), ref: 023864CF
__kmpc_barrier.LIBGUIDE40(024E6368,?,?,?,?,02386216,?,024F5944,?,?,?,?,?,?,?,?), ref: 023864E1
omp_get_thread_num.LIBGUIDE40(?,?,?,?,?,02386216,?,024F5944,?,?,?,?,?,?,?,?), ref: 023864E9

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: __kmpc_barrier__kmpc_mastermptxmsomp_get_num_threadsomp_get_thread_num
String ID:
API String ID: 1197496998-0
Opcode ID: 610ce114315704d197f089302de53be1ab463e00bd330f09b0cf168f6e074db0
Instruction ID: 5f0a18149eb780ef6a7e98b147de798071f7b06d21a729ec3c0507fbebe9fecf
Opcode Fuzzy Hash: 610ce114315704d197f089302de53be1ab463e00bd330f09b0cf168f6e074db0
Instruction Fuzzy Hash: 6151C1792083459FD764DF18C880B9AB7E6FF8A314F11886DE98D8B315DB31A854CF52

Function 023646E3 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

__kmpc_master.LIBGUIDE40(024E3AC8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02364746
omp_get_num_threads.LIBGUIDE40(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02364753
mptxms.LIBGUIDE40(024E3AC8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 023647C1
__kmpc_barrier.LIBGUIDE40(024E3AB4,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 023647CF
omp_get_thread_num.LIBGUIDE40(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 023647D7

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: __kmpc_barrier__kmpc_mastermptxmsomp_get_num_threadsomp_get_thread_num
String ID:
API String ID: 1197496998-0
Opcode ID: dd07fafce1254168251f75f55c2147a5d73e18ef65ffda737bfad58549d8e5c0
Instruction ID: 4a36caaeec8e3f64dda6c2ab5ee7332095efe9333e746edf29547b0a9f5d0f10
Opcode Fuzzy Hash: dd07fafce1254168251f75f55c2147a5d73e18ef65ffda737bfad58549d8e5c0
Instruction Fuzzy Hash: 5041EA79648741DFC360DF19C880A5AB7E5FFCE710F258959E9988B324D730A845CF92

Function 0235E261 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__kmpc_master.LIBGUIDE40(024E2920,?,?,024F58C0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235E2B3
omp_get_num_threads.LIBGUIDE40(?,?,?,024F58C0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0235E2C4
mptxms.LIBGUIDE40(024E2920,?,?,?,?,024F58C0,?,?,?,?,?,?,?,?,?,?), ref: 0235E33D
__kmpc_barrier.LIBGUIDE40(024E290C,?,?,?,?,024F58C0,?,?,?,?,?,?,?,?,?,?), ref: 0235E34B
omp_get_thread_num.LIBGUIDE40(?,?,?,?,?,024F58C0,?,?,?,?,?,?,?,?,?,?), ref: 0235E353

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: __kmpc_barrier__kmpc_mastermptxmsomp_get_num_threadsomp_get_thread_num
String ID:
API String ID: 1197496998-0
Opcode ID: 04fafb5e0dd0245de8ba32c83e6ae2361a836c84aa4c05e0138aaea4d3ce728c
Instruction ID: 412df0d0fe293c5c5693b8b2b39fc57f2309327c01776e23181f0a63847d0800
Opcode Fuzzy Hash: 04fafb5e0dd0245de8ba32c83e6ae2361a836c84aa4c05e0138aaea4d3ce728c
Instruction Fuzzy Hash: 7C410879648741DFD364DF29C880A5AB7E9FFCA310F20895DE9998B324D630A841CF52

Function 00402CA0 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 00402CCD
SysStringLen.OLEAUT32(?), ref: 00402CE6
SysAllocStringByteLen.OLEAUT32(00000000), ref: 00402D18
_memcpy_s.LIBCMT ref: 00402D51
_memcpy_s.LIBCMT ref: 00402D7A

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$_memcpy_s$AllocByte
String ID:
API String ID: 3263500483-0
Opcode ID: e522209e926445d0fa5ce29652273fe825eef3e84160c011cea1bb4af4fcab74
Instruction ID: 43dfbba4c9e89eafdb458b893f2c0e0507fcaadbd5dca2e03429a89ac6220c10
Opcode Fuzzy Hash: e522209e926445d0fa5ce29652273fe825eef3e84160c011cea1bb4af4fcab74
Instruction Fuzzy Hash: F531D371605306ABE714DE59C988A6B73A8AF85314F24446FBC01EB3D1D7B9DC00CBA8

Function 00409F40 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 00409FAB
InterlockedDecrement.KERNEL32(?), ref: 00409FC8
SysFreeString.OLEAUT32(00000000), ref: 00409FD9
InterlockedDecrement.KERNEL32(?), ref: 0040A008
SysFreeString.OLEAUT32(00000000), ref: 0040A019

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString$_com_issue_errorex
String ID:
API String ID: 2158521109-0
Opcode ID: 415efdfbaa90877e63044031befb5c008467806ab0cfb6bbd9a4507ffc462143
Instruction ID: 25a7bd03414939a9faf502c56e41fc6fcbb64fb60ef19d4786c1c5177237428a
Opcode Fuzzy Hash: 415efdfbaa90877e63044031befb5c008467806ab0cfb6bbd9a4507ffc462143
Instruction Fuzzy Hash: 743150716057029BD720DF16DC50F57B3E8AF89B54F04092EF845E7381E738ED058AAA

Function 0045ABFC Relevance: 7.6, APIs: 5, Instructions: 101COMMON

Download Yara Rule

APIs

GetFullPathNameA.KERNEL32(?,00000000,00000000,00000000), ref: 0045AC2A
GetLastError.KERNEL32 ref: 0045AC30
__dosmaperr.LIBCMT ref: 0045AC37
_calloc.LIBCMT ref: 0045AC66
GetFullPathNameA.KERNEL32(?,?,?,?), ref: 0045ACB3

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr_calloc
String ID:
API String ID: 3920351113-0
Opcode ID: 555c612d2606124843067bf75f00ae68f1bb50d197ed7970752a43ce527c4ebc
Instruction ID: b3a3fbdeec4090e2315a634c185e48118df8d9dc4c10aed9567fe7359f2cf0a1
Opcode Fuzzy Hash: 555c612d2606124843067bf75f00ae68f1bb50d197ed7970752a43ce527c4ebc
Instruction Fuzzy Hash: C8312472404145BFDF22BF64CC8146F37A6EB44316B20022BFC0087242E6399D5D976F

Function 00406BE0 Relevance: 7.6, APIs: 5, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,004078C9,?,00000003,7EE0FD72), ref: 00406BF6
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,?,00000000,00000000,7EE0FD72), ref: 00406C2A
GetLastError.KERNEL32(?,00000000,00000000,7EE0FD72), ref: 00406C3B
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,00000000,00000000,00000000,?,00000000,00000000,7EE0FD72), ref: 00406C57
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,00000000,00000000,00000000,?,?,00000000,00000000,7EE0FD72), ref: 00406C83

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: 2f620eb3fa32440dadf96dcb11f4b735a29249b3694d54ce1ee4dac7d6b5ce94
Instruction ID: f7cd5c13b2c72cbd6c599b8413194112c71c8b813e76b083c97626dd93c7f526
Opcode Fuzzy Hash: 2f620eb3fa32440dadf96dcb11f4b735a29249b3694d54ce1ee4dac7d6b5ce94
Instruction Fuzzy Hash: 192106712402247BE3309B15CC89F273B6CEF82B94F154569FA4ABA2C1CA75BC10C6F9

Function 004029C0 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 004029D9
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00402A01
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00402A12
TranslateMessage.USER32(?), ref: 00402A2F
DispatchMessageA.USER32(?), ref: 00402A36

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 00c721832f5434638ab0de269cd11e3de2bc7b098f09c5884099cc505b62b58b
Instruction ID: 036a61691bf5329ee5fc0c5801154d2b0faf9d09e5cde46268377e990bbfa2d2
Opcode Fuzzy Hash: 00c721832f5434638ab0de269cd11e3de2bc7b098f09c5884099cc505b62b58b
Instruction Fuzzy Hash: F811C131340201A7E7305A649E8DF6B7758EF45740F244173F615FA2D0DBF8E9429AAD

Function 0045CE03 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0045CE0F

Part of subcall function 0045D8AC: __getptd_noexit.LIBCMT ref: 0045D8AF
Part of subcall function 0045D8AC: __amsg_exit.LIBCMT ref: 0045D8BC

__amsg_exit.LIBCMT ref: 0045CE2F
__lock.LIBCMT ref: 0045CE3F
InterlockedDecrement.KERNEL32(?), ref: 0045CE5C
InterlockedIncrement.KERNEL32(02CB15D8), ref: 0045CE87

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 640b887e47e7108f52102e554edcccf4e99b0577f88d25f870aa70b563e18b90
Instruction ID: b685f200e1a4d2598ca75980253da671ea95338cbe5490496d1d1e50164fa628
Opcode Fuzzy Hash: 640b887e47e7108f52102e554edcccf4e99b0577f88d25f870aa70b563e18b90
Instruction Fuzzy Hash: 4101C831D02711AFC720AB25D446B5E77606F44B26F15006BEC1467793C73C698ACBED

Function 00459AD6 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00459AF4

Part of subcall function 0045DDC4: __mtinitlocknum.LIBCMT ref: 0045DDDA
Part of subcall function 0045DDC4: __amsg_exit.LIBCMT ref: 0045DDE6
Part of subcall function 0045DDC4: EnterCriticalSection.KERNEL32(?,?,?,004634E9,00000004,0048E2A8,0000000C,00463974,0045A609,?,00000000,00000000,00000000,?,0045D85E,00000001), ref: 0045DDEE

___sbh_find_block.LIBCMT ref: 00459AFF
___sbh_free_block.LIBCMT ref: 00459B0E
HeapFree.KERNEL32(00000000,0045A609,0048DED0,0000000C,0045DDA5,00000000,0048E048,0000000C,0045DDDF,0045A609,?,?,004634E9,00000004,0048E2A8,0000000C), ref: 00459B3E
GetLastError.KERNEL32(?,004634E9,00000004,0048E2A8,0000000C,00463974,0045A609,?,00000000,00000000,00000000,?,0045D85E,00000001,00000214), ref: 00459B4F

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: f0c25e28f912bbf7e12860e4530c55c676f1b2a9c3892999e5a1298af756cbf2
Instruction ID: a57aa25cd4a7f458aced83ff868927cbfb3755929e17d0fe755ac2c3d8119b5f
Opcode Fuzzy Hash: f0c25e28f912bbf7e12860e4530c55c676f1b2a9c3892999e5a1298af756cbf2
Instruction Fuzzy Hash: 53012131D05205EAEF356F71AC0AB5E3B65EF10326F10416BFC04AA193DB7DA9488A5C

Function 0040BFE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040C066
VariantClear.OLEAUT32(?), ref: 0040C0AF
_com_issue_errorex.COMSUPP ref: 0040C160

Strings

`<u, xrefs: 0040BF31

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: _com_issue_errorex$ClearVariant
String ID: `<u
API String ID: 4062025808-3367579956
Opcode ID: 06e822ecd839acbb5baecd851beefdbf0e82fec3fbe6271264dc86f67c7ca1fb
Instruction ID: 6a393751a2609617e24b7a39f9c9262bd964b188ce541d2fc7f6e641abaac35d
Opcode Fuzzy Hash: 06e822ecd839acbb5baecd851beefdbf0e82fec3fbe6271264dc86f67c7ca1fb
Instruction Fuzzy Hash: 5A716875208340DFC310DFA9C880A1BBBE9AFC9704F144A5EF58997391D779E846CBA6

Function 0235A00C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

ippsZero_64fc.IPPSW7(?,?), ref: 0235A267
ippsZero_64f.IPPSW7(?,?), ref: 0235A287

Strings

02IF, xrefs: 0235A16F
81IF, xrefs: 0235A025

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Zero_64fZero_64fc
String ID: 02IF$81IF
API String ID: 2795594376-2637274979
Opcode ID: 7c265c460e2adee69aa9ba0a5edc3c76e177837241e4a88a84add0baa51a52b5
Instruction ID: d5f2d3a4dc991b3e5819f677ee41c92c2aa4b638ac8e4f47e303d05aec3118f2
Opcode Fuzzy Hash: 7c265c460e2adee69aa9ba0a5edc3c76e177837241e4a88a84add0baa51a52b5
Instruction Fuzzy Hash: 0181DF35408B1A8BC720EF48DC4006AFBA5FF45369F248B5DDC994B256D732B662DB81

Function 02326670 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

\SML, xrefs: 02326688

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID:
String ID: \SML
API String ID: 0-4107846428
Opcode ID: 440338cddfaf7d43a6267a3a4ddd2d76ec20863d8dfbac1c7cace5c0c9cae70c
Instruction ID: ad96d0466efd08e3518fc47d86bae37c3090f445e63e606293ec63e6ec5a856c
Opcode Fuzzy Hash: 440338cddfaf7d43a6267a3a4ddd2d76ec20863d8dfbac1c7cace5c0c9cae70c
Instruction Fuzzy Hash: 2751B5726042245BDB20DE1DECC1E2BB76EEFD5A14F188659F8145B249DB32D8098FE1

Function 0236032C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

ippsZero_64fc.IPPSW7(?,?), ref: 02360523
ippsZero_8u.IPPSW7(?,?), ref: 0236054A

Strings

42IF, xrefs: 02360435
22IF, xrefs: 0236033E

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Zero_64fcZero_8u
String ID: 22IF$42IF
API String ID: 3480446401-4216829444
Opcode ID: ffd5850e8234af4e4c53131f4d484d4ff016f5e6c3f064ae8616d859a7b5cdc9
Instruction ID: fbf713d8d4975fca60bc9bdd5c48a3f83227d2cedd94943f20ab32c9b3d16f03
Opcode Fuzzy Hash: ffd5850e8234af4e4c53131f4d484d4ff016f5e6c3f064ae8616d859a7b5cdc9
Instruction Fuzzy Hash: 8B610131604B058FCB25CF0CC884569F3A6FF853647598B6DCC524B25AD331B865CFA0

Function 00404240 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00404363
SysStringLen.OLEAUT32(00000000), ref: 0040436E
SysFreeString.OLEAUT32(00000000), ref: 00404399

Strings

`<u, xrefs: 00404363, 00404399

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$Free
String ID: `<u
API String ID: 1391021980-3367579956
Opcode ID: 6d54b47acd399858279c9df5c376f7a4a807145d05e0eee137d4ba2b5a79d9cf
Instruction ID: c3fd6112bd9105a0e3368ac024b25613697fe48fa156f68a91fce3dd8e741cd4
Opcode Fuzzy Hash: 6d54b47acd399858279c9df5c376f7a4a807145d05e0eee137d4ba2b5a79d9cf
Instruction Fuzzy Hash: B35144B5A00605DFDB04DF95C880AAEB7F9FF88310F10866EE915E7390D734A941CBA4

Function 0043D3E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Station Summary), ref: 0043D41D
VariantClear.OLEAUT32(?), ref: 0043D4C0
_com_issue_errorex.COMSUPP ref: 0043D518

Strings

Station Summary, xrefs: 0043D413

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: AllocClearStringVariant_com_issue_errorex
String ID: Station Summary
API String ID: 1026948375-3045476099
Opcode ID: 56b09ab75f6d657f2a4e664c152211af5d41d53b443543dd94d18d4aaa9c4a67
Instruction ID: b3cf9f79d5930787e39bc6f3068fae8c230ff470a9081b7b1eaa21316a4b260e
Opcode Fuzzy Hash: 56b09ab75f6d657f2a4e664c152211af5d41d53b443543dd94d18d4aaa9c4a67
Instruction Fuzzy Hash: 1951D371504310EFC721EB65D881A6FB7E8FB8C718F104A5EF58997291CB38E845CB9A

Function 00410270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,?,7EE0FD72,7EE0FD72), ref: 004103DB

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Strings

Application, xrefs: 004103E7
FlowTrackerExport, xrefs: 004102D5
AppSettings.conf, xrefs: 004102C4

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ConvertGdiplusShutdownString_com_util::
String ID: AppSettings.conf$Application$FlowTrackerExport
API String ID: 2219683421-2163412475
Opcode ID: 2bef9ce4b862980722f9a2e31a4080024069a23ddeddd01649e767aca4ce3e99
Instruction ID: f8e8162d355e3fd04b1bf4f0d0d25214e731e7d29cff4492bf5d47ccd1bee30b
Opcode Fuzzy Hash: 2bef9ce4b862980722f9a2e31a4080024069a23ddeddd01649e767aca4ce3e99
Instruction Fuzzy Hash: 49518F702047099FC610DF65C481A5BB7E4FF88714F104A1EE89A97791CB78E885CBAA

Function 0044E910 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 0041B2A0: __vswprintf.LIBCMT ref: 0041B2AF

Part of subcall function 00409870: SysAllocString.OLEAUT32(?), ref: 004098DD

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

InterlockedIncrement.KERNEL32(?), ref: 0044EA35
InterlockedIncrement.KERNEL32(-00000008), ref: 0044EA7C

Strings

%.3f, xrefs: 0044E9CD
HighStdError, xrefs: 0044EA3E

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: IncrementInterlockedString$AllocConvert__vswprintf_com_util::
String ID: %.3f$HighStdError
API String ID: 3625803405-1040117878
Opcode ID: cdd67a1f416ab5ef5da10540da4a81906f06926001fb719f7af9ba75e48d3126
Instruction ID: a4310d2d9f1f6bd56d7d8d6abae817c93143850b866b5a8c22d88a4c7ae13499
Opcode Fuzzy Hash: cdd67a1f416ab5ef5da10540da4a81906f06926001fb719f7af9ba75e48d3126
Instruction Fuzzy Hash: 49415DB1608341ABC324AF65CC45B9BBBD4FB88740F10492EF049633D1DB3898048B9E

Function 0041E600 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 00402B00: SysAllocString.OLEAUT32(?), ref: 00402B55

SysStringLen.OLEAUT32(00000000), ref: 0041E662
InterlockedDecrement.KERNEL32(00000008), ref: 0041E711
SysFreeString.OLEAUT32(00000000), ref: 0041E722

Strings

`<u, xrefs: 0041E722

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$AllocDecrementFreeInterlocked
String ID: `<u
API String ID: 3605875487-3367579956
Opcode ID: 1ad314b3239bdc399309261a85be068f144eee1339a4527a70cdff1da3432bf6
Instruction ID: 4091abc2c38fd69645e9ee0428309afa5613a974ed4b7e6403dda1ce29fe183e
Opcode Fuzzy Hash: 1ad314b3239bdc399309261a85be068f144eee1339a4527a70cdff1da3432bf6
Instruction Fuzzy Hash: 87419D7A2083419FD710DF5AC8C495BB7E9EB88314F544A2EF9A9D3390C338E945CB56

Function 004202E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 0041FE70: GetModuleFileNameA.KERNEL32(00400000,?,00000208,7EE0FD72), ref: 0041FEBD
Part of subcall function 0041FE70: RegCreateKeyExA.KERNELBASE(80000000,FlowTrackerExport.SontekFlowTrackerFile.1,00000000,00000000,00000000,00020006,00000000,?,?,0047A264,00000002), ref: 0041FF3A
Part of subcall function 0041FE70: RegSetValueExA.KERNELBASE(00000000,EditFlags,00000000,00000004,?,00000004), ref: 0041FF67
Part of subcall function 0041FE70: RegSetValueExA.KERNELBASE(00000000,BrowserFlags,00000000,00000004,?,00000004), ref: 0041FF82

Part of subcall function 0041ECF0: CharNextA.USER32(?), ref: 0041ED1B
Part of subcall function 0041ECF0: CharNextA.USER32(?), ref: 0041ED22

Part of subcall function 0041ED40: CharUpperA.USER32 ref: 0041ED52
Part of subcall function 0041ED40: CharUpperA.USER32 ref: 0041ED5E
Part of subcall function 0041ED40: CharNextA.USER32(?), ref: 0041ED79
Part of subcall function 0041ED40: CharNextA.USER32(?), ref: 0041ED7E
Part of subcall function 0041ED40: CharUpperA.USER32 ref: 0041ED86
Part of subcall function 0041ED40: CharUpperA.USER32(00000000), ref: 0041ED8E

_sprintf.LIBCMT ref: 00420459

Strings

HR= %d, xrefs: 00420453
RegServer, xrefs: 00420376
UnregServer, xrefs: 00420360

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Char$NextUpper$Value$CreateFileModuleName_sprintf
String ID: HR= %d$RegServer$UnregServer
API String ID: 1115697871-432705565
Opcode ID: 407dda6d57e6b077ac0e9fca928f2a8b24ca5b21daae5b4db61db66647a3bbdf
Instruction ID: 2f93bbde2de81db56cedb751c0b2329f7d0adaaffc6b6edaf50fe39154832449
Opcode Fuzzy Hash: 407dda6d57e6b077ac0e9fca928f2a8b24ca5b21daae5b4db61db66647a3bbdf
Instruction Fuzzy Hash: D441C33174032167DB25EB21AC42BEB73D86F91704F04453AED0997343EBAD994987EE

Function 0040FB30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 107comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00479084,00000000,00000017,00477D48,?,7EE0FD72), ref: 0040FB70
OleRun.OLE32(?), ref: 0040FB81

Strings

AboutFlowTrackerSoftwareTitle, xrefs: 0040FBF9
About.htm, xrefs: 0040FC1B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CreateInstance
String ID: About.htm$AboutFlowTrackerSoftwareTitle
API String ID: 542301482-2891776880
Opcode ID: 60de62d3ee0134e277e38c86e827c4fa114ba0dddfa8b06f62f7932c8220073c
Instruction ID: 589383d25febfd43646378e62bb29aff91fba7aa78b55d4bbb530a3a2b730ea3
Opcode Fuzzy Hash: 60de62d3ee0134e277e38c86e827c4fa114ba0dddfa8b06f62f7932c8220073c
Instruction Fuzzy Hash: 24319271608341AFC310DF59C881A5BB7E8EB89714F404A7EF859A7390D678AC04CBAA

Function 004582B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00415F90: InterlockedDecrement.KERNEL32(7EE0FD7A), ref: 00415FF1
Part of subcall function 00415F90: SysFreeString.OLEAUT32(00000000), ref: 00416002

InterlockedDecrement.KERNEL32(?), ref: 00458325
SysFreeString.OLEAUT32(00000000), ref: 0045833A

Strings

`<u, xrefs: 0045833A
Global.acc, xrefs: 00458363

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString
String ID: Global.acc$`<u
API String ID: 3298718523-1017906523
Opcode ID: 793e33a822a6bfc2799daf068196026415549313bd203a97f23ab1c42fadf1da
Instruction ID: 529c98a1f6a4b850ef1dd1dc657cb4c942a18903ef4eae9aa98daea27aeaeb8a
Opcode Fuzzy Hash: 793e33a822a6bfc2799daf068196026415549313bd203a97f23ab1c42fadf1da
Instruction Fuzzy Hash: F431CF715047019FD720DB25C905B5BB7E8BF84B29F044A5EFC99A7392DB38E808CB99

Function 0040DF60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00479084,00000000,00000017,00477D48,?), ref: 0040DF84
OleRun.OLE32(?), ref: 0040DF95

Strings

QualitySettings.htm, xrefs: 0040E017
Quality Control Settings, xrefs: 0040E006

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CreateInstance
String ID: Quality Control Settings$QualitySettings.htm
API String ID: 542301482-908367580
Opcode ID: a9f32bacd7d2c9971a88172707c5488cc080ce9cfd957faab75dc169cdf9a810
Instruction ID: 3cbb14647677c9c30b3a94460b8327e9fa23ef0af7ae795bec686388e42cded6
Opcode Fuzzy Hash: a9f32bacd7d2c9971a88172707c5488cc080ce9cfd957faab75dc169cdf9a810
Instruction Fuzzy Hash: 8F312A756043129FC210DF68D841E6AB7E8EF88754F10892DF859E7390D634ED45CBAA

Function 0040A8B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A919
InterlockedDecrement.KERNEL32(?), ref: 0040A934
SysFreeString.OLEAUT32(00000000), ref: 0040A949

Strings

`<u, xrefs: 0040A949

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: af9c6c0949b8a6c988ee58a2f009a50e9935a70f3b72485e3ecc2cf212f8348b
Instruction ID: 08d29699cf1b1e0a948680d55f09fd2626df2bab03c7e94a415b4fa883bc200f
Opcode Fuzzy Hash: af9c6c0949b8a6c988ee58a2f009a50e9935a70f3b72485e3ecc2cf212f8348b
Instruction Fuzzy Hash: C9213AB56047019FD310DB29C844B5BB7E8AF88B14F04892EF899E7380E738E905CB96

Function 0040A520 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A587
InterlockedDecrement.KERNEL32(?), ref: 0040A598
SysFreeString.OLEAUT32(00000000), ref: 0040A5AD

Strings

`<u, xrefs: 0040A5AD

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 8802bcd64cf9cff9442ad254c1401ab4c60adad0bbd6b81d9293910c984ab01b
Instruction ID: 4c22a06fc81f1c0f95f8f843cd87c2d0f36c396acbf0c3d268b0a8cf5ce76196
Opcode Fuzzy Hash: 8802bcd64cf9cff9442ad254c1401ab4c60adad0bbd6b81d9293910c984ab01b
Instruction Fuzzy Hash: 3A215075604701AFD210CB29DC40F5BB7E8BF88B14F04862EF859E7380E738D9018AA6

Function 00420C90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 00420CF4
InterlockedDecrement.KERNEL32(?), ref: 00420D0F
SysFreeString.OLEAUT32(00000000), ref: 00420D24

Strings

`<u, xrefs: 00420D24

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 16f1808147cdea02515dbab3e58c321488b6c0238c7576329c69344cdfe0369a
Instruction ID: 693f2052371c8518bd92aff96e8d290a1ed9cc3a8fdb5e5d4ffa4e4943b38093
Opcode Fuzzy Hash: 16f1808147cdea02515dbab3e58c321488b6c0238c7576329c69344cdfe0369a
Instruction Fuzzy Hash: E12179B56057119FD720CF5AD840B5BB7E8EF88714F408A2EF899D7341E738E9048B95

Function 00409E70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 00409ED4
InterlockedDecrement.KERNEL32(00000008), ref: 00409EEF
SysFreeString.OLEAUT32(00000000), ref: 00409F04

Strings

`<u, xrefs: 00409F04

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 0fc5052fe2d8ecfee8d70bf57da90f5b43a92e2402db9e4b36fc09f946418780
Instruction ID: f6f2f31c79887564f6b9870307434654b8ed42a49c8d73a249e76e3e22a7b356
Opcode Fuzzy Hash: 0fc5052fe2d8ecfee8d70bf57da90f5b43a92e2402db9e4b36fc09f946418780
Instruction Fuzzy Hash: 37211AB5609702AFD310CF15C844B57B7E8AF94B14F04496EF899E7381E778ED048A95

Function 00443BA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 00443C01
InterlockedDecrement.KERNEL32(?), ref: 00443C17
SysFreeString.OLEAUT32(00000000), ref: 00443C2C

Strings

`<u, xrefs: 00443C2C

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 935a293667d33a24e01188fb2e0418bb9babe941095336449756ba26eeb2ba05
Instruction ID: e98c25ee31a1be30fd1b53e89aaf828d65f0d3c7412942eee81a23957b137cee
Opcode Fuzzy Hash: 935a293667d33a24e01188fb2e0418bb9babe941095336449756ba26eeb2ba05
Instruction Fuzzy Hash: DB216D726087419FE320DF25CD81B5BB7E8EF94B15F04492EF899D7340E738E9048AA9

Function 00420B60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 00420BBC
InterlockedDecrement.KERNEL32(?), ref: 00420BD2
SysFreeString.OLEAUT32(00000000), ref: 00420BE7

Strings

`<u, xrefs: 00420BE7

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 3f6e51cae7854aa30b9ee6b8a5c5974d993da549e691eb0354e75395909663e9
Instruction ID: 09305dbbf2382757cf9c93f2f12575ed6837b04870da14472789d38597806d7b
Opcode Fuzzy Hash: 3f6e51cae7854aa30b9ee6b8a5c5974d993da549e691eb0354e75395909663e9
Instruction Fuzzy Hash: C4118CB16047219FD220DF65D840F5BB7E8AF94B14F404A2EF899D7241E738E804CAA9

Function 00409B70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 00409BCC
InterlockedDecrement.KERNEL32(?), ref: 00409BE2
SysFreeString.OLEAUT32(00000000), ref: 00409BF7

Strings

`<u, xrefs: 00409BF7

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 1213bbcaa7896d361434376e275e3f9f1fca3b93d8fd4439af41de8e9b48d99f
Instruction ID: e1c7091eb5fdf93b2170f2d01f85043ea58849f2be21bd0da07364a60f2b07be
Opcode Fuzzy Hash: 1213bbcaa7896d361434376e275e3f9f1fca3b93d8fd4439af41de8e9b48d99f
Instruction Fuzzy Hash: 08115EB16097119BE620CB15D941B57B7E8BF94714F04492EF855D3381E738ED048AA9

Function 00457450 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 004574AC
InterlockedDecrement.KERNEL32(?), ref: 004574C2
SysFreeString.OLEAUT32(00000000), ref: 004574D7

Strings

`<u, xrefs: 004574D7

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 80bd124df50ecac4ee8b0d4c1ebc0fc0d12dc6c67d5b0a6a70fe80164e4cc5fc
Instruction ID: bcb48e4b6ce746e655b23a68bec77e49c56007950373a467b4f429d599aff566
Opcode Fuzzy Hash: 80bd124df50ecac4ee8b0d4c1ebc0fc0d12dc6c67d5b0a6a70fe80164e4cc5fc
Instruction Fuzzy Hash: 08116071608751AFD720CF25D940F57BBE8AF45715F00492EFC59D7341E738E8088AA9

Function 0040A6A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A6FC
InterlockedDecrement.KERNEL32(?), ref: 0040A712
SysFreeString.OLEAUT32(00000000), ref: 0040A727

Strings

`<u, xrefs: 0040A727

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 57e72bbef7c7e08eadd33afd547675f827f6ed162f0262ef2756d1e52d20bbda
Instruction ID: 7d756b1ee15587f32d9280435353ad4e3c62c552fc73eabec253d6899ff8db1a
Opcode Fuzzy Hash: 57e72bbef7c7e08eadd33afd547675f827f6ed162f0262ef2756d1e52d20bbda
Instruction Fuzzy Hash: 1A1160756047519FD720CF25C940B5BB7E8EF55714F048A2EF855E7380E738D8148AAA

Function 0040A980 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A9D5
InterlockedDecrement.KERNEL32(?), ref: 0040A9E6
SysFreeString.OLEAUT32(00000000), ref: 0040A9FB

Strings

`<u, xrefs: 0040A9FB

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 0f341ba57235d1542d6850669f57c49f4a076212f8cb3c0213f9d488b823a418
Instruction ID: c929d10e5b70a2a81bf49e3a38bf807b5d786acfe54fc3ce51ca47bad35b6e2d
Opcode Fuzzy Hash: 0f341ba57235d1542d6850669f57c49f4a076212f8cb3c0213f9d488b823a418
Instruction Fuzzy Hash: A0117C76705700AFD721CF29D944B5BB7E8AF98B10F04492EF859E3380E738D815CA9A

Function 0040A050 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A0A0
InterlockedDecrement.KERNEL32(?), ref: 0040A0B1
SysFreeString.OLEAUT32(00000000), ref: 0040A0C6

Strings

`<u, xrefs: 0040A0C6

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 241301e250aa54d22a875ea1c985f2787edef8aa9dab52e62903083b8335d963
Instruction ID: bd67063097056a6ff6562dfe38cd50a70a43e3e1f73bae4e539ef93c9424612b
Opcode Fuzzy Hash: 241301e250aa54d22a875ea1c985f2787edef8aa9dab52e62903083b8335d963
Instruction Fuzzy Hash: 34118E716047019FD220DF29CD40B57B7E8AF44B14F04453AFC49E3380E738E805C69A

Function 0040A800 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A850
InterlockedDecrement.KERNEL32(?), ref: 0040A861
SysFreeString.OLEAUT32(00000000), ref: 0040A876

Strings

`<u, xrefs: 0040A876

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: d834440f87d3a4a2b58acd3f61453d7aadf5c88af1949553cacf8719d082f6f2
Instruction ID: 67368f9bfa1af27b29de2132cfd4c2eeeff6564ff039d164d7ccf7c605c70d0a
Opcode Fuzzy Hash: d834440f87d3a4a2b58acd3f61453d7aadf5c88af1949553cacf8719d082f6f2
Instruction Fuzzy Hash: F1115E766047019FD225EB29D840B5BB7E8AF84B10F04853AFD55E7380E738D816C69A

Function 0040A100 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A150
InterlockedDecrement.KERNEL32(?), ref: 0040A161
SysFreeString.OLEAUT32(00000000), ref: 0040A176

Strings

`<u, xrefs: 0040A176

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 739aa3ad72137d7856ebeca8e7addc51a320944f8f2c3eefa2fda67bfe183fa8
Instruction ID: 602f4975f9273f8404cf27fe1132f5e3d6f4614cf1076b508c61ac3e2177537a
Opcode Fuzzy Hash: 739aa3ad72137d7856ebeca8e7addc51a320944f8f2c3eefa2fda67bfe183fa8
Instruction Fuzzy Hash: 03118E726047019FD222DF29CC40B5BB7E9AF85B20F04453AF845EB380E738D805C69A

Function 00421909 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0042191B

Part of subcall function 00409E70: _com_issue_errorex.COMSUPP ref: 00409ED4
Part of subcall function 00409E70: InterlockedDecrement.KERNEL32(00000008), ref: 00409EEF
Part of subcall function 00409E70: SysFreeString.OLEAUT32(00000000), ref: 00409F04

InterlockedDecrement.KERNEL32(?), ref: 00421A38
SysFreeString.OLEAUT32(00000000), ref: 00421A49

Strings

`<u, xrefs: 00421A49

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeString$Increment_com_issue_errorex
String ID: `<u
API String ID: 3105222523-3367579956
Opcode ID: 03a0564c2a7d561b64cb2ce63b2f9115728c04368d0ca036135b79f28262898c
Instruction ID: 86cf0490074b6c6bf0df1e08126aab4ed1dcbc807e2cbfabfddc60d56fdf4ae8
Opcode Fuzzy Hash: 03a0564c2a7d561b64cb2ce63b2f9115728c04368d0ca036135b79f28262898c
Instruction Fuzzy Hash: 93216AB03093419FD310DF29E844A5BBBE9AF99304F44495DF48987362DB38E905CBA6

Function 0040A310 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A360
InterlockedDecrement.KERNEL32(?), ref: 0040A371
SysFreeString.OLEAUT32(00000000), ref: 0040A386

Strings

`<u, xrefs: 0040A386

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: ca395a440d2f228f5733db79b1b36798f99dd5afa24f6573d7947bf9134c8cff
Instruction ID: d967b3e63ff0cde97ed4b9c4bf83da85de759978cf51f7bcda1a6c9cc46339c1
Opcode Fuzzy Hash: ca395a440d2f228f5733db79b1b36798f99dd5afa24f6573d7947bf9134c8cff
Instruction Fuzzy Hash: 45118B716047109FD220CB29CC40B5BB7E8AF94B10F04453AFC49E3380EB38E80586AA

Function 0040A5F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A643
InterlockedDecrement.KERNEL32(?), ref: 0040A654
SysFreeString.OLEAUT32(00000000), ref: 0040A669

Strings

`<u, xrefs: 0040A669

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 846e5e0493975dbb6bbc1713614f9ac63d3aca93c48a29d96359643f1706c2d8
Instruction ID: a0967d27f37e246141512307b53601a57d7a0d00459e80edcc8834772279bd3c
Opcode Fuzzy Hash: 846e5e0493975dbb6bbc1713614f9ac63d3aca93c48a29d96359643f1706c2d8
Instruction Fuzzy Hash: 0F118B756057009FD620CB29D840B6BB3ECAF94B50F08493AFC89E3380EB39D805869A

Function 0040A1B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A1FD
InterlockedDecrement.KERNEL32(?), ref: 0040A20E
SysFreeString.OLEAUT32(00000000), ref: 0040A223

Strings

`<u, xrefs: 0040A223

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 7321f667fe84ab10d28370e06ecb7892027a265d2881ab657b76888109f26606
Instruction ID: 631c5a1e903a6b1d8568104b354f100aad53d60b36df2deefbf68449c5a1b26d
Opcode Fuzzy Hash: 7321f667fe84ab10d28370e06ecb7892027a265d2881ab657b76888109f26606
Instruction Fuzzy Hash: E8116AB56057019BD620CB25D845F9777E8AF48B14F04497EB845E7380E739EC14C79A

Function 0040A260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A2AD
InterlockedDecrement.KERNEL32(?), ref: 0040A2BE
SysFreeString.OLEAUT32(00000000), ref: 0040A2D3

Strings

`<u, xrefs: 0040A2D3

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: ab199f9532eb0b59da4bffa365888efaf256688b585c16d2232ad79a8e97fe3f
Instruction ID: 3bef2df67f81f00acf30dfe4a5d0b0cb262bbee825134f5707b6aed7f39206ea
Opcode Fuzzy Hash: ab199f9532eb0b59da4bffa365888efaf256688b585c16d2232ad79a8e97fe3f
Instruction Fuzzy Hash: F6118CB56057119BD620CB29D840B97B7E8AF48B10F04497EB845E3380E73AEC54879A

Function 0040A3C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A40D
InterlockedDecrement.KERNEL32(?), ref: 0040A41E
SysFreeString.OLEAUT32(00000000), ref: 0040A433

Strings

`<u, xrefs: 0040A433

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 993f5d6b67fba982cf0a660f800a7300aa5376be9f1b607724b28a059e2067dd
Instruction ID: d499b5c4161d2d2bc5b515d6a06d76553e0b9a00fefc077f3360efb41eaa1df4
Opcode Fuzzy Hash: 993f5d6b67fba982cf0a660f800a7300aa5376be9f1b607724b28a059e2067dd
Instruction Fuzzy Hash: DF118CB96057119BD620DF29DC44B9777E8AF44B14F04493AB849E3381E778EC14869A

Function 0040A470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0040A4BD
InterlockedDecrement.KERNEL32(?), ref: 0040A4CE
SysFreeString.OLEAUT32(00000000), ref: 0040A4E3

Strings

`<u, xrefs: 0040A4E3

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString_com_issue_errorex
String ID: `<u
API String ID: 696761734-3367579956
Opcode ID: 4c16017fa77317901b0235882e2aa33bc23105ee0e77946b7329ed3137586142
Instruction ID: c0690a0ad9bc18fe023ad41b4be80b0e7f5220358eb42801feb4049be97088d4
Opcode Fuzzy Hash: 4c16017fa77317901b0235882e2aa33bc23105ee0e77946b7329ed3137586142
Instruction Fuzzy Hash: 7E116AB5605701ABD620DF25DC49F9B77E8AF44B10F04493AB84AE3381E778EC14CA9A

Function 0040E6B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(00400000,00000080), ref: 0040E6F7
LoadMenuA.USER32(00400000), ref: 0040E70F
LoadAcceleratorsA.USER32(00400000), ref: 0040E754

Strings

0`I, xrefs: 0040E6C4, 0040E704, 0040E749

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Load$AcceleratorsMenuString
String ID: 0`I
API String ID: 1424144778-2983702033
Opcode ID: 01a6e7fdffbbf39512320cdccb1727a56973ab954bfa9fdd3306fc42d9ecdff4
Instruction ID: d5efa0498375978e6cfbb535079462ab6206a84ee19c56ca05ab72c4a3628c00
Opcode Fuzzy Hash: 01a6e7fdffbbf39512320cdccb1727a56973ab954bfa9fdd3306fc42d9ecdff4
Instruction Fuzzy Hash: AE113AB6615250AFC324DB58D881EABB3E9BBCC700F04452EFA49C7290C7B4AC45CBA5

Function 0044D740 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0044D762
SysFreeString.OLEAUT32(00000000), ref: 0044D777
InterlockedIncrement.KERNEL32(?), ref: 0044D7A8

Strings

`<u, xrefs: 0044D777

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeIncrementString
String ID: `<u
API String ID: 3471777455-3367579956
Opcode ID: 6c83931c5ca91474e45481c681c980aff9df7dbec0360d1c0d12aaad0e2e7320
Instruction ID: 4d0d6c1f5420dddaa37071a53d82592659053bb156f2e9e2804cc5f1b40b20a0
Opcode Fuzzy Hash: 6c83931c5ca91474e45481c681c980aff9df7dbec0360d1c0d12aaad0e2e7320
Instruction Fuzzy Hash: E40192B6F013028BEB209F65DCC4A1BB7D8AF80711B18047AF909D3300E739EC488669

Function 0044D7D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0044D7FC
SysFreeString.OLEAUT32(00000000), ref: 0044D80D
InterlockedIncrement.KERNEL32(?), ref: 0044D83E

Strings

`<u, xrefs: 0044D80D

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeIncrementString
String ID: `<u
API String ID: 3471777455-3367579956
Opcode ID: 99b15d8a4621579bb562e1d692d3994217eaee0f609ed66afac7832e4d8ef62d
Instruction ID: dadbf7d6cc4202fde8b6f2fbaf7aa2bfc5c51a865df9d5baad61a0ff681610c8
Opcode Fuzzy Hash: 99b15d8a4621579bb562e1d692d3994217eaee0f609ed66afac7832e4d8ef62d
Instruction Fuzzy Hash: 0A015672E013029BEB20EF69DC8462BB7D8AF94711B54047AF959D3301E739EC44C769

Function 0040ADF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 004099C0: InterlockedIncrement.KERNEL32(-00000008), ref: 004099FA

InterlockedDecrement.KERNEL32(?), ref: 0040AE51
SysFreeString.OLEAUT32(00000000), ref: 0040AE62

Strings

`<u, xrefs: 0040AE62
Resources\Reports\, xrefs: 0040AE15

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: InterlockedString$ConvertDecrementFreeIncrement_com_util::
String ID: Resources\Reports\$`<u
API String ID: 1157734785-1770316297
Opcode ID: 463b5c6504dc9e6212cccf4bb5dcc1aa8e807268567e1ba60db2bc564df47720
Instruction ID: cd188aebe36476003af72b3b6b9bdb92097a372fa2aab85a9791eb4712206489
Opcode Fuzzy Hash: 463b5c6504dc9e6212cccf4bb5dcc1aa8e807268567e1ba60db2bc564df47720
Instruction Fuzzy Hash: 70115EB66447419FD620DF15C845B5BB7E8FF54714F040A2EF85993380E738E904CAAA

Function 00415E30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 004099C0: InterlockedIncrement.KERNEL32(-00000008), ref: 004099FA

InterlockedDecrement.KERNEL32(?), ref: 00415E91
SysFreeString.OLEAUT32(00000000), ref: 00415EA2

Strings

`<u, xrefs: 00415EA2
Resources\Help\, xrefs: 00415E55

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: InterlockedString$ConvertDecrementFreeIncrement_com_util::
String ID: Resources\Help\$`<u
API String ID: 1157734785-3593609782
Opcode ID: d3433049ff3a5ef453337fcd527a8e76bbe098f00c0dc83afa544fc55c3259c9
Instruction ID: 2af4225b4a48f78ae0396ec45c1f4b82c3af01d01d87d0a62e4ef96bea302765
Opcode Fuzzy Hash: d3433049ff3a5ef453337fcd527a8e76bbe098f00c0dc83afa544fc55c3259c9
Instruction Fuzzy Hash: D31151B66087419FD324DF15C845B97B7E8FF94715F040A2EF85593380E738E904C6AA

Function 00415EE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 004099C0: InterlockedIncrement.KERNEL32(-00000008), ref: 004099FA

InterlockedDecrement.KERNEL32(00000008), ref: 00415F41
SysFreeString.OLEAUT32(00000000), ref: 00415F52

Strings

`<u, xrefs: 00415F52
Resources\Views\, xrefs: 00415F05

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: InterlockedString$ConvertDecrementFreeIncrement_com_util::
String ID: Resources\Views\$`<u
API String ID: 1157734785-3245522201
Opcode ID: 1f9175bf3ad069567d8f77d5528c9d699bdea0925fffad9a207854c43a361c8c
Instruction ID: cffa16396f991a673bf1d3a251c40aa784cf78f8d29906c3bb3f508372e50dab
Opcode Fuzzy Hash: 1f9175bf3ad069567d8f77d5528c9d699bdea0925fffad9a207854c43a361c8c
Instruction Fuzzy Hash: D2115EB56087419FD720DF15C845B97B7E8FF94B14F044A2EF85993380E738E908CAAA

Function 0040AEF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 004099C0: InterlockedIncrement.KERNEL32(-00000008), ref: 004099FA

InterlockedDecrement.KERNEL32(?), ref: 0040AF51
SysFreeString.OLEAUT32(00000000), ref: 0040AF62

Strings

`<u, xrefs: 0040AF62
Resources\Dialogs\, xrefs: 0040AF15

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: InterlockedString$ConvertDecrementFreeIncrement_com_util::
String ID: Resources\Dialogs\$`<u
API String ID: 1157734785-2451383825
Opcode ID: 4b466bd3e59bff74acce51fa8889319b941c8f6bddfb13d671d067cb6d401ad7
Instruction ID: e8dd09141bbc58d2eaf28e85672d082f32ff997f48391fc55cfc998a04c6be6c
Opcode Fuzzy Hash: 4b466bd3e59bff74acce51fa8889319b941c8f6bddfb13d671d067cb6d401ad7
Instruction Fuzzy Hash: EE115EB56087419FD620DF25CC45B5BB7E8FF54714F040A2EF85593380E738E908CAAA

Function 00415F90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

Part of subcall function 004099C0: InterlockedIncrement.KERNEL32(-00000008), ref: 004099FA

InterlockedDecrement.KERNEL32(7EE0FD7A), ref: 00415FF1
SysFreeString.OLEAUT32(00000000), ref: 00416002

Strings

`<u, xrefs: 00416002
Resources\Accelerators\, xrefs: 00415FB5

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: InterlockedString$ConvertDecrementFreeIncrement_com_util::
String ID: Resources\Accelerators\$`<u
API String ID: 1157734785-3680602747
Opcode ID: a4aa9dc604b09efb2b9765db92a1977b844d28b93513facdbb4294b54a0e4cfb
Instruction ID: 44fb31ffa2345cd8e6deb27d9347c14695c847c4a5fc43dbd081a857d42a49ba
Opcode Fuzzy Hash: a4aa9dc604b09efb2b9765db92a1977b844d28b93513facdbb4294b54a0e4cfb
Instruction Fuzzy Hash: 2C119EB56047419FD620DF15C805B97B7E8FF58714F000A2EF85593380EB38E908CAAA

Function 0044D6C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0044D6E2
SysFreeString.OLEAUT32(00000000), ref: 0044D6F7
InterlockedIncrement.KERNEL32(?), ref: 0044D728

Strings

`<u, xrefs: 0044D6F7

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeIncrementString
String ID: `<u
API String ID: 3471777455-3367579956
Opcode ID: d84b361774724b15693432350c37d898d1a3efdf1b360ea4816fa3fa45811596
Instruction ID: 23380c3fc4d2415d505b02e51dfc8a42f65d492efdadaf2b8198f17577d1daf1
Opcode Fuzzy Hash: d84b361774724b15693432350c37d898d1a3efdf1b360ea4816fa3fa45811596
Instruction Fuzzy Hash: 8401A7B6E012029BEB209F69EC84A1FB7ECAF54751B05053AF949D7301E738EC44C799

Function 00420DD0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 00420DF1
InterlockedDecrement.KERNEL32(?), ref: 00420E03
SysFreeString.OLEAUT32(00000000), ref: 00420E18

Part of subcall function 00409730: InterlockedDecrement.KERNEL32(?), ref: 0040973E
Part of subcall function 00409730: SysFreeString.OLEAUT32(00000000), ref: 00409753

Strings

`<u, xrefs: 00420E18

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementFreeString$Increment
String ID: `<u
API String ID: 1306932728-3367579956
Opcode ID: 887c9a0a660fc9ff50917cc403ef78be159fd60df60b069947ee0b28a5cdc9b2
Instruction ID: 7a78ebf7aeda147cabab9f75c894aef27d76ae2a7dda5a465637cc4d0937ab4e
Opcode Fuzzy Hash: 887c9a0a660fc9ff50917cc403ef78be159fd60df60b069947ee0b28a5cdc9b2
Instruction Fuzzy Hash: FEF0A472B00222D7C630AF20EC0595BBBD89F10745785482EFC89D7342EB38EDC5C699

Function 00462171 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0045A6CA), ref: 00462176
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00462186

Strings

IsProcessorFeaturePresent, xrefs: 00462180
KERNEL32, xrefs: 00462171

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 9b83db90c81231e93b73fc2987c8f510fa84c0a6afbf5c08da3144d17978bad4
Instruction ID: 75f5f89d5cba1abd753006e5914429de3d4cfa2cabc9951dcc9175223c049c2d
Opcode Fuzzy Hash: 9b83db90c81231e93b73fc2987c8f510fa84c0a6afbf5c08da3144d17978bad4
Instruction Fuzzy Hash: 5AF09670E04A09E2DB002BB0AD0D7AF7B78BF81702F9604A1D1DDB00D4EF7480B5825A

Function 004015E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34windowCOMMON

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 0040160B
__cftof.LIBCMT ref: 00401623

Part of subcall function 00459846: __mbsnbcpy_s_l.LIBCMT ref: 00459859

MessageBoxA.USER32(00000000,?,00000000,00000010), ref: 0040163C

Strings

cannot initialize critical section(Error , xrefs: 004015FC

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Message__cftof__mbsnbcpy_s_l_strcpy_s
String ID: cannot initialize critical section(Error
API String ID: 4040108663-1990813258
Opcode ID: 842db5bea930b11717d53e8a1ffcd6239d73b8805deb5f55ee015be5742292fe
Instruction ID: d8bb2ec281573e116f1737456ea076cfddb5a2fc6437af6af3817672df492570
Opcode Fuzzy Hash: 842db5bea930b11717d53e8a1ffcd6239d73b8805deb5f55ee015be5742292fe
Instruction Fuzzy Hash: FAF02BB1508300BBD220E760CC83FDB33AC9B98700F00491E7688621D1D6F85484879A

Function 02394134 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

ippsDFTFree_C_32fc.IPPSW7(?), ref: 02394153

Strings

WSML, xrefs: 02394140

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: C_32fcFree_ipps
String ID: WSML
API String ID: 826238850-601441309
Opcode ID: 0886d2f24c767c60d4d302eccc154ead01a208dc375549d8272f959e0b4ef20b
Instruction ID: 74978a24ad4c988bbd205624b5ebb4b36794dbaf8f2f2c3fce68f6e9560b159c
Opcode Fuzzy Hash: 0886d2f24c767c60d4d302eccc154ead01a208dc375549d8272f959e0b4ef20b
Instruction Fuzzy Hash: 49E0127214424D568E60E9A8BD40D6BB74D5FB1378B444132FA28A96F0DB31D871EA28

Function 02394188 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

ippsDFTFree_C_32fc.IPPSW7(?), ref: 023941A7

Strings

XSML, xrefs: 02394194

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: C_32fcFree_ipps
String ID: XSML
API String ID: 826238850-2075808843
Opcode ID: 2b138579b2e6384829c74d991b0f125869140f630a4278b7e2d5e04d8aac7e31
Instruction ID: 1cfae2d98c6deac806495362253d09b1808bb0859a2309e6bf4d8f8348bcb88c
Opcode Fuzzy Hash: 2b138579b2e6384829c74d991b0f125869140f630a4278b7e2d5e04d8aac7e31
Instruction Fuzzy Hash: 88E092B314424D564E30E9A8BC40D2BB34D5FB1338B448222FE28A95E0CB31D471EA28

Function 023941DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

ippsDFTFree_C_32fc.IPPSW7(?), ref: 023941FB

Strings

YSML, xrefs: 023941E8

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: C_32fcFree_ipps
String ID: YSML
API String ID: 826238850-3271963438
Opcode ID: 95e63b9c2d6d6181309173f9027501d2284913768c4797e713fccd5cb6c61571
Instruction ID: a6898142c8f322eb2fc2a3b36f547ece6c7b043528cb81d134841a36a4c9c474
Opcode Fuzzy Hash: 95e63b9c2d6d6181309173f9027501d2284913768c4797e713fccd5cb6c61571
Instruction Fuzzy Hash: 7EE0927319024D468E20E9A8BC40D2BB34D6F61334B444223FA28991D0CB31D471E628

Function 0045D531 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 0045D543

Part of subcall function 0045D409: InterlockedIncrement.KERNEL32(0045A609), ref: 0045D41B
Part of subcall function 0045D409: InterlockedIncrement.KERNEL32(FF8BC300), ref: 0045D428
Part of subcall function 0045D409: InterlockedIncrement.KERNEL32(FFFFFF96), ref: 0045D435
Part of subcall function 0045D409: InterlockedIncrement.KERNEL32(E8EC8B55), ref: 0045D442
Part of subcall function 0045D409: InterlockedIncrement.KERNEL32(087D8300), ref: 0045D44F
Part of subcall function 0045D409: InterlockedIncrement.KERNEL32(087D8300), ref: 0045D46B
Part of subcall function 0045D409: InterlockedIncrement.KERNEL32(A3004620), ref: 0045D47B
Part of subcall function 0045D409: InterlockedIncrement.KERNEL32(55FF8B0F), ref: 0045D491

___removelocaleref.LIBCMT ref: 0045D54E

Part of subcall function 0045D498: InterlockedDecrement.KERNEL32(?), ref: 0045D4B2
Part of subcall function 0045D498: InterlockedDecrement.KERNEL32(?), ref: 0045D4BF
Part of subcall function 0045D498: InterlockedDecrement.KERNEL32(?), ref: 0045D4CC
Part of subcall function 0045D498: InterlockedDecrement.KERNEL32(?), ref: 0045D4D9
Part of subcall function 0045D498: InterlockedDecrement.KERNEL32(?), ref: 0045D4E6
Part of subcall function 0045D498: InterlockedDecrement.KERNEL32(?), ref: 0045D502
Part of subcall function 0045D498: InterlockedDecrement.KERNEL32(00000000), ref: 0045D512
Part of subcall function 0045D498: InterlockedDecrement.KERNEL32(?), ref: 0045D528

___freetlocinfo.LIBCMT ref: 0045D562

Part of subcall function 0045D2C0: ___free_lconv_mon.LIBCMT ref: 0045D306
Part of subcall function 0045D2C0: ___free_lconv_num.LIBCMT ref: 0045D327
Part of subcall function 0045D2C0: ___free_lc_time.LIBCMT ref: 0045D3AC

Strings

MI, xrefs: 0045D559

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: MI
API String ID: 467427115-2379962254
Opcode ID: 8511a0800cdd757e30596628b39cf7ebbf3679a0300be404267da4e96903d978
Instruction ID: 65104b801ae7c87890dd8658ad7d2d12fbce08186846cd36fe67d6069de94337
Opcode Fuzzy Hash: 8511a0800cdd757e30596628b39cf7ebbf3679a0300be404267da4e96903d978
Instruction Fuzzy Hash: 4AE0DF22D0162525CA32A61D6C0026B9A940F8236BB29015BFC00E7287FB2C8D89C4AE

Function 0237A158 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ippsFFTFree_R_32f.IPPSW7(?), ref: 0237A189
ippsFree.IPPSW7(?), ref: 0237A18F

Strings

70IF, xrefs: 0237A16A
50IF, xrefs: 0237A163

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$FreeFree_R_32f
String ID: 50IF$70IF
API String ID: 2335195080-3424823088
Opcode ID: 5271795541278cff2d755cda920fd0f513b3df933b987338d2e91e89f29f4c60
Instruction ID: 268f9071e6fd91d56533f07338512cde7aeba8e403465ef1c0b1065150cce700
Opcode Fuzzy Hash: 5271795541278cff2d755cda920fd0f513b3df933b987338d2e91e89f29f4c60
Instruction Fuzzy Hash: 92E092722086D1436E71D53C9840E4FA3945F127783058E29F050CB2A8D728E883C694

Function 0237A1A4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ippsFFTFree_C_32fc.IPPSW7(?), ref: 0237A1D5
ippsFree.IPPSW7(?), ref: 0237A1DB

Strings

80IF, xrefs: 0237A1B6
60IF, xrefs: 0237A1AF

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$C_32fcFreeFree_
String ID: 60IF$80IF
API String ID: 2389687155-2915863459
Opcode ID: cadcc251cc1dde1aec41d901325303949a7d82189349a7bbe82ecb381bc0efd7
Instruction ID: f767b4d930f4cbfbe4065e5fcfd48f2b08c9de16247dc59c442e65e9153036c0
Opcode Fuzzy Hash: cadcc251cc1dde1aec41d901325303949a7d82189349a7bbe82ecb381bc0efd7
Instruction Fuzzy Hash: 6BE0D872208690436F70D93C9880D4FA3D46F113B43044E16F460DF2D4D728EC82C691

Function 02398638 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ippsCopy_64f.IPPSW7(?,?,?), ref: 02398667
ippsZero_64f.IPPSW7(?,?), ref: 02398677

Strings

22II, xrefs: 0239864D
12II, xrefs: 02398646

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Copy_64fZero_64f
String ID: 12II$22II
API String ID: 3145756444-2253945433
Opcode ID: bb8429f944889bc6135cf92fb6a466d6d1efec6d1b9047c527a7a5d825cf4277
Instruction ID: 6068126c6fbf8dfe3caa574f2f3737250d5bcfc0f6a0483345019c7c225c7b97
Opcode Fuzzy Hash: bb8429f944889bc6135cf92fb6a466d6d1efec6d1b9047c527a7a5d825cf4277
Instruction Fuzzy Hash: AEE092392102805B8E54AA7CC840C1AB7367FF3758728CA1EB6698D1B8C723D853EB41

Function 022FE10C Relevance: 6.1, APIs: 4, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

ippsMalloc_8u.IPPSW7(00000001), ref: 022FE145
___libm_sse2_sin.LIBCMT ref: 022FE1F0
ippsFFTInitAlloc_R_64f.IPPSW7(?,-00000001,00000008,00000000), ref: 022FE222
ippsFFTGetBufSize_R_64f.IPPSW7(?,00000000,?,-00000001,00000008,00000000), ref: 022FE23C

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$R_64f$Alloc_InitMalloc_8uSize____libm_sse2_sin
String ID:
API String ID: 3406558733-0
Opcode ID: 1d6bf823e3a99a192ccc4c7a2b4482667f1f71562ad1480939bc9bbe464bae3c
Instruction ID: 33efc982e25d45ef3c59e26c05c1ff6fd9fc4874fffe6d4fd59a76f714e40def
Opcode Fuzzy Hash: 1d6bf823e3a99a192ccc4c7a2b4482667f1f71562ad1480939bc9bbe464bae3c
Instruction Fuzzy Hash: FE41C472E00B058BC716CE78CC4059BF3EABFD9354F05476AE849AB264EB71D851CB81

Function 02304614 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

ippsMalloc_32u.IPPSW7(?), ref: 023046A2
ippsCopy_32f.IPPSW7(?,00000000,?), ref: 023046B4
ippsFIRMR64fc_Direct_16sc_Sfs.IPPSW7(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 023046E3
ippsFree.IPPSW7(00000000,?,00000000,?), ref: 023046EB

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$Copy_32fDirect_16sc_FreeMalloc_32uR64fc_
String ID:
API String ID: 1010944985-0
Opcode ID: ebdc07045c7ad7bf187010a35e21f414467938570c4d01f9a366c680f5437a19
Instruction ID: 5c38fdc8946c5530ff79f9540a1ade1ad43b8f3c77458b850e8a0e9c6f326ade
Opcode Fuzzy Hash: ebdc07045c7ad7bf187010a35e21f414467938570c4d01f9a366c680f5437a19
Instruction Fuzzy Hash: 7531C2333093446B4240E9ADBC80D5BF7E9EBC6AB5F405B2EF360DB294D721E9408761

Function 00459580 Relevance: 6.1, APIs: 4, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,7EE0FD72,?,00000000,?,?,00000000,00476A70,000000FF), ref: 004595F0
GetLastError.KERNEL32(?,00000000,?,?,00000000,00476A70,000000FF,?,00423D9B,?,?,AbbrBurst,?,00000000,?,Year), ref: 004595FC

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: dfd172f187ea42c6d137d59f6616ca6c565dc738a1be926a4d61196ebad9da1b
Instruction ID: 9178379c6a20677d7f59ff589e27079bbcb1c629a6a9dacf9525c95e3be9324d
Opcode Fuzzy Hash: dfd172f187ea42c6d137d59f6616ca6c565dc738a1be926a4d61196ebad9da1b
Instruction Fuzzy Hash: 2031C672B44205EAD7208F65DC06F5B77A8EB44B61F10427AFD09D72C1E778AD08C698

Function 004699D7 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00469A0B
__isleadbyte_l.LIBCMT ref: 00469A3F
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,?,00000000,00000000,?,?,?,?,00000002,00000000), ref: 00469A70
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,?,?,?,00000002,00000000), ref: 00469ADE

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 7483dc724d84530d4b20fa60b14f4d1d808a1f3a447c7242297fff9c3bca4fb5
Instruction ID: 14cedcc5509b6623110c4ddb035882935479619baf58fa210210b4a35abdb33d
Opcode Fuzzy Hash: 7483dc724d84530d4b20fa60b14f4d1d808a1f3a447c7242297fff9c3bca4fb5
Instruction Fuzzy Hash: 4231D331A002C5EFCB20DFA4C8809BA7BE9AF01314F14456AE4658B291F775DD40DB5A

Function 023CE290 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

ippsMalloc_8u.IPPSW7(00000014), ref: 023CE2EC
ippsZero_8u.IPPSW7(00000000,00000014), ref: 023CE2F6
ippsMalloc_32u.IPPSW7(?), ref: 023CE350
ippsFree.IPPSW7(00000000), ref: 023CE385

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$FreeMalloc_32uMalloc_8uZero_8u
String ID:
API String ID: 2529108998-0
Opcode ID: 9d80b719afc29873b88a6d4aa8fd7ae216fe825b5b0e7b9cc09de27c65aa6ebc
Instruction ID: 6b3d0dd9f134702ef60d518f65ae72eec124c9fac091c76d4ff251d20d670a74
Opcode Fuzzy Hash: 9d80b719afc29873b88a6d4aa8fd7ae216fe825b5b0e7b9cc09de27c65aa6ebc
Instruction Fuzzy Hash: 9B3193726087059BCB50EF69E840A5FB7E5BFC4764F24876DF9249B284E730EC018B91

Function 00408EF0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,0000000D), ref: 00408F26
FlushInstructionCache.KERNEL32(00000000), ref: 00408F2D

Part of subcall function 00458ED1: GetProcessHeap.KERNEL32(00000000,0000000D,?,0040183E), ref: 00458E52
Part of subcall function 00458ED1: HeapAlloc.KERNEL32(00000000,?,0040183E), ref: 00458E59

SetLastError.KERNEL32(0000000E), ref: 00408F47

Part of subcall function 00403B70: RaiseException.KERNEL32(C0000005,00000001,?,?), ref: 00403B82
Part of subcall function 00403B70: GetCurrentThreadId.KERNEL32 ref: 00403B9C
Part of subcall function 00403B70: EnterCriticalSection.KERNEL32(?), ref: 00403BA9
Part of subcall function 00403B70: LeaveCriticalSection.KERNEL32(?), ref: 00403BB9

CreateWindowExA.USER32(?,?,?,?,?,00000000,000000E9,?,?,?,00400000,?), ref: 00408FC3

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CriticalCurrentHeapProcessSection$AllocCacheCreateEnterErrorExceptionFlushInstructionLastLeaveRaiseThreadWindow
String ID:
API String ID: 3956295412-0
Opcode ID: a770077c6f6cf5a7c5798f3fdb01a78614343668deb012b59b77e34ea112ea1b
Instruction ID: 18c2cce7039951b90f72251f38333c555b0cebe6de159e60fba38aa77de3817b
Opcode Fuzzy Hash: a770077c6f6cf5a7c5798f3fdb01a78614343668deb012b59b77e34ea112ea1b
Instruction Fuzzy Hash: 3021A272204311AFD320DF68D944F67BBE9EFC8710F05856EB549A7291CA74EC40CBA4

Function 0238C630 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

ippsFIRMRGetStateSize32s_16s.IPPSW7(?,?,?), ref: 0238C648
ippsMalloc_8u.IPPSW7(?), ref: 0238C661
ippsFIRMRInit32s_16s.IPPSW7(?,?,?,00000000,?,?,?,?,?,00000000), ref: 0238C69B
ippsFree.IPPSW7(00000000), ref: 0238C6B6

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: ipps$FreeInit32s_16sMalloc_8uSize32s_16sState
String ID:
API String ID: 4042844123-0
Opcode ID: fb6a58f2d097edb7748b53e989e15c770f86e95c1594c26143c7d48341038a0b
Instruction ID: 0a4b099a5d3d218e2821e3c88b4198969176f2b800f1b3595e6dc1b58189ba0a
Opcode Fuzzy Hash: fb6a58f2d097edb7748b53e989e15c770f86e95c1594c26143c7d48341038a0b
Instruction Fuzzy Hash: 0C11C07320D3046FD210FA59EC80D6BFBEDEBC5268F505A2FF5508A255DA22E8418BA1

Function 0046203C Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00462062

Part of subcall function 00461E87: __fltout2.LIBCMT ref: 00461EB3

__cftog_l.LIBCMT ref: 00462088
__cftoe_l.LIBCMT ref: 004620BA

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 840b47117f9822f084accbee9b1c534dfb85568be519b44761eb59a11297ec6b
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 75117E3200014ABBCF225E84CD05CEE3F66BF08354B588416FE1859136E27BC9B1EB86

Function 00401380 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,?,?), ref: 00401397
SHGetSpecialFolderLocation.SHELL32(00000000,?,?), ref: 004013A5
SHGetPathFromIDListA.SHELL32(?,?), ref: 004013B5
SHGetMalloc.SHELL32(?), ref: 004013C0

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: FolderLocationSpecial$FromListMallocPath
String ID:
API String ID: 2730999478-0
Opcode ID: 4ab77e87824fe9dca97bdbab7fd5e359f8ad1dbd96e88aea0ea9143d1229caf5
Instruction ID: 123756061c5a49b39786d1c2f75b908266bd7ece5e3061d9baf8173e595297e0
Opcode Fuzzy Hash: 4ab77e87824fe9dca97bdbab7fd5e359f8ad1dbd96e88aea0ea9143d1229caf5
Instruction Fuzzy Hash: F3012175608302AFD600EB59DC84D9BB7ACEFC8355F448569F948C3264D635E846CBA1

Function 0041EDD0 Relevance: 6.0, APIs: 4, Instructions: 36synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041EDE6
WaitForSingleObject.KERNEL32(?,?), ref: 0041EDF3
CloseHandle.KERNEL32(?), ref: 0041EE07
PostThreadMessageA.USER32(?,00000012,00000000,00000000), ref: 0041EE15

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ObjectSingleWait$CloseHandleMessagePostThread
String ID:
API String ID: 3386540786-0
Opcode ID: 2dbfd0e1236f658863d927a66c109daeb4abc3404585ebb5969edc68d0239eab
Instruction ID: e768331fae9045f5502842c348cbe3dfb7b3814be9b17800a2d262ca3cd41a88
Opcode Fuzzy Hash: 2dbfd0e1236f658863d927a66c109daeb4abc3404585ebb5969edc68d0239eab
Instruction Fuzzy Hash: 0EF030B6204705AFD734EB65DD88CA3B7ACFF483653984A2EF54683A90D624FC45CB24

Function 00443C70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

_com_issue_errorex.COMSUPP ref: 00443D1D
_com_issue_errorex.COMSUPP ref: 00443D4E

Strings

m/s, xrefs: 00443CB9, 00443D9A

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: _com_issue_errorex$ConvertString_com_util::
String ID: m/s
API String ID: 1160526872-1683921290
Opcode ID: 631b69fe65cb5180010977fd029fe55dc9056dbee6f0a62a1592a00d6a091765
Instruction ID: 0883962f744c4f729d502c99e1e6012d35de8e08c57d015037be1f8ce05b1898
Opcode Fuzzy Hash: 631b69fe65cb5180010977fd029fe55dc9056dbee6f0a62a1592a00d6a091765
Instruction Fuzzy Hash: 0541D5B16047419FD700EF55C881A1BB7E8EF9CB18F104A5EF989A7392C7389D09CB5A

Function 0041E890 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000009), ref: 0041E95B
SysFreeString.OLEAUT32(00000000), ref: 0041E970

Strings

`<u, xrefs: 0041E970

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString
String ID: `<u
API String ID: 3298718523-3367579956
Opcode ID: c0778014686aed6a2d0dd45375d3a8fc8cddd70e0e6078cc527cacd0c63f9789
Instruction ID: 08fbb5a7e81de869ea6b56f36222f1e07e2a7f5b1044c05de058789440debd76
Opcode Fuzzy Hash: c0778014686aed6a2d0dd45375d3a8fc8cddd70e0e6078cc527cacd0c63f9789
Instruction Fuzzy Hash: 663152B96047019FC710DF2AC940A97B7E8AF88740F14856EF859C7351E738ED45CBA5

Function 0044EAD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 0044EB99
InterlockedIncrement.KERNEL32(-00000008), ref: 0044EBDF

Strings

HighBndConditions, xrefs: 0044EBA2

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: IncrementInterlocked
String ID: HighBndConditions
API String ID: 3508698243-1412865835
Opcode ID: 2032d0b054ed5852c9865e3b9eb5e2d89034ca8853833e52d2cd1fc65df18e4f
Instruction ID: 20ca8ac4fea37eda6d1a82b5dc9c05c64d425806e14940d9e2031cd098bfedd7
Opcode Fuzzy Hash: 2032d0b054ed5852c9865e3b9eb5e2d89034ca8853833e52d2cd1fc65df18e4f
Instruction Fuzzy Hash: C431CB716183409BD314DF19C842B5BB7E5FBD9754F40092EF48693381DB79E900CBAA

Function 004564A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00456C40: EnterCriticalSection.KERNEL32(004960A0,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?), ref: 00456C4C
Part of subcall function 00456C40: RegisterWindowMessageA.USER32(WM_ATLGETHOST,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?,?,00000000), ref: 00456C5D
Part of subcall function 00456C40: RegisterWindowMessageA.USER32(WM_ATLGETCONTROL,?,00000000,?,?,?,?,?,?,?,?,?,004564AB,?,?,00000000), ref: 00456C69
Part of subcall function 00456C40: GetClassInfoExA.USER32(00400000,AtlAxWin90,?), ref: 00456C90
Part of subcall function 00456C40: LoadCursorA.USER32 ref: 00456CCE
Part of subcall function 00456C40: RegisterClassExA.USER32 ref: 00456CF1
Part of subcall function 00456C40: _memset.LIBCMT ref: 00456D1D
Part of subcall function 00456C40: GetClassInfoExA.USER32(00400000,AtlAxWinLic90,?), ref: 00456D3A
Part of subcall function 00456C40: LoadCursorA.USER32 ref: 00456D72
Part of subcall function 00456C40: RegisterClassExA.USER32 ref: 00456D95

SysFreeString.OLEAUT32(00000000), ref: 0045651C
SysAllocString.OLEAUT32(?), ref: 0045654B

Strings

`<u, xrefs: 0045651C

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ClassRegister$CursorInfoLoadMessageStringWindow$AllocCriticalEnterFreeSection_memset
String ID: `<u
API String ID: 3252910278-3367579956
Opcode ID: a27279b07cdb66f9765c7f919233df2f0b78bbfea7f61d67dd8013fbf400cec6
Instruction ID: 4142194e8fc7ae903ef9e4af970420ad25aa7267e5c7d4a7c4756549836b1952
Opcode Fuzzy Hash: a27279b07cdb66f9765c7f919233df2f0b78bbfea7f61d67dd8013fbf400cec6
Instruction Fuzzy Hash: 2A314A72204301AFC700DF59D8C081BB7E9AFC8745BA1896EFA49C7325D634DC4ACBA6

Function 0044DD80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0041B2A0: __vswprintf.LIBCMT ref: 0041B2AF

Part of subcall function 00409870: SysAllocString.OLEAUT32(?), ref: 004098DD

Part of subcall function 00402A70: _com_util::ConvertStringToBSTR.COMSUPP ref: 00402AC4

InterlockedIncrement.KERNEL32(?), ref: 0044DE7A

Strings

%.0f, xrefs: 0044DE14
HighAngle, xrefs: 0044DE87

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: String$AllocConvertIncrementInterlocked__vswprintf_com_util::
String ID: %.0f$HighAngle
API String ID: 1764855592-1008769313
Opcode ID: 8c583597350d133c4047f03d6b13ce72e1cd39c9537fd6932623411b8d8f8dc3
Instruction ID: b8e5da60ceeb2fb9ccf3806aeca50ffa6231cfcae76a3a3259a54ffd6d2ca7ba
Opcode Fuzzy Hash: 8c583597350d133c4047f03d6b13ce72e1cd39c9537fd6932623411b8d8f8dc3
Instruction Fuzzy Hash: ED31D3716287409BD324EB69D95AB9FB7E8FF88704F10492EF08D522C1DB789504CB5B

Function 00420E40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86comCOMMON

Download Yara Rule

APIs

Part of subcall function 00401E30: CreateFileA.KERNEL32(\\.\mailslot\SontekObjectTrack,40000000,00000003,00000000,00000003,00000080,00000000,00404F54), ref: 00401E9C
Part of subcall function 00401E30: WriteFile.KERNEL32(FFFFFFFF,?,?,?,00000000,00404F54), ref: 00401EB6

CoCreateInstance.OLE32(00479AB4,00000000,00000017,00477D48,?), ref: 00420EC6
OleRun.OLE32(?), ref: 00420ED6

Strings

FlowTracker.FtDataSessionExporter, xrefs: 00420E46

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CreateFile$InstanceWrite
String ID: FlowTracker.FtDataSessionExporter
API String ID: 4285916682-1703287146
Opcode ID: bfc8b136ac67617bc8302a17132c8431151e2e75798f4339d753db82c7eec42c
Instruction ID: 1c399bf86431638251a73b9d460989d9cc435293057d5e4e4c63c9d9458b270b
Opcode Fuzzy Hash: bfc8b136ac67617bc8302a17132c8431151e2e75798f4339d753db82c7eec42c
Instruction Fuzzy Hash: FC3102B5640B009FC320DF6AD884956FBF9FFA87007518A2FE58AC7B20D7B5A841CB54

Function 0040AFA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0040B060
SysFreeString.OLEAUT32(00000000), ref: 0040B075

Strings

`<u, xrefs: 0040B075

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString
String ID: `<u
API String ID: 3298718523-3367579956
Opcode ID: b6b91b750c373e59632c7374e360b7155fb8a803fe3f45547c44d3f5862ce724
Instruction ID: 19b30c5e1ac258276a612aa25e92b0a0ae0b6f84188cb7ab5f32a347f2bd934d
Opcode Fuzzy Hash: b6b91b750c373e59632c7374e360b7155fb8a803fe3f45547c44d3f5862ce724
Instruction Fuzzy Hash: B53180B1604345CBD7309F25C951B6BB3E8EF88700F44493EE95597381E738A904C79E

Function 0041E300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(0040C6CB), ref: 0041E35A
SysFreeString.OLEAUT32(00000000), ref: 0041E36F

Strings

`<u, xrefs: 0041E36F

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString
String ID: `<u
API String ID: 3298718523-3367579956
Opcode ID: c042ffc0fd0cc15ca0c2148168b847c18a8a92a1d83c515d671fc73f407bf472
Instruction ID: 7de6d0b8e86637d8d493deabb4806f365d9e993547f75952c4bbfcca1ad6a22f
Opcode Fuzzy Hash: c042ffc0fd0cc15ca0c2148168b847c18a8a92a1d83c515d671fc73f407bf472
Instruction Fuzzy Hash: BD2159B9604606AFD710DF26C884B57B7E8AF88710F144A1EED2987391E738E885CA95

Function 00401E30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\mailslot\SontekObjectTrack,40000000,00000003,00000000,00000003,00000080,00000000,00404F54), ref: 00401E9C
WriteFile.KERNEL32(FFFFFFFF,?,?,?,00000000,00404F54), ref: 00401EB6

Strings

\\.\mailslot\SontekObjectTrack, xrefs: 00401E97

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: File$CreateWrite
String ID: \\.\mailslot\SontekObjectTrack
API String ID: 2263783195-1984679209
Opcode ID: 2089036e1b41a0dadd0d7413b73b929d2774ce6ce867640d0c9295de5afef469
Instruction ID: 03059b0a8c8d1266c1d9eaddd2895e6ff4bb023cda45de279df42b67c9f5c91a
Opcode Fuzzy Hash: 2089036e1b41a0dadd0d7413b73b929d2774ce6ce867640d0c9295de5afef469
Instruction Fuzzy Hash: A411E731244340AFD321CF28DC45F93BBE8DF56754F24856AF6A49B3E1C670A808C768

Function 00451240 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00451256
CreateWindowExA.USER32(?,AtlAxWin90,?,?,?,00000002,?,?,?,?,00400000,?), ref: 004512BE

Strings

AtlAxWin90, xrefs: 004512B8

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: AllocCreateStringWindow
String ID: AtlAxWin90
API String ID: 2375029931-469574346
Opcode ID: 7bea32f9c9b7a27d903b8687938ca785a54a4fdbaa4c602d032f280f3609dfda
Instruction ID: 2108f0eb41ef2915d2ff62bf489248088feeafcb4c6cf78296b46aab407923d2
Opcode Fuzzy Hash: 7bea32f9c9b7a27d903b8687938ca785a54a4fdbaa4c602d032f280f3609dfda
Instruction Fuzzy Hash: 4F117076204201AFC314CB9DC804E17F7EDDFE8710F15846EB644E7221D670EC408BA5

Function 004012C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00458CAF: EnterCriticalSection.KERNEL32(00496044,00000000,?,00000000,004012D1,00000000,?,?,00000000,00000004,004122A0,?,00000000,?,?,?), ref: 00458CBC
Part of subcall function 00458CAF: LeaveCriticalSection.KERNEL32(00496044,?,?,00000000,004012D1,00000000,?,?,00000000,00000004,004122A0,?,00000000,?,?,?), ref: 00458CD8

FindResourceExA.KERNEL32(00000000,00000006,?,00000000), ref: 004012F6

Part of subcall function 00401250: LoadResource.KERNEL32(?,?,00000000,?,00401308,00000000,00000000,?,?,00000000,00000000,?,?,00000000,00000004,004122A0), ref: 0040125C

Strings

0`I, xrefs: 00401312
0`I, xrefs: 004012C7

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CriticalResourceSection$EnterFindLeaveLoad
String ID: 0`I$0`I
API String ID: 1986744039-165543972
Opcode ID: c1c72bff6ff7ec8519f78a322e04c604987675e16476dfb03e2417b848f4ee40
Instruction ID: 62b9c9d55d6ad862daec9adf9ef96556f0c27137a918262609525372b937856b
Opcode Fuzzy Hash: c1c72bff6ff7ec8519f78a322e04c604987675e16476dfb03e2417b848f4ee40
Instruction Fuzzy Hash: 8EF0D17274212117E72165666C80E7BA39EDAC07E2702013FFD46E3791DE799C0102B8

Function 00420470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 004204B3
_sprintf.LIBCMT ref: 004204EC

Strings

HR= %d, xrefs: 004204E6

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: CommandLine_sprintf
String ID: HR= %d
API String ID: 4076998932-2285545011
Opcode ID: 3915a361e658c79ea0af7637c346910661847afa6620a567b7242695845c3310
Instruction ID: 235e58c3c25a2cfec138f97a766e66e397701a94e950b82b2d33dc9a39c07850
Opcode Fuzzy Hash: 3915a361e658c79ea0af7637c346910661847afa6620a567b7242695845c3310
Instruction Fuzzy Hash: BF01FC71604220AFC624E724E806BEF73D45F95714F40856FE589832C2DA785C44C7DF

Function 0044D990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0044D9B0
SysFreeString.OLEAUT32(00000000), ref: 0044D9C1

Strings

`<u, xrefs: 0044D9C1

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString
String ID: `<u
API String ID: 3298718523-3367579956
Opcode ID: a745336ac8060f5772ac0d5855e81506c783ba7ada24f77373a383fb97c88c62
Instruction ID: 6bf3fa6a79460c065e00a22aa5683f51ff550779478520340d6d440c85c9c250
Opcode Fuzzy Hash: a745336ac8060f5772ac0d5855e81506c783ba7ada24f77373a383fb97c88c62
Instruction Fuzzy Hash: 29F090F3E012129BFB209E59DC81A2BB3ED9F44B51B05052BEA59D3341E738EC4086A9

Function 00401ED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\mailslot\SontekObjectTrack,40000000,00000003,00000000,00000003,00000080,00000000), ref: 00401F01
WriteFile.KERNEL32(FFFFFFFF,?,?,?,00000000), ref: 00401F1B

Strings

\\.\mailslot\SontekObjectTrack, xrefs: 00401EFC

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: File$CreateWrite
String ID: \\.\mailslot\SontekObjectTrack
API String ID: 2263783195-1984679209
Opcode ID: 32006baa07c83d9abf5bbe8833e4859b0ea4c13080f7dd74388523181c850182
Instruction ID: 4e04ef70d19d60105fdeec83da0f874164684f549da30b96dd49fffa43f91d3f
Opcode Fuzzy Hash: 32006baa07c83d9abf5bbe8833e4859b0ea4c13080f7dd74388523181c850182
Instruction Fuzzy Hash: 8AF09675244200BFE2208B28EC86F5373A8EF59724F204A2BF765972D1D7B06C408A68

Function 004020F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00402127
__CxxThrowException@8.LIBCMT ref: 0040213E

Part of subcall function 0045A5EA: _malloc.LIBCMT ref: 0045A604

Strings

t}G, xrefs: 00402136

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: t}G
API String ID: 4063778783-3734030870
Opcode ID: f4484a74aca3ecbf1990058a38a395cf0224e9a1b79218be1e07a52822bdf0be
Instruction ID: 1a6d9c3cd0143c7b225ea504d7fe5ba7eb624a6bda444872cfa3e787e0ee82c3
Opcode Fuzzy Hash: f4484a74aca3ecbf1990058a38a395cf0224e9a1b79218be1e07a52822bdf0be
Instruction Fuzzy Hash: 41E0E5B04083006AD308EB20D65AB2F73957B80700F008F2FF94A401C1EBB8DA1CC54B

Function 0043D940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0043D97E
__CxxThrowException@8.LIBCMT ref: 0043D995

Part of subcall function 0045A5EA: _malloc.LIBCMT ref: 0045A604

Strings

t}G, xrefs: 0043D98D

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: t}G
API String ID: 4063778783-3734030870
Opcode ID: a867fff7a892fccaf453040704f97405bc2a4bd0b48fec9012bd099bd6360366
Instruction ID: 58497454e6a066d14e0189063ea943b0f5a41db7a31a03dee0895204c5ecadeb
Opcode Fuzzy Hash: a867fff7a892fccaf453040704f97405bc2a4bd0b48fec9012bd099bd6360366
Instruction Fuzzy Hash: A7F0E9B1404300A6D308EF60E995B5F73956FC4715F108E1FF85681181EB78D91CC64B

Function 00462620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045AA12: __getptd.LIBCMT ref: 0045AA18
Part of subcall function 0045AA12: __getptd.LIBCMT ref: 0045AA28

__getptd.LIBCMT ref: 0046262F

Part of subcall function 0045D8AC: __getptd_noexit.LIBCMT ref: 0045D8AF
Part of subcall function 0045D8AC: __amsg_exit.LIBCMT ref: 0045D8BC

__getptd.LIBCMT ref: 0046263D

Strings

csm, xrefs: 0046264B

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: dc80ffa6b93f169842e9542535fb58e95c8228ca8430d1f37235ad030f0a468f
Instruction ID: 46de22cf1adcb86ecdf53e95222a0d8fdbdc550c26d3d89eefaee5fb1735cc0b
Opcode Fuzzy Hash: dc80ffa6b93f169842e9542535fb58e95c8228ca8430d1f37235ad030f0a468f
Instruction Fuzzy Hash: F0017C34C00616AACF34AF21D64466EB3B5AF18316F58442FE8409A352EF7C8994CF0A

Function 00409730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0040973E
SysFreeString.OLEAUT32(00000000), ref: 00409753

Strings

`<u, xrefs: 00409753

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString
String ID: `<u
API String ID: 3298718523-3367579956
Opcode ID: fbb45a429b7a0d03f8e5de07f97b311abc0133390302b9323e1bad68afac5bff
Instruction ID: 9fb95d2eeea2add9817693eee9dee77ac64f82ceda4e27cf2c996691d69f0abb
Opcode Fuzzy Hash: fbb45a429b7a0d03f8e5de07f97b311abc0133390302b9323e1bad68afac5bff
Instruction Fuzzy Hash: D5F03076A11211C7DA70AF25E948A47B7AC5F40B11704047ABD5AE7342E738DC4486D9

Function 00421440 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 00421454
SysFreeString.OLEAUT32(00000000), ref: 00421469

Strings

`<u, xrefs: 00421469

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DecrementFreeInterlockedString
String ID: `<u
API String ID: 3298718523-3367579956
Opcode ID: 68bdaf7c8c6260a48de4f4e6cb939a24f7f993a6a26f1b7625c6170008563747
Instruction ID: 90f2a0de44803f0090f7b3ff88bed7de5a59cd0f9071034eaa29a84409630349
Opcode Fuzzy Hash: 68bdaf7c8c6260a48de4f4e6cb939a24f7f993a6a26f1b7625c6170008563747
Instruction Fuzzy Hash: 4AF0A075B012229B8730AB24AD0494B77986F20B04789496EBC8DD3311E738EC0586A9

Function 00459301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00459308
__CxxThrowException@8.LIBCMT ref: 00459333

Part of subcall function 00459B64: RaiseException.KERNEL32(?,?,0045A64E,?,?,?,?,?,0045A64E,?,004855FC,004960F4), ref: 00459BA6

Part of subcall function 00411890: std::exception::exception.LIBCMT ref: 004118BE

Strings

invalid string position, xrefs: 0045930D

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::exception::exception
String ID: invalid string position
API String ID: 2977319401-1799206989
Opcode ID: be580436b1f4b79dbeb2b9cb9fc6be2ae33521212ceca4379e8bdcc1e64a3290
Instruction ID: f2e5cd0091a9b08c69ca8ab38ad0b78d5e550fb43906f157741f012d91281a52
Opcode Fuzzy Hash: be580436b1f4b79dbeb2b9cb9fc6be2ae33521212ceca4379e8bdcc1e64a3290
Instruction Fuzzy Hash: 61F0A072900218A7CB10FBE1CC42EDEBB78AF40366F10882BB604A6142CBB89944C798

Function 00462F3C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?,?,00462F8C,?,00000000,00000007,00000007,?,004630D1,00000000,?,?,0048E248,0000000C,0045ACFF,?), ref: 00462F62

Strings

\, xrefs: 00462F5A
:, xrefs: 00462F56

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: DriveType
String ID: :$\
API String ID: 338552980-1166558509
Opcode ID: 9370124acd5b303bcd293dc39a9c0d9653faa0e31a269e5d841b1634744bab20
Instruction ID: e94b2b414d48e146c17c73fb915b586e073ffa679635462a38562da8b075e0fd
Opcode Fuzzy Hash: 9370124acd5b303bcd293dc39a9c0d9653faa0e31a269e5d841b1634744bab20
Instruction Fuzzy Hash: CFE048313087C8ADEF11CE75984479B3FDC9B51798F44C096F85CCE241E1B5D65683A6

Function 0239C15C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ippsCopy_64f.IPPSW7(?,?,?), ref: 0239C18B

Strings

41II, xrefs: 0239C175
31II, xrefs: 0239C16E

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Copy_64fipps
String ID: 31II$41II
API String ID: 1871515258-17609913
Opcode ID: a6d6b7e245fb4745af0ce0bfb645c816dba42796de5a39e24473e28e66dde7ee
Instruction ID: 5530324c6927b618303460dd5be79f969ef32d5e8877b910846e3c6dd6225d2b
Opcode Fuzzy Hash: a6d6b7e245fb4745af0ce0bfb645c816dba42796de5a39e24473e28e66dde7ee
Instruction Fuzzy Hash: C5E04F35210181568E54993CC84092AB6537BF6318B28DE1EA065891B4CB22CC53DB18

Function 0239C1D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ippsCopy_64fc.IPPSW7(?,?,?), ref: 0239C207

Strings

51II, xrefs: 0239C1EA
61II, xrefs: 0239C1F1

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Copy_64fcipps
String ID: 51II$61II
API String ID: 3879569744-3625911736
Opcode ID: 6eeb59aca40f4fdc760860ffc36a50ad0258529497cb880f54e73720b2c69112
Instruction ID: 266640898572dc4e488a1034f6db9cd4dbce565fa4bd0087550d2ef101265510
Opcode Fuzzy Hash: 6eeb59aca40f4fdc760860ffc36a50ad0258529497cb880f54e73720b2c69112
Instruction Fuzzy Hash: 13E04F35220141569E5499A8C84082BB6626BE6B18B68DE1FE4A58A1B8C322D852DB00

Function 02398688 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ippsCopy_64fc.IPPSW7(?,?,?), ref: 023986B7

Strings

42II, xrefs: 023986A1
32II, xrefs: 0239869A

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Copy_64fcipps
String ID: 32II$42II
API String ID: 3879569744-2378501379
Opcode ID: 80b2c43dcc017ab68eec537829419428e457a48fa5c56455066dc4908ad5d0ba
Instruction ID: a4f1c804ee47d232278a15cdc435db506a84f4419c3a7c5553da3360c5f32e1f
Opcode Fuzzy Hash: 80b2c43dcc017ab68eec537829419428e457a48fa5c56455066dc4908ad5d0ba
Instruction Fuzzy Hash: 08E0863521014257CE54993CC440C2BBA527FE3718728CA1DB765CE2B4C722DC52DB42

Function 023982AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ippsFree.IPPSW7(?), ref: 023982D4

Strings

71II, xrefs: 023982BD
81II, xrefs: 023982B6

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Freeipps
String ID: 71II$81II
API String ID: 203438716-372660749
Opcode ID: 90c438072769448ad6308e060af06579cff370d3d5966f473a173e947e615c17
Instruction ID: a7e1b746e7fa944fab30b9f69a0ce7f85c07a97b82ba91939f87cf4a796cfa0d
Opcode Fuzzy Hash: 90c438072769448ad6308e060af06579cff370d3d5966f473a173e947e615c17
Instruction Fuzzy Hash: F4D012BA320982424A60C53CC480D27A7562BF37287588669B5A4CA1E8D731DC40D754

Function 023982E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ippsFree.IPPSW7(?), ref: 02398310

Strings

02II, xrefs: 023982F2
91II, xrefs: 023982F9

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Freeipps
String ID: 02II$91II
API String ID: 203438716-1147426626
Opcode ID: d8e74de4ebbf15e0de7eb8664f26c0d6742a7fd0d08270ac04c33274bc9c3471
Instruction ID: d5f0bd9246011bd68d34d3954cc5bf067e0426206381d6d7ff29888fc7c8be52
Opcode Fuzzy Hash: d8e74de4ebbf15e0de7eb8664f26c0d6742a7fd0d08270ac04c33274bc9c3471
Instruction Fuzzy Hash: 15D05BB93202C2834E24CD3CC8C4D1FA6566FF3B24758C729F164CA1E4D730D840D654

Function 02392014 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ippsFree.IPPSW7(?), ref: 0239203C

Strings

90IF, xrefs: 0239201E
11IF, xrefs: 02392025

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Freeipps
String ID: 11IF$90IF
API String ID: 203438716-3183182225
Opcode ID: 3bd69e57eb38c2ae9ed2798595e4f2c7ad62c49b371fc9d245c8d6c1ee03a8b7
Instruction ID: a0a5fb60d506cf76446e9c3ede9824824e7f4b4e81e550f7d9f1febfa7699088
Opcode Fuzzy Hash: 3bd69e57eb38c2ae9ed2798595e4f2c7ad62c49b371fc9d245c8d6c1ee03a8b7
Instruction Fuzzy Hash: 31D0C7B13009C2A30E68C93C8480D1BA2523BA3328758C625BA20CE3ECEB35C884C614

Function 02392050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ippsFree.IPPSW7(?), ref: 02392078

Strings

01IF, xrefs: 0239205A
21IF, xrefs: 02392061

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Freeipps
String ID: 01IF$21IF
API String ID: 203438716-2080602340
Opcode ID: a675ea394d8c492d4beb5fb834f6a365453329501a9ad3838202418c0ca408ba
Instruction ID: 701864502623f7be2198dee340a5cffb70346436a81fd2c58bb67e73326ac0f3
Opcode Fuzzy Hash: a675ea394d8c492d4beb5fb834f6a365453329501a9ad3838202418c0ca408ba
Instruction Fuzzy Hash: 96D01275310DC2565E64D53C8880917A65B3FE3728754C725E964CE3FCD731D850D654

Function 02396620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ippsFree.IPPSW7(?), ref: 02396648

Strings

72II, xrefs: 02396631
82II, xrefs: 0239662A

Memory Dump Source

Source File: 0000001D.00000002.1939585065.00000000022F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 022F0000, based on PE: true

Associated: 0000001D.00000002.1939565534.00000000022F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939800406.00000000024CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939818969.00000000024DC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939834655.00000000024DE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939853740.00000000024E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939872843.00000000024E8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939892713.00000000024F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939907186.00000000024F2000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939922319.00000000024F4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939941415.00000000024F8000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939955508.00000000024FA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939970666.00000000024FB000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1939990579.00000000024FE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000001D.00000002.1940010878.0000000002501000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22f0000_FlowTrackerExport.jbxd

Similarity

API ID: Freeipps
String ID: 72II$82II
API String ID: 203438716-2600461239
Opcode ID: 561376d553875808623185583cee76178fcca891ae39a3640d50cc940204be98
Instruction ID: fc41fff4218183506f9a3c2f30c53fc78b54f8673bb5df69e79520e149a8e65e
Opcode Fuzzy Hash: 561376d553875808623185583cee76178fcca891ae39a3640d50cc940204be98
Instruction Fuzzy Hash: 8AD012B53111C1538E10CA3CC4C1D27A25D2BA27647188729A124CA1D4DB30D840DA55

Function 00458ED1 Relevance: 5.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0000000D,?,0040183E), ref: 00458E52
HeapAlloc.KERNEL32(00000000,?,0040183E), ref: 00458E59

Part of subcall function 00458D6A: IsProcessorFeaturePresent.KERNEL32(0000000C,00458E40,?,0040183E), ref: 00458D6C

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,0040183E), ref: 00458E7B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,0040183E), ref: 00458EA8

Memory Dump Source

Source File: 0000001D.00000002.1939162817.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1939142324.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939208338.0000000000477000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939243339.0000000000490000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939263130.0000000000491000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939282443.0000000000494000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000001D.00000002.1939303132.0000000000498000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FlowTrackerExport.jbxd

Similarity

API ID: AllocHeapVirtual$FeatureFreePresentProcessProcessor
String ID:
API String ID: 4058086966-0
Opcode ID: cb52c2df3fd35c301bd37986e7fd03351829cb6d2469e4df832d77f7ba5cef58
Instruction ID: 8b15d7fb54190140a0953b99697dea96b44e03bdadc7f9358699ce3d0382e275
Opcode Fuzzy Hash: cb52c2df3fd35c301bd37986e7fd03351829cb6d2469e4df832d77f7ba5cef58
Instruction Fuzzy Hash: 5C01AD31604211ABEB215B24BC4AB1B3675EB90743F56013AFC08F63A1CF388C89CA6C

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FlowTracker_Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\5aa757.rbs

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\Chinese.xml

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\English.xml

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\French.xml

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\German.xml

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\Italian.xml

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\Japanese.xml

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\MultiLanguage.Dll

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\Portuguese.xml

C:\Program Files (x86)\Common Files\SonTek Shared\MultiLanguage2\Spanish.xml

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Base.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Communications.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\Graphics.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUI.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommUtils.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonCommunications.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDTP.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonData.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataBrowser.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataControls.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataExport.dll

C:\Program Files (x86)\Common Files\SonTek Shared\SonTek Components 2\SonDataLib.dll

Windows Analysis Report
FlowTracker_Setup.exe