Edit tour

Windows Analysis Report
AccessDatabaseuser.exe

Overview

General Information

Sample name:	AccessDatabaseuser.exe
Analysis ID:	1591991
MD5:	46b666e01d7ea03bc65ec5e1249f7d4b
SHA1:	0aa027c5d00ca67dd85eafeeb7ab245226331823
SHA256:	86fecfce83469b3f40ee93e0b54f433209c2bf5626d7f475761024e3f2d4a324
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	true
Confidence:	100%

Compliance

Score:	48
Range:	0 - 100

Signatures

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

AccessDatabaseuser.exe (PID: 5176 cmdline: "C:\Users\user\Desktop\AccessDatabaseuser.exe" MD5: 46B666E01D7EA03BC65EC5E1249F7D4B)

msiexec.exe (PID: 3248 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1880 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 6DCFC73376ADDBA52990B232DF33C952 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1372 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding E0883EF17785BDC605A083E905F940CD MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6140 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A0E0FCCBD52B915BB5099AA028D1FC6F E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Compliance

Uses 32bit PE files

Source: AccessDatabaseuser.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: AccessDatabaseuser.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Windows\System32\msiexec.exe

File opened: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcr90.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: AccessDatabaseuser.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: o\x86\ship\0\mso.dll\scpobfu\mso.pdb source: MSO.DLL.2.dr
Source:	Binary string: t:\ace\x86\ship\0\aceodbc.pdb6\ship\0\aceodbc.dll\bbtopt\aceodbcO.pdb source: ACEODBC.DLL.2.dr
Source:	Binary string: hip\0\opatchinst.exe\bbtopt\opatchinstO.pdb source: AccessDatabaseuser.exe
Source:	Binary string: t:\ses\x86\ship\0\opatchinst.pdb source: AccessDatabaseuser.exe
Source:	Binary string: t:\mso\x86\ship\0\mso.pdb source: MSO.DLL.2.dr
Source:	Binary string: t:\ace\x86\ship\0\aceodbc.pdb source: ACEODBC.DLL.2.dr
Source:	Binary string: t:\ace\x86\ship\0\aceoledb.pdb source: ACEOLEDB.DLL.2.dr
Source:	Binary string: t:\mso\x86\ship\0\mso.pdbo\x86\ship\0\mso.dll\scpobfu\mso.pdb)Z source: MSO.DLL.2.dr
Source:	Binary string: t:\ses\x86\ship\0\opatchinst.pdbhip\0\opatchinst.exe\bbtopt\opatchinstO.pdb source: AccessDatabaseuser.exe
Source:	Binary string: D:\office\Target\msishared\x86\ship\0\CustomActions\ocfxca.PDBzy source: MSI127D.tmp.0.dr
Source:	Binary string: \ship\0\aceoledb.dll\bbtopt\aceoledbO.pdb source: ACEOLEDB.DLL.2.dr
Source:	Binary string: t:\ace\x86\ship\0\aceoledb.pdb\ship\0\aceoledb.dll\bbtopt\aceoledbO.pdb source: ACEOLEDB.DLL.2.dr
Source:	Binary string: 6\ship\0\aceodbc.dll\bbtopt\aceodbcO.pdb source: ACEODBC.DLL.2.dr
Source:	Binary string: D:\office\Target\msishared\x86\ship\0\CustomActions\mainca.PDB source: MSI547B.tmp.2.dr
Source:	Binary string: D:\office\Target\msishared\x86\ship\0\CustomActions\ocfxca.PDB source: MSI127D.tmp.0.dr

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Networking

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.6:57101 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: MSO.DLL.2.dr	String found in binary or memory: http://beta.blogger.com/feeds/default/blogsatom:link
Source: MSO.DLL.2.dr	String found in binary or memory: http://nonexistant/proppanel.xsn
Source: AccessDatabaseuser.exe, 00000000.00000002.2507836334.00000000079F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://office.microsof
Source: MSO.DLL.2.dr	String found in binary or memory: http://officelive.com/
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/chart3http://purl.oclc.org/ooxml/officeDocument/customXml
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagram1http://purl.oclc.org/ooxml/drawingml/lockedCanvas.http:
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/picture.http://purl.oclc.org/ooxml/presentationml/main:http://p
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/bibliography1http://purl.oclc.org/ooxml/drawingml/chartDra
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/customPropertiesVj
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/docPropsVTypes
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/extendedProperties
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/attachedTemplate
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/audiovideo?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/calcChainchartsheets/
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/chartchart
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/chartsheet
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/commentAuthors
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/comments
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/controlembeddings/package?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/customProperties
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/customProperty
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/customXml/drs/
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/customXmlProps
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/diagramColors
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/diagramLayoutquickStyleHeader?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/diagramQuickStylecolorsHeader?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/endnotes
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/externalLink
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/externalLinkPath
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/font
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/fontTablefooter?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/footer
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/footnotesglossary/
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/frameafChunk?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/glossaryDocument
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/handoutMasterslideMasters/
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/header
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/htmlPubSaveAs
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/hyperlink
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/imagemedia?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeHeaderSource
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeRecipientData
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/notesSlide
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/numberingsettings
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/officeDocument
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/oleObjectuserXmlData?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/pivotCacheDefinition
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/pivotCacheRecords
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/pivotTable
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/presPropsslides/slide?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/queryTable
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/settings
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/sharedStringstables/table?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/sheetMetadatapivotCache/pivotCacheDefinition
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/slideUpdateUrl
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/slideslideUpdateInfo/
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/styles
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/tableSingleCells
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/tabletableSingleCells?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/tags
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/themeOverridetheme?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/themethemeThumbnail
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/transformthemeManager
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/usernamesvolatileDependencies
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/videohdphoto?
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/viewPropstags/
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/volatileDependencies
Source: MSO.DLL.2.dr	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/worksheetxmlMaps
Source: MSO.DLL.2.dr	String found in binary or memory: http://schemas.google.com/g/2005#post
Source: MSO.DLL.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: MSO.DLL.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSO.DLL.2.dr	String found in binary or memory: http://uri.etsi.org/01903#SignedProperties
Source: MSO.DLL.2.dr	String found in binary or memory: http://uri.etsi.org/01903/v1.3.2#
Source: MSO.DLL.2.dr	String found in binary or memory: http://www.blogger.com/feeds/default/blogs
Source: MSO.DLL.2.dr	String found in binary or memory: http://www.passport.com/NameSpace.xsd
Source: MSO.DLL.2.dr	String found in binary or memory: http://www.typepad.com/t/api
Source: MSO.DLL.2.dr	String found in binary or memory: http://xml.org/sax/features/external-parameter-entitieshttp://xml.org/sax/features/external-general-
Source: MSO.DLL.2.dr	String found in binary or memory: http://xml.org/sax/features/lexical-handler/parameter-entities
Source: MSO.DLL.2.dr	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: MSO.DLL.2.dr	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: MSO.DLL.2.dr	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: MSO.DLL.2.dr	String found in binary or memory: http://xml.org/sax/properties/lexical-handlero12:itemID
Source: MSO.DLL.2.dr	String found in binary or memory: https://docs.live.net/SkyDocsService.svcU
Source: MSO.DLL.2.dr	String found in binary or memory: https://office.bcentral.com/eServices/index?DPC=%ProductCode%&DCC=%AppComponentCode%&AppName=%Applic
Source: MSO.DLL.2.dr	String found in binary or memory: https://office.bcentral.com/eServices/service?Command=WebPost&DPC=%ProductCode%&DCC=%AppComponentCod
Source: MSO.DLL.2.dr	String found in binary or memory: https://www.google.com/accounts/ClientLogin

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Keylogger Generic

Source: Yara match

File source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL, type: DROPPED

System Summary

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\594d15.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI51B9.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{90140000-00D1-0409-0000-0000000FF1CE}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI541B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI542C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI547B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5612.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\GACLock.dat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\tmp\T50LY6O0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\tmp\T50LY6O0\Microsoft.Office.interop.access.dao.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\GACLock.dat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\tmp\9Y4YXQIY	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\tmp\9Y4YXQIY\NGBHLPX0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\tmp\9Y4YXQIY\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131238.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131238.0\9.0.30729.4148.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.manifest	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcm90.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcp90.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcr90.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131238.0\9.0.30729.4148.policy	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F58.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\594d17.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\594d17.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\GACLock.dat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\GACLock.dat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\pubpol181.dat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\GACLock.dat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\pubpol182.dat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\GACLock.dat	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI51B9.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D39CFE2	0_2_2D39CFE2
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D39BE63	0_2_2D39BE63
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D39E160	0_2_2D39E160
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D3939EF	0_2_2D3939EF
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D39C8EB	0_2_2D39C8EB
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D39C3A7	0_2_2D39C3A7

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: String function: 2D385E3A appears 92 times
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: String function: 2D38F7B1 appears 64 times
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: String function: 2D392906 appears 35 times

PE file contains executable resources (Code or Archives)

Source: MSOINTL.DLL.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: MSOINTL.DLL.2.dr	Static PE information: Resource name: None type: basic-16 executable not stripped
Source: MSOINTL.DLL.2.dr	Static PE information: Resource name: None type: DitPack archive data
Source: MSOINTL.DLL.2.dr	Static PE information: Resource name: None type: iAPX 286 executable large model (COFF) not stripped
Source: MSOINTL.DLL.2.dr	Static PE information: Resource name: None type: unknown readable demand paged pure executable
Source: MSOINTL.DLL.2.dr	Static PE information: Resource name: None type: ARC archive data, uncompressed
Source: MSOINTL.DLL.2.dr	Static PE information: Resource name: None type: DitPack archive data
Source: MSOINTL.DLL.2.dr	Static PE information: Resource name: None type: iAPX 286 executable large model (COFF) not stripped
Source: MSOINTL.DLL.2.dr	Static PE information: Resource name: None type: 68k Blit mpx/mux executable
Source: MSI547B.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

PE file does not import any functions

Source: ACERECR.DLL.2.dr	Static PE information: No import functions for PE file found
Source: STSLISTI.DLL.2.dr	Static PE information: No import functions for PE file found
Source: MSOINTL.DLL.2.dr	Static PE information: No import functions for PE file found
Source: MSOINTL.REST.IDX_DLL.2.dr	Static PE information: No import functions for PE file found
Source: MSOINTL.DLL.IDX_DLL.2.dr	Static PE information: No import functions for PE file found
Source: OFFICE.ODF.2.dr	Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: AccessDatabaseuser.exe, 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs AccessDatabaseuser.exe
Source: AccessDatabaseuser.exe	Binary or memory string: OriginalFilename vs AccessDatabaseuser.exe

Uses 32bit PE files

Source: AccessDatabaseuser.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: STSLISTI.DLL.2.dr

Static PE information: Section .rsrc

Source: classification engine

Classification label: clean6.winEXE@8/72@0/0

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: 0_2_2D387E35 GetDiskFreeSpaceExA,

0_2_2D387E35

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: 0_2_2D373001 CLSIDFromProgID,CoCreateInstance,

0_2_2D373001

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: 0_2_2D37EC30 FindResourceA,GetLastError,__CxxThrowException@8,LoadResource,LockResource,SysAllocString,

0_2_2D37EC30

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

File created: C:\Program Files (x86)\MSECache\AceRedist

Jump to behavior

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

File created: C:\Users\user\AppData\Local\Temp\Microsoft Access Database user 2010 (0).log

Jump to behavior

Source: AccessDatabaseuser.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

File read: C:\Users\user\Desktop\AccessDatabaseuser.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AccessDatabaseuser.exe "C:\Users\user\Desktop\AccessDatabaseuser.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6DCFC73376ADDBA52990B232DF33C952 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E0883EF17785BDC605A083E905F940CD
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A0E0FCCBD52B915BB5099AA028D1FC6F E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6DCFC73376ADDBA52990B232DF33C952 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E0883EF17785BDC605A083E905F940CD	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A0E0FCCBD52B915BB5099AA028D1FC6F E Global\MSI0000	Jump to behavior

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\InProcServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Automated click: Next >
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Automated click: I accept the terms in the License Agreement
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Automated click: Next >
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Automated click: Install
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Automated click: OK
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: AccessDatabaseuser.exe

Static PE information: certificate valid

PE /OLE file has a valid certificate with Microsoft as Issuer

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

Submission file is bigger than most known malware samples

Source: AccessDatabaseuser.exe

Static file information: File size 26557232 > 1048576

Uses new MSVCR Dlls

Source: C:\Windows\System32\msiexec.exe

File opened: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcr90.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: AccessDatabaseuser.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AccessDatabaseuser.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AccessDatabaseuser.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AccessDatabaseuser.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AccessDatabaseuser.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AccessDatabaseuser.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: AccessDatabaseuser.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: AccessDatabaseuser.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: o\x86\ship\0\mso.dll\scpobfu\mso.pdb source: MSO.DLL.2.dr
Source:	Binary string: t:\ace\x86\ship\0\aceodbc.pdb6\ship\0\aceodbc.dll\bbtopt\aceodbcO.pdb source: ACEODBC.DLL.2.dr
Source:	Binary string: hip\0\opatchinst.exe\bbtopt\opatchinstO.pdb source: AccessDatabaseuser.exe
Source:	Binary string: t:\ses\x86\ship\0\opatchinst.pdb source: AccessDatabaseuser.exe
Source:	Binary string: t:\mso\x86\ship\0\mso.pdb source: MSO.DLL.2.dr
Source:	Binary string: t:\ace\x86\ship\0\aceodbc.pdb source: ACEODBC.DLL.2.dr
Source:	Binary string: t:\ace\x86\ship\0\aceoledb.pdb source: ACEOLEDB.DLL.2.dr
Source:	Binary string: t:\mso\x86\ship\0\mso.pdbo\x86\ship\0\mso.dll\scpobfu\mso.pdb)Z source: MSO.DLL.2.dr
Source:	Binary string: t:\ses\x86\ship\0\opatchinst.pdbhip\0\opatchinst.exe\bbtopt\opatchinstO.pdb source: AccessDatabaseuser.exe
Source:	Binary string: D:\office\Target\msishared\x86\ship\0\CustomActions\ocfxca.PDBzy source: MSI127D.tmp.0.dr
Source:	Binary string: \ship\0\aceoledb.dll\bbtopt\aceoledbO.pdb source: ACEOLEDB.DLL.2.dr
Source:	Binary string: t:\ace\x86\ship\0\aceoledb.pdb\ship\0\aceoledb.dll\bbtopt\aceoledbO.pdb source: ACEOLEDB.DLL.2.dr
Source:	Binary string: 6\ship\0\aceodbc.dll\bbtopt\aceodbcO.pdb source: ACEODBC.DLL.2.dr
Source:	Binary string: D:\office\Target\msishared\x86\ship\0\CustomActions\mainca.PDB source: MSI547B.tmp.2.dr
Source:	Binary string: D:\office\Target\msishared\x86\ship\0\CustomActions\ocfxca.PDB source: MSI127D.tmp.0.dr

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: 0_2_2D38784B LoadLibraryA,GetProcAddress,FreeLibrary,

0_2_2D38784B

PE file contains sections with non-standard names

Source: STSLIST.DLL.2.dr	Static PE information: section name: .rtext
Source: ACEES.DLL.2.dr	Static PE information: section name: .rtext
Source: ACEEXCH.DLL.2.dr	Static PE information: section name: CURSORS
Source: ACEEXCH.DLL.2.dr	Static PE information: section name: BASE
Source: EXPSRV.DLL.2.dr	Static PE information: section name: user

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D39294B push ecx; ret		0_2_2D39295E
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D38F889 push ecx; ret		0_2_2D38F89C

Source: msvcr90.dll.2.dr

Static PE information: section name: .text entropy: 6.922045894978299

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File created: C:\Users\user\AppData\Local\Temp\MSI127D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI51B9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Microsoft Office\Office14\STSLIST.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\Source user\OSE.EXE	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Microsoft Office\Office14\1033\STSLISTI.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\tmp\T50LY6O0\Microsoft.Office.interop.access.dao.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcp90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\VBAJET32.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI542C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F58.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5612.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcm90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI547B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\tmp\9Y4YXQIY\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F58.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5612.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI51B9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcm90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI547B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\tmp\9Y4YXQIY\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\assembly\tmp\T50LY6O0\Microsoft.Office.interop.access.dao.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcp90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI542C.tmp	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: 0_2_2D388222 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_2D388222

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI127D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI51B9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office14\STSLIST.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\Source user\OSE.EXE	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office14\1033\STSLISTI.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\assembly\tmp\T50LY6O0\Microsoft.Office.interop.access.dao.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcp90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\VBAJET32.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI542C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6F58.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5612.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcm90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI547B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\assembly\tmp\9Y4YXQIY\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL	Jump to dropped file

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-17281
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-14831

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: MSO.DLL.2.dr

Binary or memory string: Whgfse

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	API call chain: ExitProcess graph end node			graph_0-15492
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	API call chain: ExitProcess graph end node			graph_0-15086

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: 0_2_2D38F7A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_2D38F7A3

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: 0_2_2D38784B LoadLibraryA,GetProcAddress,FreeLibrary,

0_2_2D38784B

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: 0_2_2D38EBE3 GetProcessHeap,HeapFree,

0_2_2D38EBE3

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D38F7A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_2D38F7A3
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D3970F3 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_2D3970F3
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Code function: 0_2_2D38F26F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_2D38F26F

HIPS / PFW / Operating System Protection Evasion

Source: MSO.DLL.2.dr	Binary or memory string: Shell_TrayWnd
Source: AccessDatabaseuser.exe, 00000000.00000002.2506753423.00000000035D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RemoveProgManItems
Source: AccessDatabaseuser.exe, 00000000.00000002.2506753423.00000000035D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CreateProgManItems
Source: AccessDatabaseuser.exe, 00000000.00000003.2151144618.0000000001178000.00000004.00000020.00020000.00000000.sdmp, AccessDatabaseuser.exe, 00000000.00000003.2151282677.0000000001189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Removing Program Manager items
Source: AccessDatabaseuser.exe, 00000000.00000002.2506753423.00000000035D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Removing Program Manager items\|
Source: AccessDatabaseuser.exe, 00000000.00000003.2151144618.0000000001178000.00000004.00000020.00020000.00000000.sdmp, AccessDatabaseuser.exe, 00000000.00000003.2151282677.0000000001189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Creating Program Manager itemsde
Source: AccessDatabaseuser.exe, 00000000.00000002.2506753423.00000000035D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Creating Program Manager itemsI

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: GetLocaleInfoA,

0_2_2D39DD43

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AccessDatabaseuser.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\Windows\assembly\tmp\T50LY6O0\Microsoft.Office.interop.access.dao.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\Windows\assembly\tmp\9Y4YXQIY\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: 0_2_2D39295F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_2D39295F

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Code function: 0_2_2D382FF7 _memset,GetVersionExA,GetVersionExA,GetVersionExA,GetLastError,__CxxThrowException@8,GetSystemDefaultLangID,GetUserDefaultLangID,GetModuleFileNameW,

0_2_2D382FF7

Source: C:\Users\user\Desktop\AccessDatabaseuser.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Native API	1 DLL Side-Loading	2 Process Injection	31 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	26 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AccessDatabaseuser.exe	0%	Virustotal		Browse
AccessDatabaseuser.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL	3%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\VBAJET32.DLL	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\Source user\OSE.EXE	0%	ReversingLabs
C:\Program Files (x86)\Microsoft Office\Office14\1033\STSLISTI.DLL	0%	ReversingLabs
C:\Program Files (x86)\Microsoft Office\Office14\STSLIST.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI127D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI51B9.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI542C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI547B.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5612.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6F58.tmp	0%	ReversingLabs
C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcm90.dll	0%	ReversingLabs
C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcp90.dll	0%	ReversingLabs
C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcr90.dll	0%	ReversingLabs
C:\Windows\assembly\tmp\9Y4YXQIY\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll	0%	ReversingLabs
C:\Windows\assembly\tmp\T50LY6O0\Microsoft.Office.interop.access.dao.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://purl.oclc.org/ooxml/officeDocument/relationships/diagramLayoutquickStyleHeader?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/hyperlink	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/imagemedia?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/videohdphoto?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/drawingml/picture.http://purl.oclc.org/ooxml/presentationml/main:http://p	0%	Avira URL Cloud	safe
http://schemas.google.com/g/2005#post	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/handoutMasterslideMasters/	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/controlembeddings/package?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/notesSlide	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/extendedProperties	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/themethemeThumbnail	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/externalLink	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/calcChainchartsheets/	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/attachedTemplate	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/endnotes	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/sharedStringstables/table?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/commentAuthors	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/drawingml/chart3http://purl.oclc.org/ooxml/officeDocument/customXml	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/customXml/drs/	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/comments	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/bibliography1http://purl.oclc.org/ooxml/drawingml/chartDra	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/fontTablefooter?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/chartsheet	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/drawingml/diagram1http://purl.oclc.org/ooxml/drawingml/lockedCanvas.http:	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/docPropsVTypes	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/header	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/tags	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/slideslideUpdateInfo/	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/usernamesvolatileDependencies	0%	Avira URL Cloud	safe
http://beta.blogger.com/feeds/default/blogsatom:link	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/customXmlProps	0%	Avira URL Cloud	safe
http://xml.org/sax/features/lexical-handler/parameter-entities	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeRecipientData	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/diagramColors	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/themeOverridetheme?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/styles	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/pivotCacheRecords	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/chartchart	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/sheetMetadatapivotCache/pivotCacheDefinition	0%	Avira URL Cloud	safe
http://www.passport.com/NameSpace.xsd	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/customProperty	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/oleObjectuserXmlData?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/slideUpdateUrl	0%	Avira URL Cloud	safe
https://office.bcentral.com/eServices/index?DPC=%ProductCode%&DCC=%AppComponentCode%&AppName=%Applic	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/pivotTable	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/presPropsslides/slide?	0%	Avira URL Cloud	safe
https://office.bcentral.com/eServices/service?Command=WebPost&DPC=%ProductCode%&DCC=%AppComponentCod	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/pivotCacheDefinition	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/frameafChunk?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/customProperties	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/queryTable	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/officeDocument	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/viewPropstags/	0%	Avira URL Cloud	safe
http://xml.org/sax/properties/lexical-handlero12:itemID	0%	Avira URL Cloud	safe
http://uri.etsi.org/01903#SignedProperties	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/diagramQuickStylecolorsHeader?	0%	Avira URL Cloud	safe
http://xml.org/sax/features/external-parameter-entitieshttp://xml.org/sax/features/external-general-	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/footnotesglossary/	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/htmlPubSaveAs	0%	Avira URL Cloud	safe
http://office.microsof	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/numberingsettings	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/volatileDependencies	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/settings	0%	Avira URL Cloud	safe
http://officelive.com/	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/transformthemeManager	0%	Avira URL Cloud	safe
http://uri.etsi.org/01903/v1.3.2#	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/worksheetxmlMaps	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/audiovideo?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/tabletableSingleCells?	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeHeaderSource	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/footer	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/glossaryDocument	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/externalLinkPath	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/tableSingleCells	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/relationships/font	0%	Avira URL Cloud	safe
http://purl.oclc.org/ooxml/officeDocument/customPropertiesVj	0%	Avira URL Cloud	safe
http://nonexistant/proppanel.xsn	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://purl.oclc.org/ooxml/officeDocument/extendedProperties	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/notesSlide	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/imagemedia?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/diagramLayoutquickStyleHeader?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/hyperlink	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/handoutMasterslideMasters/	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/controlembeddings/package?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	MSO.DLL.2.dr	false		high
http://purl.oclc.org/ooxml/drawingml/picture.http://purl.oclc.org/ooxml/presentationml/main:http://p	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/themethemeThumbnail	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/accounts/ClientLogin	MSO.DLL.2.dr	false		high
http://schemas.google.com/g/2005#post	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/features/namespace-prefixes	MSO.DLL.2.dr	false		high
http://www.typepad.com/t/api	MSO.DLL.2.dr	false		high
http://purl.oclc.org/ooxml/officeDocument/relationships/videohdphoto?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/calcChainchartsheets/	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/bibliography1http://purl.oclc.org/ooxml/drawingml/chartDra	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/customXml/drs/	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/externalLink	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/sharedStringstables/table?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/endnotes	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/attachedTemplate	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/commentAuthors	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/comments	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/drawingml/chart3http://purl.oclc.org/ooxml/officeDocument/customXml	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/chartsheet	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/fontTablefooter?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/docPropsVTypes	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/drawingml/diagram1http://purl.oclc.org/ooxml/drawingml/lockedCanvas.http:	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/header	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/tags	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/slideslideUpdateInfo/	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://beta.blogger.com/feeds/default/blogsatom:link	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/customXmlProps	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/usernamesvolatileDependencies	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/features/lexical-handler/parameter-entities	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeRecipientData	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/themeOverridetheme?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
https://docs.live.net/SkyDocsService.svcU	MSO.DLL.2.dr	false		high
http://purl.oclc.org/ooxml/officeDocument/relationships/diagramColors	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/sheetMetadatapivotCache/pivotCacheDefinition	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/pivotCacheRecords	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/styles	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/chartchart	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/customProperty	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://www.passport.com/NameSpace.xsd	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
https://office.bcentral.com/eServices/index?DPC=%ProductCode%&DCC=%AppComponentCode%&AppName=%Applic	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/pivotTable	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	MSO.DLL.2.dr	false		high
http://purl.oclc.org/ooxml/officeDocument/relationships/pivotCacheDefinition	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
https://office.bcentral.com/eServices/service?Command=WebPost&DPC=%ProductCode%&DCC=%AppComponentCod	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/slideUpdateUrl	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/features/namespaces	MSO.DLL.2.dr	false		high
http://purl.oclc.org/ooxml/officeDocument/relationships/oleObjectuserXmlData?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/frameafChunk?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/presPropsslides/slide?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/officeDocument	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/queryTable	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/customProperties	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/viewPropstags/	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://uri.etsi.org/01903#SignedProperties	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/properties/lexical-handlero12:itemID	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/footnotesglossary/	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/settings	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/htmlPubSaveAs	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/numberingsettings	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://office.microsof	AccessDatabaseuser.exe, 00000000.00000002.2507836334.00000000079F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://officelive.com/	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://www.blogger.com/feeds/default/blogs	MSO.DLL.2.dr	false		high
http://purl.oclc.org/ooxml/officeDocument/relationships/diagramQuickStylecolorsHeader?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/features/external-parameter-entitieshttp://xml.org/sax/features/external-general-	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/volatileDependencies	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/transformthemeManager	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://uri.etsi.org/01903/v1.3.2#	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/worksheetxmlMaps	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/tabletableSingleCells?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/audiovideo?	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/externalLinkPath	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/glossaryDocument	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeHeaderSource	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/footer	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/tableSingleCells	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/relationships/font	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.oclc.org/ooxml/officeDocument/customPropertiesVj	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://nonexistant/proppanel.xsn	MSO.DLL.2.dr	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/properties/lexical-handler	MSO.DLL.2.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591991
Start date and time:	2025-01-15 16:20:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AccessDatabaseuser.exe
Detection:	CLEAN
Classification:	clean6.winEXE@8/72@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 60% Number of executed functions: 45 Number of non-executed functions: 72
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.253.45, 4.175.87.197, 52.149.20.212
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL	https://download.brother.com/welcome/dlfp100270/cltw10100a.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL	https://download.brother.com/welcome/dlfp100270/cltw10100a.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL	https://download.brother.com/welcome/dlfp100270/cltw10100a.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\594d16.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	530141
Entropy (8bit):	4.817426866212445
Encrypted:	false
SSDEEP:	6144:oIuF+D6zvOCmDoarvNj71RdVJ5QJKfE1V5pjVEMYJ0CFstNWeTgT+Y0PZ5L+mhQa:o7Z
MD5:	8A902E436C747B7D58262B7172D6AA51
SHA1:	A35781F0E30AAE5283397EC2D7B0A3AE9139C9A8
SHA-256:	A3EF3D646165BECC8E635C83AD74D46ED407EBE583699A1E3CC80B104014DD9E
SHA-512:	AC88A97DE7716769AE07A2545EBC2A277911A581F889E7C7E9E89A1B22F6F6A068CA915FEF9072BED7AF1615CD30CFC44D921574BF95E6230592E8E9226DC110
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.R/Z.@.....@.....@.....@.....@.....@......&.{90140000-00D1-0409-0000-0000000FF1CE}/.Microsoft Access database user 2010 (English)..AceRedist.msi.@.....@g....@.....@........&.{05CF0009-88BA-4D1A-86DA-5DE0B6FAEFF2}.....@.....@.....@.....@.......@.....@.....@.......@..../.Microsoft Access database user 2010 (English)......Rollback..Rolling back installation..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{398E906A-826B-48DD-9791-549C649CACE5}&.{90140000-00D1-0409-0000-0000000FF1CE}.@......&.{A6D1C76C-5B2F-4D54-8682-95738E88B3AC}&.{90140000-00D1-0409-0000-0000000FF1CE}.@......&.{88D5AF78-19C6-4D47-B4EC-5BAF83D02E92}&.{90140000-00D1-0409-0000-0000000FF1CE}.@......&.{1CDB09B8-58BA-46B5-B334-0F38167D3AC1}&.{90140000-00D1-0409-0000-0000000FF1CE}.@......&.{C6715366-3AA7-4E71-A4BC-A2DBC3CD387E}&.{90140000-00D1-0409-0000-0000000FF1CE}.@......&.{77F30F62-59C5-4A99-A003-700584527465}&.{90140000-00D1-0409-0000-00000

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	196520
Entropy (8bit):	3.753723863615446
Encrypted:	false
SSDEEP:	3072:MRZnGkviXjj80ggbjD1UECecjgQd999oW:awNKg01
MD5:	57AEA755AF17E7FEEC88CC9C6DF34A86
SHA1:	9C87A768E9C808444AC1F3F70B1994704844B00B
SHA-256:	0C1A2237AEC785322AE37A7C4BABA8AC57277AA5EC5AA9FBF6869B4BC337553E
SHA-512:	85ED5F9AFD163E2D944CE2ECBD5E56EC0EA95EB88D7EF82DD96F659EF7C21467C217820AD24C9441255FD505A6363C3BC1DF3F1E9032B3265709A96A6377F4DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=\.y=..y=..y=..^...{=..pE..z=..y=..^=..pE..x=..pE..{=..pE..u=..pE..x=..pE..x=..pE..x=..Richy=..........PE..L...3..K...........!......................... .....;......................... ............@.............................N.......<....@..<.......................0.......8...............................@............................................text...f........................... ..`.data...T....0......................@....rsrc...<....@......................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51632
Entropy (8bit):	4.466389822271565
Encrypted:	false
SSDEEP:	768:HVSFg9T1uDGTpRNz/5sJ+YL35YYXrabS2DuRPnMi2jpvW:1SEsyhziJTL35linyM95W
MD5:	6B228FAB530430AE7152500D238C20FE
SHA1:	28063BDD02282D2909FBD93A3BA04EE77AA88A39
SHA-256:	1CA7B6B024F64E43DD1E14DC667E76D3E48B649C4119777E30112B5E54DB7B8D
SHA-512:	4F4560BEB337ADA91F41D801A0E99C77D9F729AA8FD0E30419F14E5B297BBE2473618D488999E39500DA9A2A8CA62D827A757CAAEDF28B8D485B897540B7A2D7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=\b.y=..y=..y=..^.w.{=..pE..z=..y=..[=..pE..x=..pE..{=..pE..x=..pE..x=..pE..u=..pE..x=..Richy=..................PE..L...K:.K...........!.........................0....q;......................................@.........................<.......l"..<....@..T.......................$....%..8...............................@............................................text...t........................... ..`.data...X....0......................@....rsrc...T....@......................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20432
Entropy (8bit):	5.1271470036934925
Encrypted:	false
SSDEEP:	384:Dz6KD4mw5Q8S8dGCVxqR9cGCXEWW6MlWKLXci2jXHUoJd:f6KD4mw5Q8PdhxqR649Mi2jXHUE
MD5:	86EFA17A232685397C9A8F8D42DC5ED3
SHA1:	56E57D92EBE6ED42938EEBCD517DF0A0C70EAA0A
SHA-256:	FF5015328F1D632585B38A7096DF0DC710B32B744227A14570C0ED0C4CAFA1CF
SHA-512:	BFCA427F2D1F960F1750E244759B33677B40B2689B2BD7CD0C044926D8342B9E972BA484C5F79858659E6D6E08E032B8A792227542D2D9653BFAF39AB7DA010D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e..W...W...W...^\|R.V...^\|T.V...^\|Q.V...RichW...........PE..L....6.K...........!.........6...............................................`......}.....@......................... ...4............ ..$2...........8...............................................................................................rdata..............................@..@.rsrc...$2... ...4..................@..@.....6.K........W...T...T............6.K....H...........................ACERECR.DLL.RSDS..o....J.`.....>....D:\office\Target\ACE\X86\ship\1033.pre\acerecr.PDB.acerecr.pdb..............................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	854128
Entropy (8bit):	4.949201225668175
Encrypted:	false
SSDEEP:	12288:XRmLWu06UEPvhjlhu9kHY5jtdKMyWnZ5z39jjyaoK:XRm7UEnH49kH+tdTIaoK
MD5:	156A5A97CB5391CA8ABD03A6EEB45B6B
SHA1:	29ECF920FC05F288C5DEC67E7EA2DDAECD8D07B6
SHA-256:	FBFB03025734AD84BE663DBE75D52F7DC9871AAE1F582E07E2210C7B1BCBBEE5
SHA-512:	5823518FD642644CA400579411850BFCE4D02E7E3457D3D4C783D53D9158D8CF54DE828B043055F8B1A3730A321CD643F0F1116695A01C69B4CA9016BA63B03D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&..u..u..u...u..u...u..u..u..u...u..u...u..u...u..u...u..u...u..u...u..uRich..u................PE..L.....P...........!.....f...........j.............:......................... ......Y.....@.........................\o..P....o..<.......................p.......<....t..8...........................H...@............................................text...ve.......f.................. ..`.data....q.......p...j..............@....rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2499680
Entropy (8bit):	6.044446425373023
Encrypted:	false
SSDEEP:	24576:RkLHgZpJk5S/vz4abLCj6eMfgpxjREUNn89nlbFyKfilKxOqZou:RkLHkJk5+CEL9lbFzfvZou
MD5:	47DBD73563490D9828E596F86DBE31EB
SHA1:	A8EA4D08C0C1481CE97FD18A8A38E9B3BE5AF3F7
SHA-256:	C941C6F013A6847EFB4674DB8D028E2B17F56FED240029A5696D23D83BAFFD5C
SHA-512:	CF5D62CDAB3B450A1C0676FD4AEA7F99A8DCCA7BFF1271FF4764868C43568CD2AF6644DBDFE099FF133387EAE42BC3CE5D7C6C944A76C0AA2F6500977080EC71
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e..W..W..W..^\|\|.V..^\|z.V..W.y.V..^\|..V..RichW..................PE..L...v<.P...........!..........&....................9.........................0&......P&...@.......................................... ....&...........&.`...............8............................................................................text...............................@..@.rsrc.....&.. ....&.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55680
Entropy (8bit):	4.869093237347097
Encrypted:	false
SSDEEP:	1536:DyeRlCBm+j9POROulFnU/kvEnshMV9dj4w95D:Dm+KkvEshMV9Z4w95D
MD5:	8E81A111FC922524F7A3FF9679A2626C
SHA1:	D01D7C61D537848DEB177D2382471C04D7BBC1F4
SHA-256:	77EC6E1DDE0D20F8A02C9A2D20B4F2BF806BB382FFE2977A000987F99E483BD4
SHA-512:	DD4418973B9184FFB6D5873E4AC2570332AC29F2A235CBF79FC09A21721E685474CF3739DA5ABB9B7DA50F4C5AACD2C1FCDE51FB40AC927C4EB0BCB8F80ACCE1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e..W...W...W...^\|R.V...^\|T.V...^\|Q.V...RichW...........PE..L....VIK...........!.................................................................V....@.......................................... ..................................8............................................................................text...............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1388416
Entropy (8bit):	5.051999983508193
Encrypted:	false
SSDEEP:	12288:lcji8e43+V30ZGtlSb7XoTonuEZT8FRCas+DuTTCM1rX2Uu:yjoPVqwgMEXoFsasiETu
MD5:	656DCD78613F7716BA4EAA5A5F3DA4FD
SHA1:	A6D32A5F0148E251298C145DA5B16DF6F4C6C089
SHA-256:	BBE053F7FA668F5177002DF53A0C43A18DEBE7A4F15A2E2B62968E114022EBE9
SHA-512:	6EA71CF15AB4CDBE458EBA035EE63196B03FAA306676E50AE2A54B01760E174C5EC631D78558BF9519E17A8DD33B05E4A6E9FFED89CEA62333CD76280C528D16
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e..W...W...W...^\|R.V...^\|T.V...^\|Q.V...RichW...........PE..L....VIK...........!.........................................................@......G&....@.......................................... ..................................8............................................................................text...............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1843816
Entropy (8bit):	6.58873367940625
Encrypted:	false
SSDEEP:	49152:dsIe2OWReRcTwbKl3cGdBdi8h3cLda5RmhYU1:k2OhRsw2rTU+sLOmq8
MD5:	96B518B62E482D74404D5F1F8C240D8F
SHA1:	242D49EE16F77EE297C6F70D9371E4367A709FB7
SHA-256:	CC403B95CA190153D829FC5605B09E8C5398A5EAB52B5F553E798A5CF4FE647D
SHA-512:	FD5E97CC9E88416712376FBCDACC0BA39A218774DD0C3128B989726C48BAEA6B20DE1C64B1A6A0ED78C4BCA7BC3CDF8C9708EA9DAC3FB45AFDE552630EFC1303
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O......................VM.....raH......VK................D/...\|Z......VZ.....V].Y....VL......VJ......VO.....Rich............................PE..L....Y"Q...........!.................X.......@.....4.......................... ......v....@.............................................................h...........h...8...............................@...................h........................text............................... ..`.data...<........N..................@....rsrc...............................@..@.reloc...............&..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	544920
Entropy (8bit):	6.361519985458099
Encrypted:	false
SSDEEP:	6144:x4J20DX6qhIAq04x4au344ELsrx0PIpQWjC8u+MGQfqpyToP1hOqqV8i7EVW5n:6J2rqhIAqNx4YPIbW2M9xG+
MD5:	CC98FD9B25BE402A9C9ED9B32B0EE65A
SHA1:	6132E99E062CDD38386A6ADEAF80FC219C815BA3
SHA-256:	F72F11766BB445BD09A098F481E2BF0380F130A8F6A19CEA48FA3C2B0363579B
SHA-512:	4B6E968B2BE96A8E110F31A2DDF002872189A0559EF0F1F5458AB414879875FEFFE93E43BBE99E7A2533F850A86A56BE963B2A3F646F87FF65AA2DB5B5F73DFF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..G.G.G.....G.?y..G.<.\|..G.?...G..n..G.....G.G.HG.?n..G.?i..G.?x..G.?~..G.?{..G.Rich.G.........................PE..L....Y"Q...........!.........p...............0....I;.........................p............@.............................q...............h............6..........._......8...........................0...@...............L... ...@....................text...u........................... ..`.rdata..............................@..@.data.... ..........................@....rsrc...h...........................@..@.reloc..._.......`..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37000
Entropy (8bit):	5.95155452052304
Encrypted:	false
SSDEEP:	768:6suhMhbm3aj5Qqp9QecUM5nepP1Vnlc+8tVqOXOH/+9MQnFiN:qmhiqd99QecBnepP1VqNqOXOH/OMQFk
MD5:	2328DAB740F3058B0BC040AAD2839F82
SHA1:	4DB709051101AABA648964152D8319AE22DBF018
SHA-256:	D293B39FF640806AAD93EE3C0E8D868CF1FD7F5AC0B1AB5389F2C67C2BF281FE
SHA-512:	ECBF6AC141B88E1CC2A6E536B31322CC6B44C2EE21D6BB7B5B3D52C2C9BB464528B4B6EB39398714111C106066DC888F4CCA25098B9C6A261793A3C86BDF5F70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nC.."..".."..#Z.)"...m/.+"..#Z,.+"....."".."..n"..#Z=.,"..4p=.+"..#Z:.:"..#Z+.+"..#Z-.+"..#Z(.+"..Rich"..................PE..L....Y"Q...........!.....b...........b.............;................................t.....@..........................j......$l..d....................v..........,...`q..8...........................xH..@....................k..@....................text....a.......b.................. ..`.data................f..............@....rsrc................h..............@..@.reloc..,............r..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	647816
Entropy (8bit):	6.50038271256333
Encrypted:	false
SSDEEP:	12288:fIU6G4s8HvmNw7EhGOGrdZlI0EVSVa9H89vjgYE1Uhfk9HJds3KUvNx3z:fIUfm7EhG1VnvjgYE1UQM3Bvz
MD5:	89F04D75CEB70DEAB2C8D47E15F906C0
SHA1:	9E446147005A9A7B7F11F39F2F831EEB20E64884
SHA-256:	236D1696D354E5C1DEFFDD054DF1AA34641C6938BC6F854D69206BCCE36483E9
SHA-512:	801A7CD5355BAB95753DD3CBA1CA61F0E679858A0C96CA3F730FEC6DBB618F1EB8B1EA57A28956A88CE7017E397FEA92A6E098B38A83D5B8959E9B7628DB2861
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t...S..r...}f!.p....Q$.u...}f'.s...S..y...t...D...}f1.d...jL6.q...}f6.....}f .u...}f&.u...}f#.u...Richt...........................PE..L....Y"Q...........!.........<.....................:......................................@.........................4............................................j......8...............................@...............x.......@....................text............................... ..`.data...T.... ...<..................@....rtext..L............P..............@....rsrc................R..............@..@.reloc...j.......l...\..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	335488
Entropy (8bit):	6.150025799390155
Encrypted:	false
SSDEEP:	6144:i1hOv9vcTu7gBCXZTsa2KnhOL8QfaggevjqB12J6d+K6g89a4UM9:i1hOv9v3gg+Kw8QOevjqB1Q6MgOf
MD5:	D32C20FEB3D64EC5089F236D33A1085E
SHA1:	FC2E07BB38DE7930C2DB8136C5EF958B57129C4D
SHA-256:	A021D7AAF7B2B092D8261E5527D46737297133076B477E465D4E3895B0210DDB
SHA-512:	B1D27602206A52D0907C6DBC90386CDA88580F5E689E7E050E130EABA9D17C45154BA4CD65A70373F9BE653885B163EF6723AFADC1D9A9357DA79527DEFED68F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Un.4...4...4..<{...4...L...4...L...4....{..4...4..D4...f...4...L...4...L...4...L...4...L...4...L...4..Rich.4..................PE..L....Y"Q...........!.........t...............0.....;.........................P......(>....@.........................l...`.................................... ...#......8...........................P)..@.......................`....................text...#........................... ..`CURSORS............................. ..`BASE.....C...p...D...V.............. ..`.data....D.......<..................@....rsrc...............................@..@.reloc...#... ...$..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	646368
Entropy (8bit):	6.4012103251120624
Encrypted:	false
SSDEEP:	12288:pKpSQ7k2f52toU3zg9I0ETQrLyWpV7BliKrMnY2VW7Sz+U34VeM9kt00cIL:UC2f5qj8ft7DiK8Y2LM9g04
MD5:	0DF4C75F989A6BD872FB1748EBC78C5B
SHA1:	88CCE5ACD03E8A5B4E51980C4BF0E40FEA6F245D
SHA-256:	FF2F548DFE8B2F9BD6A23567618D2C16DCE31AA7098DDB438212162B9A305D4C
SHA-512:	BD73E0A9AD9E2E922CA577768DDB761FAC6D70560672C786CDB78FC0E4624DEFEA82905D444F5FBAB837D20F4B952599F25FAEDAEC3D10BA65789B8C1C900118
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......rG.p6&.#6&.#6&.#...#2&.#?^n#2&.#.ik#7&.#?^h#<&.#...#=&.#6&.#.'.#(ty#3&.#?^~#(&.#?^y#`&.#?^o#7&.#?^i#7&.#?^l#7&.#Rich6&.#........................PE..L......Q...........!.........:......R ............y;.........................0............@.........................$...X...h........p..LO.......................d..,...8...............................@...............@...\|........................text............................... ..`.data...`........:..................@....rsrc...LO...p...P..................@..@.reloc...d.......f...\..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	279696
Entropy (8bit):	6.187651099619222
Encrypted:	false
SSDEEP:	6144:cUSIfxXcPgItf81u6PR/9YhoRsHiTsUITSlOLWa:cUfxMNtf8o6IZTj
MD5:	5A77F7C098483B429B51EA528352385B
SHA1:	910D853666175F0BE0C6904DF46252CDF997FF20
SHA-256:	F92F2DF951FAAAC1CDAC9C310999C88335DB66090D7D4696E63108A1B6D90952
SHA-512:	337F3F3EDB8372B9BD2F56A62494AF275972BBDA6B70A1917E4CF4E3B4D9B31E585DA31FBD684C4563700FF7A66FB9A8C4A43AE081F45A5F48C2A1775FB79B4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,.Guh.)&h.)&h.)&OOR&f.)&v.&i.)&OOG&i.)&OOD&j.)&a.&k.)&h.(&z.)&..&i.)&a.&a.)&a.&`.)&a.&i.)&a.&i.)&a.&Y.)&a.&i.)&Richh.)&........PE..L......Q...........!.....(........................j;.........................P............@.................................,'.......................*.......0..8...(7..8............................B..@....................%.......................text....'.......(.................. ..`.data....^...@...Z...,..............@....rsrc...............................@..@.reloc..8....0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15536
Entropy (8bit):	6.386167857098985
Encrypted:	false
SSDEEP:	192:hwkbQBT5m3XGt+wCXdlRW4iN5WzojS6T49LP0nWxs/nGfe4pBjS7:h7bQBVa2UPNlRW4iN5WuKMnC0GftpBj
MD5:	5CCBE894C2780CA8E595AF2AAE5BC3DC
SHA1:	5B7C0BC00884FD1F8E9AC6E0C92CFA835957DF43
SHA-256:	7CA0D67CBE38258DA5DF41C1277BE03150CE718FB9C67E3971F74661DF33EE10
SHA-512:	36FBFC8F1B6298D5291D947466DD33112515B143AA0CD3613D7655234CD1AFE80B717137DEE1C54F8C78B35D78B86A18C913A82C93751EE423B4A7737AD4F858
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.AY.\|.Y.\|.Y.\|.~...[.\|.Pv..\.\|.Y.}.\|.\|.Pv..X.\|.Pv..[.\|.Pv..X.\|.Pv..X.\|.Pv..T.\|.Pv..X.\|.RichY.\|.........................PE..L....d.P...........!.........................0...............................`.......U....@.............................N.......P....@...............".......P..0.......8...............................@............................................text...I........................... ..`.data...T....0......................@....rsrc........@......................@..@.reloc..0....P....... ..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15536
Entropy (8bit):	6.387123377633282
Encrypted:	false
SSDEEP:	384:o7bQBb2UPNpW4AN5WuZBMnC0GftpBjpTqp:oIbzFmyiip
MD5:	FCC0FB3C183027C9FEDB62AC25AF9F58
SHA1:	31066AAE191B46EB698DC109001A7B9585C7FB9F
SHA-256:	9E40C9907FACC3AE387A4948D2E9A28CF46A1B76601511627FE6A6C1D1307BBD
SHA-512:	EF4C7D811390B7FA5E781C92FC47B259883634CD2DB1D9B211572FC77C99B699D5132CE962D183B784B192C211396E4854C6448B04C1CC1117691B339865560C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.AY.\|.Y.\|.Y.\|.~...[.\|.Pv..\.\|.Y.}.\|.\|.Pv..X.\|.Pv..[.\|.Pv..X.\|.Pv..X.\|.Pv..T.\|.Pv..X.\|.RichY.\|.........................PE..L....d.P...........!.........................0...............................`......=O....@.............................N.......P....@...............".......P..0.......8...............................@............................................text...I........................... ..`.data...T....0......................@....rsrc........@......................@..@.reloc..0....P....... ..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15528
Entropy (8bit):	6.386752778069314
Encrypted:	false
SSDEEP:	192:NwkbQBTV3XGt+wCXdOWBuN5WzojFU49LP0nWxs/nGfe4pBjSjYi:N7bQB92UPNOWBuN5WuFMnC0GftpBji
MD5:	8430C591B95A0F610174028C94590915
SHA1:	3334723C8F4217960B2EE897FDDF4E633656939D
SHA-256:	AD4E47AD1B6E9E5EF0A76CECCF11AEB37AE6C09036763811790EB7EDF45A2E48
SHA-512:	B40924054CC877BDF8BB523EFC60DAB54F2F543A33E21B92EE9B7FE6C4603B02BA27C319F9FE7285B627E5C501597761517EBB7D132134BFAF77D6E686624CC3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.AY.\|.Y.\|.Y.\|.~...[.\|.Pv..\.\|.Y.}.\|.\|.Pv..X.\|.Pv..[.\|.Pv..X.\|.Pv..X.\|.Pv..T.\|.Pv..X.\|.RichY.\|.........................PE..L....d.P...........!.........................0...............................`............@.............................N.......P....@...............".......P..0.......8...............................@............................................text...I........................... ..`.data...T....0......................@....rsrc........@......................@..@.reloc..0....P....... ..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	378072
Entropy (8bit):	6.315928496615918
Encrypted:	false
SSDEEP:	6144:T6Cdhj/QQE94WAja85YxWQii1IBT4RvSG+FsOchO+t3R:uCnjohdSd6WQl1IJ4Rmw
MD5:	77A745B9C26ACCABF98218D5942EAA19
SHA1:	29ADEF32998E80C2736FCC816ACCF9F207A5D7A6
SHA-256:	A41D677F0F0F1CCC1A49E9EC776CECE17EA015B115D9E799128F3FF943924064
SHA-512:	E35E12F38CCC463F7933ACFF24CAB9B1D08FF69F951118689D0D7072191A80C912CFF5E939E45B6348DF14EC93DF94636A15EBAD449111F65D13367BD72FF1A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y,..=M..=M..=M.....;M..454.?M..452.8M.....6M..=M...M....1.?M..#.#.8M..45$./M..45#..M..455.<M..453.<M..456.<M..Rich=M..........................PE..L....{:Q...........!................c........P....b;.....................................@..........................=......DA...................................@......8........................... ...@............ .......>.......................text...Y........................... ..`.rdata..l*... ...,..................@..@.data...d$...P..."...<..............@....rsrc................^..............@..@.reloc...@.......@...j..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	330360
Entropy (8bit):	6.528015153785932
Encrypted:	false
SSDEEP:	6144:JRB24SfaVGWtWyyr7Xo53wSTWu6Ibj3mNF/lGH0IebN469wFwY3XzChO8U4yC:JyAgWtWyI7XaAsuO3mLlm0ICCwY39C
MD5:	F96DE7533E0E5F8F1692D49EE25149B5
SHA1:	372205709C4D16A31086CF6CB78E36773465C892
SHA-256:	93D5CEF72875FE841309550A1EEDDFD0EFDA95515E60B002871A426A2AB57EC3
SHA-512:	88778F53A51C447FD0FB9433EDA3E9149CE3F5E7788765ACD0BE117C4FF47A44A646DC9A3782D3F9592D25CBCF89695389D477E985CB561B027BDE907DA44C60
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...........{B....(LG.....{D...................7...QU.....{U.....{R.....{C.....{E.....{@....Rich...................PE..L......Q...........!.........F.......W.......P....s;......................... ......o ....@............................7...\|...x.......................x........(......8........................... k..@.......................@....................text............................... ..`.data...8...........................@....rsrc...............................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45728
Entropy (8bit):	6.408659815115089
Encrypted:	false
SSDEEP:	768:6CbM2w2UZJFXXH6I0G2jY5E6QaItPY3OI/wvH70D0SFsKgy3Z6ehOpl+YLBKRviE:6CbM2w2AHXH6jRiJQaItPkOQ2H3Kgy3j
MD5:	9A384587D2BB88F7646DF38B5D3E3BA9
SHA1:	86A8CF4EAFCF4C06B5CF9C386CF2A1D060241557
SHA-256:	D115E00BAEDB223618B7BCFAD132145C4F75882873D9D93BFD5439F4C38745E5
SHA-512:	23CF2678259CFCB68697C39CD7A92A6FF2D26204C06BCCD63CE864F97B7F2291D540AF74E0C5E52C8189A8679E285B724CC24A917FE1DBA5C2DC9BEFEE0CB5FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.I.~.'.~.'.~.'.YtJ.\|.'.w..z.'.......'.w..\|.'.Yt\.s.'.~.&..'.`...'.w..k.'.w..n.'.w....'.w....'.w....'.Rich~.'.................PE..L......Q...........!.....\|...........t....................................................@..........................}..r...p...................................@.......8...........................H...@...................`~.......................text...;z.......\|.................. ..`.data...............................@....rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEREDST.TXT

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.8245387807277744
Encrypted:	false
SSDEEP:	3:PI6qNSv:gTSv
MD5:	06604F6AD34FA0BA04E2F785E32367F5
SHA1:	ACBEC35E882A65F00A8BB920BB4B00DE5476CE85
SHA-256:	FEC7F297B0B41C1F85A4E0294BFF35E8794676187F596A330EDCB1D4C3D1F26D
SHA-512:	65EA5C139EB13102B6D180DDE5B7AD9E9DEF494C053036CDA4EB6CB6D43FD24B6E9433BA7F4162470A50BFB286EEDD71E2A5B8EEBAE7BC83E62983D1A2E2D2D2
Malicious:	false
Preview:	AccessDatabaseuser.exe ..

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	528536
Entropy (8bit):	6.3738351759493375
Encrypted:	false
SSDEEP:	6144:S/ppiNu2t7mAd+eFtdOFQtA/yeEB89Ofdy7MwK95kJnUyMc7R+vAXyyCrcM1qrUr:2biNvsAwcj40ymOuFc7RxCyCErU8k377
MD5:	78E16C3A5C1E7A87D6B977925229DA1E
SHA1:	1353DCFE050D3A5A504905F076109A16F94CE319
SHA-256:	BC764A22174A80E4FE3719C82AE8267667CD842FE25835D5CE57FDD13C425CDD
SHA-512:	6541AB0E5DA968FDD762853F5B2961BCC0623ECA7BAB43597AAF191A84AAD072AB41E5254185103617356611C4BAAEE81D780B7A44CA66C7EB47DD5173188C71
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............nn..nn..nn......nn.I!...nn......nn.....nn.....nn..no..nn..<...nn......nn......nn......nn......nn......nn.Rich.nn.........................PE..L....Y"Q...........!................H}............X;.........................@.......*....@.............................[.......x................................Y......8............................i..@...............H............................text............................... ..`.data...L+..........................@....rsrc...............................@..@.reloc...Y.......Z..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	221304
Entropy (8bit):	6.330477703077784
Encrypted:	false
SSDEEP:	6144:MtcXGBwrKGK/bCzKJ7h5LJAAtH/4Ya1W2/Tb4HGHwQfkptipBWOdMy:bK5LJAAtH/DaIUTb4HGHwxptipay
MD5:	08F1F4B2DCD23BEF2747F74E2960AA2D
SHA1:	B0FC858A114DC2CC3759D6962F382A583C123A48
SHA-256:	5186673CE46BA50CB54DD0199694EBFAA068EB6E741863C45E25E34973192723
SHA-512:	BAA89D690C516682E973C68916BC72009571CCB034CA64549626042E77AF7309F60C1C788CFEEDB71FC058578978EDCB54AC82925405B2CD6CEBB5CF73F5A22F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4..p...p...p...Wa..q.....I.q...y.J.y...y.L.w...Wa..z...p.......n.[.q...y.\.@...y.[.}...y.M.q...y.K.q...y.N.q...Richp...........PE..L....Y"Q...........!...............................;......................................@.........................`...7...X........................F..x.......p.......8...........................@T..@.......................`....................text...)........................... ..`.data... y..........................@....rsrc................"..............@..@.reloc..p............,..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3049376
Entropy (8bit):	6.470431761306206
Encrypted:	false
SSDEEP:	49152:JQN5vwiZx58ASCJJWS97gYQc4gyNTLyTv+hFBrGk9GOva2+GmfKmfHIkPy+TL:uN5oiv58ASSWTYQceNXyTGhF1v9xvEG0
MD5:	A6F5ACA8DAB5FF8B8EAA26F060336C8E
SHA1:	46F56E11562121064A85EA9CA3DE07FB9FA7A108
SHA-256:	4A95B48D8FA6F9F19F687A3D816C60A4FE1BA445920F012ADBF264D3789BAF99
SHA-512:	F5C6AB9683A718ADFB9F59536D3BDE316D2B132FCBD01AA2D9FEC91F88F937D557699601D79C8CA84121C52FAF7C4C6F54F80AD02FDAC1DD2E6C21BA7EC84F09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W......................[...............].......L.......K.......Z.......\.......Y.....Rich............PE..L......L...........!.........R.......#.......0.....;................................i./...@.........................l(..8....(..<....................p..........<...\,..8...............................@............................................text............................... ..`.data...4E...0...B..."..............@....rsrc................d..............@..@.reloc..<............l..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247424
Entropy (8bit):	6.677359751177031
Encrypted:	false
SSDEEP:	6144:fCTBJA9eLw8FwIe8SERItIWwV1pI5Ol6xgnimI4aOkg5Q:fCTrA/fER+IWsYoWN
MD5:	50AD01A0EF7C6BFF0AA190A7A838EBFE
SHA1:	5F2C203AB133919481DEF938B23C7BD3E17DE576
SHA-256:	061A7F953F84D42C7202F23F732B12D7FA7F7B3B48A1A7540F02D48FBE829DAD
SHA-512:	47694BE304D7000987950B549FDAD5F9470DB7DB74307DD97DE6FF2C431919F9DAE6A0B80DA4B8E8FE778966FDF1F7001E6F33624849030782BD1812F7ACB7D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7..7..7.....7..e..7..O..7..7..c7...x..7..O..7.....7..O..7..O..7..O..7..O..7..O..7..Rich.7..................PE..L.....P...........!.....x...F...............@.....4................................X.....@..........................\|..7...@\|..........\|.......................P...`...8...........................X~..@...............4............................text....w.......x.................. ..`.data....!...........\|..............@....rsrc...\|...........................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	363656
Entropy (8bit):	6.387492405605909
Encrypted:	false
SSDEEP:	6144:Ba+A2LYyMkREoZWeKv2v0gKrytCIKHoijYKskUVCrMLONGfKLf:I+d4oZKvQSUCIKIijYHkUVC4t6
MD5:	4F75717682E24C330FC20601DFECB626
SHA1:	2FAB3C36F51D0E9447F6C46F4B67C4168180F655
SHA-256:	2B7AE1E68F41AFD8CE095E7A01BB1DC9C6C5829E2568CEB2C1F3174971371C26
SHA-512:	1FC3CDA0B6FCCB6E8F8A0254199A270FAD27E22AB57FDFE242E81B085B032AFEDB0312DBA07C6FC2F92986F5614AAF35B04BED8A355144AB252E7E9168687752
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%.?RD.lRD.lRD.l[<$lWD.l..!lSD.l[<"lZD.lu..lXD.lRD.l.D.lL.3lSD.l[<4l.D.l[<3lYD.l[<%lSD.l[<#lSD.l[<&lSD.lRichRD.l........PE..L....Y"Q...........!...............................;......................................@.........................x...7............................r..........`......8............................4..@.......................`....................text...u........................... ..`.data........ ...4..................@....rsrc................<..............@..@.reloc..`.......,...F..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4300456
Entropy (8bit):	4.692926232602364
Encrypted:	false
SSDEEP:	49152:RIfV1YrNP6+Au5qgWib0X9+njNWH+rqhM1u:JNP6+Au53s
MD5:	A026BD4085C0E933A57E1B81840DDD83
SHA1:	8DB011A089F5DC894E0D6BE353B2A7B6A6770180
SHA-256:	0E48323B8BF92687C0FE7C5ED6D44C51A189C5D5C745A717A60D6444769AB735
SHA-512:	4330036068B6A6F2D09B94E286B472BD17DF0B10130CC69AEA6C579FEA56DCC523053D13CF91F09BE6432D48F9BBCDE718BCFDB9659AAF6A127E282E9FE1DC24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e..W...W...W...^\|R.V...^\|T.V...^\|Q.V...RichW...........PE..L.....\Q...........!..........A...............................................A.......B...@.......................................... ..`}A...........A.................8............................................................................text...............................@..@.rsrc...`}A.. ...~A.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	454744
Entropy (8bit):	6.623858457452539
Encrypted:	false
SSDEEP:	6144:PG3LPMCteJXH2n3zvAWrqopaNIBOH7ELUFqtcFAOWOMyU+p0c2aZ5:PuMCEJXH2n3zYWrqopaNQO4L5cFxMBo5
MD5:	7172970EFFB3EA5600B53D5905566ED0
SHA1:	E7CC72236B92EC0E7B922FDFF24A589F6D3C38BC
SHA-256:	8AD6D1CF04A4E15B5F4EB348E9FB6CEE7224B64ED277FE38FAE3DE3EF60614D9
SHA-512:	50C141B2ABE027E323F55F2BC64BA9FBFFE97724B12BD2E4D2EC286E19903402A677009C6026D9201930483CBE1F3E9454D36CCDA7D2C2D45B15E783066EE6E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,a..B2..B2..B2.'/2..B2.'92..B2..C2..B2...2g.B2...2..B2...2r.B2..2..B2...2..B2...2..B2Rich..B2........................PE..L....}oP...........!.........b......=y..............................................QH....@..............................N...w..x.......................X........=.. ................................................................................text............................... ..`user.............................. ..`.rdata..*8.......:..................@..@.data..../..........................@....rsrc...............................@..@.reloc...K.......L..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101992
Entropy (8bit):	6.764942652670399
Encrypted:	false
SSDEEP:	3072:vCbtJGyYsLBzrBQ4COc5JnvkmQaAanZ/Q4doCFh:vCX9J45JnMZv8Nndx
MD5:	F7BA3446A6AA42E3A38597CC8E826C79
SHA1:	BE10FDB8F859D8BE803F5E6FA340358119D3C94B
SHA-256:	BAAE2E026C83CC200281775C58FAF1275BF26B26C2C54FBE440654EB0D9F49EF
SHA-512:	E3C289FDF1D14915924935310D2125CFE103B06001D2A1990FBE0EBA73B1AE4D88788996B095124FF600DC191BCB5DDAA436BE9F1B9D91A7F5534272EB818EDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4...g...g...g.?.g...g.?.g...g..Cg...g...g...g..Eg...g..Sg...g..Dg...g..Tg...g..Bg...g..Ag...gRich...g........................PE..L....;"Q...........!.....Z...........V.......p....nE......................................@..........................^..U....^.......................t..h...........hh..8...........................p-..@...............8............................text....Y.......Z.................. ..`.data........p.......^..............@....rsrc................`..............@..@.reloc...............h..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59480
Entropy (8bit):	6.466894019333764
Encrypted:	false
SSDEEP:	768:Z4k7DZkKQ38fUVRTAQI/CCRWS6VS4+rXxuoLxvzypmLT0gEYTRFraQ6F0Ji6Fr:Z4kq5MUXAQIWfS5xuxmdEIRh6qJx5
MD5:	459538285FB66B0820B85FEE5DCF21A7
SHA1:	A0E395814A16DDD24F075289CC165683070ED88D
SHA-256:	A67A97299D5348A12C7088A1EE9AF304E29F8B7157C9E99E41DBC4691CCEEA00
SHA-512:	553339C94A627C87803D263AB038C4A649C11562434974DCBC1899229082636949944A298EA88033D8319D395A20EED3FA8D2EFFD021E904780F5F9EE434109D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I.G.I.G.I.G...G.I.G...G.I.G.1lG.I.G.I.G.I.G.1jG.I.G.1\|G.I.G.1kG.I.G.1{G.I.G.1mG.I.G.1nG.I.GRich.I.G................PE..L......Q...........!................D.............pE......................................@.........................L...U.......x.......................X.......,...T...8...........................8=..@...............,............................text.............................. ..`.data...`...........................@....rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18635968
Entropy (8bit):	6.539176807452944
Encrypted:	false
SSDEEP:	393216:C44GrbHDqV/9mMAfsN9g8TPUNsmjdqUDNbwGgmS1iGm9:JrbHD0lAfsGs4qUYn1i1
MD5:	AB4FE7E4B1B1B845D789EF6C30FCA1FE
SHA1:	75B383A6614AF9ED11845AC0A85A041C3E99D352
SHA-256:	D6DB37FC839B1107BC77E77853FB784B2CDC34AE2A832625C07A0A973DE40A34
SHA-512:	ADC5CBF8980ABAB8B437B23D850195FC5DD6C034AB5F69B597D4A011AA16B699C15C4A79F3BCA2C1B2A9B5AE503AE474DDC8974D787E9F31ADCD14341ADC8A92
Malicious:	false
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........,...BO..BO..BO..,O..BO...O..BO/..O..BO...O..BOQ."O..BOQ..O..BOfy/O..BOfy?O..BO...O..BO..9O..BO..CO..BO...O..BO../O..BO...O..BO...O..BO...O..BO...O..BO...O..BORich..BO........................PE..L......Q...........!.........Z.....................9............CS P.........p............@...........................=.=...l............^...........B...........i..x...8............................E..@...............T....".......................text............................... ..`.data..............................@....rsrc....^.......^...z..............@..@.reloc...i.......j..................@..H................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72524600
Entropy (8bit):	5.149821660145504
Encrypted:	false
SSDEEP:	1572864:KdbWo7aLKb7YF+w6chhnOS6seHKOeJjM1:Kdb26chhnOS6seHKOeJjS
MD5:	76A5DB2B33E75128AE6309AE68A5D0A2
SHA1:	E32DF1A8085470B11E2698D18B05A117085E91B8
SHA-256:	A52D5F708C57B2C89791294DE5032752D61CF11F1B43286B4B25350181F5928D
SHA-512:	A17AFD1E66CADE1F9A54F87AF8189879EC481A5195D72C4401A184728CD2BC24035279650AB75CC24421768D19D4540A2DF94895D14F6D6A1EA549A404534F26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e..W...W...W...^\|R.V...^\|T.V...^\|Q.V...RichW...........PE..L...X4.O...........!..........R...............................................R......NS...@.......................................... ....R...........R.8...............8............................................................................text...{...........................@..@.rsrc.....R.. ....R.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\VBAJET32.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50272
Entropy (8bit):	6.391215711621637
Encrypted:	false
SSDEEP:	768:PM01KG+65h6tpjPnqV93Pmx/QobMlzdUMR2Xi:pK+r6tp2V9P6Qi2R2X
MD5:	AAC786999127BF644763C8422EBF0C24
SHA1:	469CA9350E75053FD58B8C99B62B926AFB40C815
SHA-256:	57DD378C031D5699015EE4CC510A35693C08C231F4D4B14754B44D1D13CB8C48
SHA-512:	D19BAC1D142AEC1608817C097573A67A4EC209CE4622B9D691E28C10A5D5BE330A0CB99EA45A20C65F8F466B3E4B897F4FCC456846618051E2C6C8197E9759AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ko../..B/..B/..B...B,..B/..Bc..B&v.B?..B&v.Bf..B&v.B5..B&v.B...B1\.B...B&v.B...BRich/..B........................PE..L...+}oP...........!.................*..............................................3.....@.............................f......(.......................`...........0...............................@#..@............................................text............................... ..`.data...............................@....rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\Source user\OSE.EXE

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149352
Entropy (8bit):	6.5641450191049735
Encrypted:	false
SSDEEP:	1536:vC4QOL26NOd32mM6X/pGzd4t/qcarbwNfQ8WfQJ+ItkbKR2zy2IoN7Zo86eAI0UV:K4QgNOd3z44Kw6JrokFyF5Zat/Vq09oi
MD5:	9D10F99A6712E28F8ACD5641E3A7EA6B
SHA1:	835E982347DB919A681BA12F3891F62152E50F0D
SHA-256:	70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC
SHA-512:	2141EE5C07AA3E038360013E3F40969E248BED05022D161B992DF61F21934C5574ED9D3094FFD5245F5AFD84815B24F80BDA30055CF4D374F9C6254E842F6BD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.P."..."..."......"......"..."..."...Zv.."...Z`.."...Zw.."...Zg.."...Zr.."..Rich."..................PE..L....TIK.....................N......r?.......0...............................p............@..........................................@..0............0..h....P......`...8............................>..@............................................text............................... ..`.data...............................@....rsrc...0....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\MSECache\AceRedist\1033\AceRedist.msi

Download File

Process:	C:\Users\user\Desktop\AccessDatabaseuser.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Access database user 2010 (English), Author: Microsoft Corporation, Keywords: Installer, MSI, Database, Release, Comments: This Installer database contains the logic and data required to install Microsoft Access database user 2010 (English)., Template: Intel;1033, Revision Number: {05CF0009-88BA-4D1A-86DA-5DE0B6FAEFF2}, Create Time/Date: Fri Jun 28 21:35:44 2013, Last Saved Time/Date: Fri Jun 28 21:35:44 2013, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.0.5419.0), Security: 2
Category:	dropped
Size (bytes):	26697728
Entropy (8bit):	7.981418003582255
Encrypted:	false
SSDEEP:	786432:EMOfoJ3okLTpKIoxfaMnWGcMxBWH9m18:J4o6kLTpMXvBWHA18
MD5:	85A6869262CE6A071BE66989351D7633
SHA1:	A1FE61869A4323CCA082E736AFAD9C6838BF0EDA
SHA-256:	AA7593A82BDE2B70B91AE1DA1EF70CE46CDA0D619BD86B08DA133755B93A9B5D
SHA-512:	51FBD64BE2B7E491AC74FAB36D87FD06052E25C179631D8B6CEC8061462D01441B4F7B49C053EA69CA243C1EBBF9A7B6B3F727E502273ED9F53D1860CBD00F73
Malicious:	false
Preview:	......................>............................................6....................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6.............................................................................................................................. ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Program Files (x86)\MSECache\AceRedist\1033\Catalog\files14.cat

Download File

Process:	C:\Users\user\Desktop\AccessDatabaseuser.exe
File Type:	data
Category:	dropped
Size (bytes):	3285039
Entropy (8bit):	4.9500464410734555
Encrypted:	false
SSDEEP:	24576:ZQ77OddddddddddddddddddddddddddddddddddddddSneHXjj/BMtb117XYUb0n:Kpcn
MD5:	8ADA3622562B9A7607E68CEC0BB2D6E7
SHA1:	8CFABE3FB2EC018D5657465B0992A5C2F95CDB8C
SHA-256:	0A4075BFA646C1F7B902FFB644AE179DE74A141090C54089A1EF948D83169B63
SHA-512:	9C34774912379231961B6EFC9DD26A4770F2779AB9011E3F8CFF5FB6DBD7C4BB14216F0A92AD6E97E8100881DA113545AAE362D60D0CD7A46C4FFBCC7E74E4A9
Malicious:	false
Preview:	0.2 ...H........2 .0.2 ....1.0...+......0.2.?..+.....7....2./0.2.0...+.....7...... ...:M....lj.C..100428202918Z0...+.....7.....0.2..0....R0.0.1.7.8.9.5.0.6.7.F.2.A.A.4.4.C.3.9.3.1.5.6.9.5.8.7.C.A.C.F.4.2.A.F.6.A.1.8.E...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........Pg.D..iX\|.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R0.0.2.6.E.3.7.4.9.6.6.8.0.E.1.1.9.1.5.0.C.2.4.3.3.C.0.1.D.C.A.7.A.F.0.8.C.7.A.3...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........&.t.h...P.C<.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R0.0.2.6.E.3.7.4.9.6.6.8.0.E.1.1.9.1.5.0.C.2.4.3.3.C.0.1.D.C.A.7.A.F.0.8.C.7.A.3...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........&.t.h...P.C<.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E

C:\Program Files (x86)\Microsoft Office\Office14\1033\STSLIST.CHM

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	433434
Entropy (8bit):	7.960697988910112
Encrypted:	false
SSDEEP:	12288:HSzxpydHm8dwmsYDI+NuZydfUzmtH+dKL:HSzcbdwvYDI+YZydfUCtOKL
MD5:	89920DC13154BE087439A2935B0C78FD
SHA1:	3FF745F432C62D95E492F502BA40E2A9D0DE182A
SHA-256:	16D7794BC0D43F8C8CAD61F6FD431B168026BD4B369E06ED8125C5D1A6B5FE88
SHA-512:	5416B87CCEE34A044D8054410073B8DC2FC145587872E22CDF0B8B92EDCBC79DAE2E94A420CD8CD7B94B5ECC4F4D5763FD580A100C52EE82D7FAC1B24E721DB4
Malicious:	false
Preview:	ITSF....`........c........\|.{.......".....\|.{......."..`...............x.......TP.......P..............................ITSP....T...........................................j..].!......."..T...............PMGL4................/..../#IDXHDR....../#ITBITS..../#IVB...`.l./#STRINGS.....N./#SYSTEM..F.4./#TOPICS.....0./#URLSTR....}./#URLTBL...9.d./#WINDOWS.....L./$FIftiMain......v./$OBJINST...T.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...P../$WWKeywordLinks/..../$WWKeywordLinks/Property...L../html/..../html/About_HP10355287.htm...h.w./html/AbtAData_HP10355320.htm..._.../html/AbtConst_HP10355217.htm...h.0./html/Abtdocl_HP10355230.htm......./html/aChrtXl_HP10355274.htm...*.! /html/AddMVChoice_HA10355234.htm...K.. /html/AddMVLookup_HA10355235.htm...a.`./html/AddRC_HP10355236.htm...A.../html/AdEdCC_HP10355237.htm...P.../html/AEDdata_HP10355238.htm...[.6./html/aExpAx_HP10355300.htm.....1./html/aExpDtsh_HP10355221.htm...B.../html/aExpXl_HP10355375.htm...S.:./html/AppFil_HP10355241.

C:\Program Files (x86)\Microsoft Office\Office14\1033\STSLISTI.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88464
Entropy (8bit):	4.038953430996915
Encrypted:	false
SSDEEP:	1536:lmNeNT+YcuUhOojh+O0uHkpCnLye4sKjthM+9rHUM:cNeNEhOeFtLAsOthM+9oM
MD5:	528DE8FCB5FBBE1D23AD4D37270BEC2E
SHA1:	AB50FC129D8E8D6240E8A35971AA862E66449F57
SHA-256:	338DED3648ED5133370FBECECF7A3C216A58173CDB956F1A9321E11E610EBC19
SHA-512:	B832FACB8939D4FA9A8E2A41E59F0237BCAB891CD30CB3F03332A5679E8D310214EDAF2DA89B3E6F66DF662000FF0FCBAA2D5BF9719175819E80492A787BEE82
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....8.K...........!.........@...............................................P...........................................................?...........B...............................................................................................rsrc....?.......@..................@..@............................................................0.......p....................................2.......2.......2.. ....2..8....2..P....2..h....................,.......,.......-..........................................................(.......@...l...X...m...p...n...........................................................0.......H.......`.......x....................................................... .......8.......P.......h...............................................................(.......@.......X.......p...

C:\Program Files (x86)\Microsoft Office\Office14\STSLIST.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2834128
Entropy (8bit):	6.510797306685462
Encrypted:	false
SSDEEP:	49152:j+2DNcxkwEDYFw3Di+hdwwQEEKLHz0InJQz7R7WTGSw6m:VWk1Z3LSKLHJnJytWNw
MD5:	9E1216ACA980D400BDFF51E8458A8ED3
SHA1:	38396E25F505D4AB4FB481FAB59605F3BF87098B
SHA-256:	D2F62D557485399B6D3544B3023BDDFA89D71A3A69F881E41381591A7A2D23DD
SHA-512:	473FB5700490519E9DD878203947E0AB328299DE77F75922216478251EA0205CB4ACBDC76B840559C20685BE5363F7633218D80D54CACF8F2F97CBE23B9D7BC8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........J..$..$..$.....$.....$.X....$..qI..$..q_..$..$..$..qJ..$..%.$.....$.....$....p.$.....$.....$.....$.Rich.$.........PE..L....{:Q...........!......"..................0%....>.........................`+......r+...@..........................i".....P{".......$..............$+......@).......".8...............................@....................n"......................text....."......."................. ..`.data.........".......".............@....rtext..L.....$......j$.............@....rsrc.........$......l$.............@..@.reloc.......@).......).............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI127D.tmp

Download File

Process:	C:\Users\user\Desktop\AccessDatabaseuser.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373312
Entropy (8bit):	6.500188156806958
Encrypted:	false
SSDEEP:	6144:308k6+uFxagMpTZA/EvjkJLzF6bmXnYGWrsoa76AQ9UvFA:308vbyJ8LzF6bmXMsoK/QavFA
MD5:	4572882DF9A2C11116522E7784F0E2BB
SHA1:	140586DAACA44C40249B0D70DEDF0398193EA562
SHA-256:	45C765CA08B371AB16FB45FE8EE469C4F77F4B935C5FD54D7CB48FBC34979E4F
SHA-512:	C3FF748E6C45296CE15433BEC7E9A9AE619B5672D00E408E5889C470385D04CACD415A522DC2B2E70F1B5B75C7335A16AF5DDF238E719C53FCA44B2B3EA3C4F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+].Qo<..o<..o<..qn}.n<..fDl.v<..fDz..<......h<......m<..H...i<..H...N<..o<...=..fDk.n<..fD}..<..fDh.n<..Richo<..................PE..L...r..P...........!.....&...........T.......`.......................................N....@..........................".......&..........................@........6..D4..8...........................h...@....................$..`....................text....$.......&.................. ..`.data....G...@...6...*..............@....reloc...6.......8...`..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Microsoft Access Database user 2010 (0).log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (498), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2376520
Entropy (8bit):	3.75762839758351
Encrypted:	false
SSDEEP:	3072:m9jd+GLymcCbFj2GxV+NL+h5uW5mqbKngMpAjf81/vYT6gx+CiNr890VBFcpiT+G:ajjpiT+5jfo9hFMu
MD5:	A95A669155942B284007F01CA295B2DB
SHA1:	46C57B46BE4CFE48137042436127C1CAD743D264
SHA-256:	90B363E80C0039C8E23D255AB7115F3F3864B3612688E8282504CECA665F8EB5
SHA-512:	3290ACB6EF1B891382ACCA7430FB3775BB4C24E7B29F9B21DD6F81AF7B22E853A9A081BE0660F8F7A859EDE5FED8540C9443683BC941AE015AC7F304A4162975
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .1.5./.0.1./.2.0.2.5. . .1.0.:.2.1.:.0.7. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.D.e.s.k.t.o.p.\.A.c.c.e.s.s.D.a.t.a.b.a.s.e.E.n.g.i.n.e...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.3.8.:.A.C.). .[.1.0.:.2.1.:.0.8.:.0.0.2.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.3.8.:.A.C.). .[.1.0.:.2.1.:.0.8.:.0.0.2.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.3.8.:.A.4.). .[.1.0.:.2.1.:.0.8.:.0.4.9.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.3.8.:.A.4.). .[.1.0.:.2.1.:.0.8.:.0.4.9.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.

C:\Windows\Installer\594d15.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Access database user 2010 (English), Author: Microsoft Corporation, Keywords: Installer, MSI, Database, Release, Comments: This Installer database contains the logic and data required to install Microsoft Access database user 2010 (English)., Template: Intel;1033, Revision Number: {05CF0009-88BA-4D1A-86DA-5DE0B6FAEFF2}, Create Time/Date: Fri Jun 28 21:35:44 2013, Last Saved Time/Date: Fri Jun 28 21:35:44 2013, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.0.5419.0), Security: 2
Category:	dropped
Size (bytes):	26697728
Entropy (8bit):	7.981418003582255
Encrypted:	false
SSDEEP:	786432:EMOfoJ3okLTpKIoxfaMnWGcMxBWH9m18:J4o6kLTpMXvBWHA18
MD5:	85A6869262CE6A071BE66989351D7633
SHA1:	A1FE61869A4323CCA082E736AFAD9C6838BF0EDA
SHA-256:	AA7593A82BDE2B70B91AE1DA1EF70CE46CDA0D619BD86B08DA133755B93A9B5D
SHA-512:	51FBD64BE2B7E491AC74FAB36D87FD06052E25C179631D8B6CEC8061462D01441B4F7B49C053EA69CA243C1EBBF9A7B6B3F727E502273ED9F53D1860CBD00F73
Malicious:	false
Preview:	......................>............................................6....................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6.............................................................................................................................. ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\594d17.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Access database user 2010 (English), Author: Microsoft Corporation, Keywords: Installer, MSI, Database, Release, Comments: This Installer database contains the logic and data required to install Microsoft Access database user 2010 (English)., Template: Intel;1033, Revision Number: {05CF0009-88BA-4D1A-86DA-5DE0B6FAEFF2}, Create Time/Date: Fri Jun 28 21:35:44 2013, Last Saved Time/Date: Fri Jun 28 21:35:44 2013, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.0.5419.0), Security: 2
Category:	dropped
Size (bytes):	26697728
Entropy (8bit):	7.981418003582255
Encrypted:	false
SSDEEP:	786432:EMOfoJ3okLTpKIoxfaMnWGcMxBWH9m18:J4o6kLTpMXvBWHA18
MD5:	85A6869262CE6A071BE66989351D7633
SHA1:	A1FE61869A4323CCA082E736AFAD9C6838BF0EDA
SHA-256:	AA7593A82BDE2B70B91AE1DA1EF70CE46CDA0D619BD86B08DA133755B93A9B5D
SHA-512:	51FBD64BE2B7E491AC74FAB36D87FD06052E25C179631D8B6CEC8061462D01441B4F7B49C053EA69CA243C1EBBF9A7B6B3F727E502273ED9F53D1860CBD00F73
Malicious:	false
Preview:	......................>............................................6....................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6.............................................................................................................................. ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI51B9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.741623752383387
Encrypted:	false
SSDEEP:	192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
MD5:	85221B3BCBA8DBE4B4A46581AA49F760
SHA1:	746645C92594BFC739F77812D67CFD85F4B92474
SHA-256:	F6E34A4550E499346F5AB1D245508F16BF765FF24C4988984B89E049CA55737F
SHA-512:	060E35C4DE14A03A2CDA313F968E372291866CC4ACD59977D7A48AC3745494ABC54DF83FFF63CF30BE4E10FF69A3B3C8B6C38F43EBD2A8D23D6C86FBEE7BA87D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........CnuS".&S".&S".&t.}&P".&S".&.".&t.{&X".&t.m&^".&t.z&R".&t.n&R".&t.x&R".&RichS".&........................PE..L...\..C...........!.....@... .......6.......P....@..........................p......I................................B.......=..x............................`......0...............................x...@............................................text....2.......@.................. ..`.data...h....P.......P..............@....reloc..<....`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI541B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	321801
Entropy (8bit):	6.215807727718274
Encrypted:	false
SSDEEP:	6144:4hrGH5MhIaO9j14yjSqLBzghDC8Ra23HuySnavx+5Xqp42Rl+iurVnWfVKXlyUTW:i4QC1wfHM7CJ
MD5:	319358F76A33087C58F4963AB22420AA
SHA1:	2714C23E786D49107488B7224D6C7A087CD194B6
SHA-256:	D3A1C8AD28E57445D0F9895932BFA97B603ADEAF770DA0F01D32B6A3801F5930
SHA-512:	D67C083DD738BE8886A92FECEAFF45A10A44A6FD78B52BBD9EAD3CE6EF2B0B44B1B320EDD9443C5B696FE7CB25D644216C8511EE8E2937A31BD255D90E558C0C
Malicious:	false
Preview:	...@IXOS.@.....@.R/Z.@.....@.....@.....@.....@.....@......&.{90140000-00D1-0409-0000-0000000FF1CE}/.Microsoft Access database user 2010 (English)..AceRedist.msi.@.....@g....@.....@........&.{05CF0009-88BA-4D1A-86DA-5DE0B6FAEFF2}.....@.....@.....@.....@.......@.....@.....@.......@..../.Microsoft Access database user 2010 (English)......Rollback..Rolling back installation..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@!....@.....@.]....&.{398E906A-826B-48DD-9791-549C649CACE5}E.C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL.@.......@.....@.....@......&.{A6D1C76C-5B2F-4D54-8682-95738E88B3AC}<.C:\Program Files (x86)\Microsoft Office\Office14\STSLIST.DLL.@.......@.....@.....@......&.{88D5AF78-19C6-4D47-B4EC-5BAF83D02E92}I.C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL.@.......@.....@.....@......&.{1CDB09B8-58BA-46B5-B334-0F38167D3AC1}H.C:\Program Files (x8

C:\Windows\Installer\MSI542C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	152064
Entropy (8bit):	6.508790784114524
Encrypted:	false
SSDEEP:	1536:KJS28uK6Gf6oGFDrJMxiPXzr8iOE6uqR4JjAK3Xf5n4TbTwzx/JQ5jR1bQlWkjWt:wSMtlFCuU4F3tM1wWkaUfHM64kQ+
MD5:	33908AA43AC0AAABC06A58D51B1C2CCA
SHA1:	0A0D1CE3435ABE2EED635481BAC69E1999031291
SHA-256:	4447FAACEFABA8F040822101E2A4103031660DE9139E70ECFF9AA3A89455A783
SHA-512:	D5216A53DF9CFBE1A78629C103286EB17042F639149C46B6A1CD76498531AE82AFD265462FBE0BA9BAAFF275FC95C66504804F107C449F3FC5833B1ED9C3DA46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...............V&......V0......................."....V7......V!......V'......V".....Rich....................PE..L...Z.;J...........!.........`......W........0............................................@..........................$...............p..............................................................X4..@............................................text............................... ..`.data....;...0......................@....rsrc........p......................@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI547B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264816
Entropy (8bit):	6.603718145708859
Encrypted:	false
SSDEEP:	6144:oHZrr0HLZ11JK2YjtjiLCgYGdGgD396qdRS:oHZrrAt1DKvp+LRYGdPDH7S
MD5:	DBC010FC3F00557C0CF08637F2B03B3F
SHA1:	1FFAA7637BADE6A30371E6DA473E3CBC8EABCA6E
SHA-256:	54D8AC05A1C448C3A24148C8C70804770AB43C1A3968A2FB6670A5652B77A873
SHA-512:	C37BCF6B916B4194BC41177DDB93016177F5A50276624BE3F6426FC9DD1725C3DE29A797181959C35FDD114A722AB5A1B80E485E93141628A6B25F6B8AE772CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........gK..4K..4K..4U.^4L..4B.O4\..4B.Y4..4lQ.4I..4lQ.4R..4K..4m..4B.H4J..4B.N4J..4B.^4&..4B.K4J..4RichK..4................PE..L.....P...........!.................L.............A.........................P......I.....@.........................\...\|...l...........................p.... ...#..8...8...........................H...@......................`....................text.............................. ..`.data....W..........................@....rsrc...............................@..@.reloc...#... ...$..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5612.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	152064
Entropy (8bit):	6.508790784114524
Encrypted:	false
SSDEEP:	1536:KJS28uK6Gf6oGFDrJMxiPXzr8iOE6uqR4JjAK3Xf5n4TbTwzx/JQ5jR1bQlWkjWt:wSMtlFCuU4F3tM1wWkaUfHM64kQ+
MD5:	33908AA43AC0AAABC06A58D51B1C2CCA
SHA1:	0A0D1CE3435ABE2EED635481BAC69E1999031291
SHA-256:	4447FAACEFABA8F040822101E2A4103031660DE9139E70ECFF9AA3A89455A783
SHA-512:	D5216A53DF9CFBE1A78629C103286EB17042F639149C46B6A1CD76498531AE82AFD265462FBE0BA9BAAFF275FC95C66504804F107C449F3FC5833B1ED9C3DA46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...............V&......V0......................."....V7......V!......V'......V".....Rich....................PE..L...Z.;J...........!.........`......W........0............................................@..........................$...............p..............................................................X4..@............................................text............................... ..`.data....;...0......................@....rsrc........p......................@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6F58.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	152064
Entropy (8bit):	6.508790784114524
Encrypted:	false
SSDEEP:	1536:KJS28uK6Gf6oGFDrJMxiPXzr8iOE6uqR4JjAK3Xf5n4TbTwzx/JQ5jR1bQlWkjWt:wSMtlFCuU4F3tM1wWkaUfHM64kQ+
MD5:	33908AA43AC0AAABC06A58D51B1C2CCA
SHA1:	0A0D1CE3435ABE2EED635481BAC69E1999031291
SHA-256:	4447FAACEFABA8F040822101E2A4103031660DE9139E70ECFF9AA3A89455A783
SHA-512:	D5216A53DF9CFBE1A78629C103286EB17042F639149C46B6A1CD76498531AE82AFD265462FBE0BA9BAAFF275FC95C66504804F107C449F3FC5833B1ED9C3DA46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...............V&......V0......................."....V7......V!......V'......V".....Rich....................PE..L...Z.;J...........!.........`......W........0............................................@..........................$...............p..............................................................X4..@............................................text............................... ..`.data....;...0......................@....rsrc........p......................@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{90140000-00D1-0409-0000-0000000FF1CE}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.162437607983155
Encrypted:	false
SSDEEP:	12:JSbX72FjioSAGiLIlHVRpiBh/7777777777777777777777777vDHFOV5Wrgp7lN:JiQI5AXDF
MD5:	CE2A95E3A656C4A0A8369401EE084AD6
SHA1:	9E8732441368440EA200BD3756FDAEE05A3703BC
SHA-256:	97E551DEF94C8092723641506B56D53E225DFBC15C5C07679C35DC8B54C69EB5
SHA-512:	89668E33C29FFD2B8B4CE5BE11BE5F7E6751B918D1D2830575BEEBAB5F8FE83060CFA8C61CCA7F23DF80CB130DC2F47FEDE749DCAAFFFEF57A38C4AE0997ACB5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5604504441426843
Encrypted:	false
SSDEEP:	48:S8Ph5uRc06WXJKjT5jCdBT1GETkfAdCCS5kY2AdCCSIOpnT1G:9h51BjT0JGETl6UJG
MD5:	C5DBA15B32B5A590393A08805AF882ED
SHA1:	5339F2701C5A120834F54F0E9E9358F3786EAF50
SHA-256:	780FD584EA798356B93959515685C4773B458413D789D92BBFC5F0E73C05D7C8
SHA-512:	8F5E87786C8D8CBDEF25F825C8C1BB1C9401EDFA97592E0655B30CA936AB19AAE84742267F25FDE76BDEE383760AB75E6865309C8779AD908DB975C4F0426140
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362989231433142
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauQ:zTtbmkExhMJCIpEx
MD5:	5FB760DAC1CF709A6947BB4CA9485E6A
SHA1:	9D82FC382C76C484D5864F30998733715ED882C8
SHA-256:	205691E2C1A9C76FD72D4F08CEF9693D88E5F7ACC50C123ED7558B702F8E01D5
SHA-512:	CDBAA1E6AFA73C6486FCB9042F768F28D66D7440AEFA6327188C554162F3766047DE8EFCE88CC4C2E20AB018EE942AD7D4180670CFBE04AD2A3FA140302C01E9
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF0263B061B23F3CE7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5604504441426843
Encrypted:	false
SSDEEP:	48:S8Ph5uRc06WXJKjT5jCdBT1GETkfAdCCS5kY2AdCCSIOpnT1G:9h51BjT0JGETl6UJG
MD5:	C5DBA15B32B5A590393A08805AF882ED
SHA1:	5339F2701C5A120834F54F0E9E9358F3786EAF50
SHA-256:	780FD584EA798356B93959515685C4773B458413D789D92BBFC5F0E73C05D7C8
SHA-512:	8F5E87786C8D8CBDEF25F825C8C1BB1C9401EDFA97592E0655B30CA936AB19AAE84742267F25FDE76BDEE383760AB75E6865309C8779AD908DB975C4F0426140
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3439C44FE1B66F88.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.135895696490115
Encrypted:	false
SSDEEP:	48:0T1GGOpCAdCCSoAdCCS5kY32TxT1GzdF:0JG3OXTxJG
MD5:	BCC6E1CC2423C792A1E297105097E1AE
SHA1:	F018729E351FB2E8D0A1F97BB5714AE644D22D43
SHA-256:	47A3B1B1448718DB4F0CABA6DAF5CB66155B76D1618DC446EEC25866D639EDF1
SHA-512:	E45C7800869A207F9932EE87CB265462B9094A4B091663563342BF75926263E1C99BE289FFFFAF876D2F0D9CE3D8A6A68CD8045963141DEFD24AB0E5DF1F64CA
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF60A12C85B645FA70.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07064272341071551
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOh8is8oWrdztiVky6l7:2F0i8n0itFzDHFOV5Wrhb7
MD5:	11E76F55CECB20E5A5BCD83FC064137C
SHA1:	B46650DC9531868F7D02B45E8000C8AFA87628EE
SHA-256:	E4BC4D6EEA6E2EED5DC74EF2818AC5E43C9A7AD6F51CC5CC342AFF5E7E0056DF
SHA-512:	774B247A88EA1DD1FB643B4EAF011E3FC0CB9FC74C28E198100F72B1BA0CAB49F03292DD90FE78A62DD1B6522C5C573796E0C655BEAB5F3DF89396DE1E7DABCA
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF65494D1E5502A4DC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2507267664898283
Encrypted:	false
SSDEEP:	48:l4Bu/rhLFXJdT5fCdBT1GETkfAdCCS5kY2AdCCSIOpnT1G:GBSFTwJGETl6UJG
MD5:	B5E12DB90DD367C370BAF2243C2CD665
SHA1:	D917C9A4029FA74AE816BD5F166F2B6739E6EFD1
SHA-256:	7DA522CD112A3C807FE0DD2D90A7041B70CD21641B9E6C298F7290A02C58F901
SHA-512:	3529E054E83740F6E7DF588F46E9D94F0D976E463C86E6D6B9237CC4C0E454F787D6ABF4554CA20CC6996C609FD4712076113567E91D8EB18D60D7200DB53C40
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF923598E328332295.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBBA76014774796AF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCB7769857CB82622.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE011A7EECFC1D52C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2507267664898283
Encrypted:	false
SSDEEP:	48:l4Bu/rhLFXJdT5fCdBT1GETkfAdCCS5kY2AdCCSIOpnT1G:GBSFTwJGETl6UJG
MD5:	B5E12DB90DD367C370BAF2243C2CD665
SHA1:	D917C9A4029FA74AE816BD5F166F2B6739E6EFD1
SHA-256:	7DA522CD112A3C807FE0DD2D90A7041B70CD21641B9E6C298F7290A02C58F901
SHA-512:	3529E054E83740F6E7DF588F46E9D94F0D976E463C86E6D6B9237CC4C0E454F787D6ABF4554CA20CC6996C609FD4712076113567E91D8EB18D60D7200DB53C40
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcm90.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034450906226583
Encrypted:	false
SSDEEP:	3072:P5wveocziNzMLSMOYscmuW0AXLiLR4JpA86Goao1vJU87/amFYw8fF01OyAILH:hwyOMqcp3AXOLR4JpL6ft3/amiX2OyX
MD5:	67BDB40FBE6CECC320507161B58D134A
SHA1:	11EC8313BA20E96A0F776A018586CC127A451E16
SHA-256:	A15EAABBE6C32FBA34C1CACD8C0F206C28A69A8B73E619C962D812AE7FA0F844
SHA-512:	687289C5740E5316ABDAEC56BBB6C0A629FC1F374B865A61F71AE3561738B42D3C31987E53ED0DBAED0AEFD357824303B0DD7527BAA81FEE2434A4BCDEC6433D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L....LYJ...........!.....:..........Z........P....?x.........................0............@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcp90.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	569664
Entropy (8bit):	6.521726174641651
Encrypted:	false
SSDEEP:	12288:iZ/veMyZ137mSEWT0VkypLvgLehUgiW6QR7t5183Ooc8SHkC2eU8bw:iZSZ13iwJmgLq83Ooc8SHkC2efw
MD5:	B2EEE3DEE31F50E082E9C720A6D7757D
SHA1:	3322840FEF43C92FB55DC31E682D19970DAF159D
SHA-256:	4608BEEDD8CF9C3FC5AB03716B4AB6F01C7B7D65A7C072AF04F514FFB0E02D01
SHA-512:	8B1854E80045001E7AB3A978FB4AA1DE19A3C9FC206013D7BC43AEC919F45E46BB7555F667D9F7D7833AB8BAA55C9098AF8872006FF277FC364A5E6F99EE25D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L...~LYJ...........!.....4...p..............P....Hx......................................@..........................P..,....E..<.......................@.......43...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20250115102131222.0\msvcr90.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653120
Entropy (8bit):	6.883968356674239
Encrypted:	false
SSDEEP:	12288:shr4UC+UumMaIYE8EoPP1cI9xPP2OKDL9QXyG2pUmRyyvRt:cU9FNPPbxPP2OeL9Q2pUmRyyvRt
MD5:	7538050656FE5D63CB4B80349DD1CFE3
SHA1:	F825C40FEE87CC9952A61C8C34E9F6EEE8DA742D
SHA-256:	E16BC9B66642151DE612EE045C2810CA6146975015BD9679A354567F56DA2099
SHA-512:	843E22630254D222DFD12166C701F6CD1DCA4A8DC216C7A8C9C0AB1AFC90189CFA8B6499BBC46408008A1D985394EB8A660B1FA1991059A65C09E8D6481A3AF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L...yLYJ...........!.....\..........@-.......p....Rx.........................0............@..............................\|..P...(.......................@........3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20250115102131222.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7473
Entropy (8bit):	7.340614348720467
Encrypted:	false
SSDEEP:	192:kh0ifIJ2hEi1HnNpBjSebyaAqjkKiTbmr3TSc2Q:ky3eHNpBjTeajCynn
MD5:	BDDF54672A53F5DEA80F8202CD39C481
SHA1:	207C39103155AA3B6A7AF25B3E4A91AEB82898CB
SHA-256:	2717A5A51CFA1F0371B9FBB344D79554B0EFA3A6FF94DA3DC6664F7AF13C5048
SHA-512:	DD4A4F2FD470235602BA0645AAEFCB9664B41FFE228C654D94779164C095E828C69FCB74B0B70442C79DD2AAC6072FC295224DC8507EFAA37DF64EC5C5633BDD
Malicious:	false
Preview:	0..-...H..........0......1.0...+......0..u..+.....7.....f0..b0...+.....7......J...o8I......c..090712070759Z0...+.....7.....0...0....RD.8.B.A.8.1.E.D.6.5.8.6.8.2.5.8.3.5.B.7.6.E.9.D.5.6.6.0.7.7.4.6.6.E.E.4.1.A.8.5...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........e..X5.n.V`wFn...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.9.0...C.R.T...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........e..X5.n.V`wFn...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0..........a........"0....H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA0...081022223914Z..100122224914Z0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....MOPR1E0C..U...<Microsoft Develo

C:\Windows\WinSxS\InstallTemp\20250115102131222.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.manifest

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1860
Entropy (8bit):	5.392371898016726
Encrypted:	false
SSDEEP:	48:3SlK+vU6g49Pd09kkKKMzEAZ09kkKxrzVHNw09kkK3zY:Clt8CtdXks5ZXk8pNwXkK8
MD5:	53213FC8C2CB0D6F77CA6CBD40FFF22C
SHA1:	D8BA81ED6586825835B76E9D566077466EE41A85
SHA-256:	03D0776812368478CE60E8160EC3C6938782DB1832F5CB53B7842E5840F9DBC5
SHA-512:	E3CED32A2EABFD0028EC16E62687573D86C0112B2B1D965F1F9D0BB5557CEF5FDF5233E87FE73BE621A52AFFE4CE53BEDF958558AA899646FA390F4541CF11EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="98e8006e0a4542e69f1a3555b927758bd76ca07d"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>+CXED+6HzJlSphyMNOn27ujadC0=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="3aec3be680024a46813dee891a753bd58b3f3b12"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:d

C:\Windows\WinSxS\InstallTemp\20250115102131238.0\9.0.30729.4148.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7522
Entropy (8bit):	7.328101670485594
Encrypted:	false
SSDEEP:	192:iZ3fIJ2hEi1HnNpBjSebyaAqjkKiTbGpTcf:uQeHNpBjTeajC48
MD5:	F4F36BE5F6F26473AE2916D3614E04D0
SHA1:	CC81719FE7AC6BF72E2413206C6CAE4857CE4B9A
SHA-256:	44D63039DADFDE315555A2E4773153AB795AB46F254F7A21A8B3B6A29F71EE20
SHA-512:	27B5296422EC11639C8CF261C7B1057DB2FB5BB9E7771F4D3947D3742761C8634D1A7AC2DE2462A47CC4C4873422F406A046E4475A6A4DF97FA0FE270D95B0B2
Malicious:	false
Preview:	0..^...H.........O0..K...1.0...+......0.....+.....7......0..{0...+.....7.....t..n.. E........090712023807Z0...+.....7.....0..80....R5.E.3.9.1.7.8.6.7.3.0.5.F.D.B.F.0.7.D.9.3.0.1.B.D.4.6.3.2.F.8.6.2.E.2.6.8.0.7.2...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........^9..s.....0..c/..&.r0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....Fp.o.l.i.c.y...9...0.0...M.i.c.r.o.s.o.f.t...V.C.9.0...C.R.T...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........^9..s.....0..c/..&.r0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0..........a........"0....H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA0...081022223914Z..100122224914Z0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....MOPR1E

C:\Windows\WinSxS\InstallTemp\20250115102131238.0\9.0.30729.4148.policy

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	764
Entropy (8bit):	5.318118661435931
Encrypted:	false
SSDEEP:	12:TMHdtXBFN8uN53SNbMHpaXOr6gVuNnOw53SNK+MHCgVuNnm/6hdSIXOV/FkxqOK3:2dtXD+uXiNbPXU6g4NnOIiNK+zg4NnoP
MD5:	8D108E59FDDFA7E845AE8795296EA4FA
SHA1:	5E3917867305FDBF07D9301BD4632F862E268072
SHA-256:	7EA6ADD145DAF72CCBFD2140C32DA4718039B2B683CCB02B47C8DB142203E461
SHA-512:	D93758E1BD6170D5B70653F3C369230F97203CB1E789E6318652EEA128F5B63FFF2FB9CF4D7B16B4938B7856A0A5DB6A365803BA84F32954524E0630E857EE74
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">...<assemblyIdentity type="win32-policy" name="policy.9.0.Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>...<dependency>....<dependentAssembly>.....<assemblyIdentity type="win32" name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.....<bindingRedirect oldVersion="9.0.20718.0-9.0.21022.8" newVersion="9.0.30729.4148"/>.....<bindingRedirect oldVersion="9.0.30201.0-9.0.30729.4148" newVersion="9.0.30729.4148"/>....</dependentAssembly>...</dependency>..</assembly>..

C:\Windows\assembly\tmp\9Y4YXQIY\NGBHLPX0

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	908
Entropy (8bit):	3.591501424910525
Encrypted:	false
SSDEEP:	24:QlLOpYplJrYlWBSKnjbc7ww9SWDdkR8Eob7wWqdWJP:yek1DH87ww9xdRBH0dm
MD5:	8A9FDA784C76AEBFCC8266727C31A77D
SHA1:	1E5C13D11DBB9252303BFAF3960A0FEC9C7EC238
SHA-256:	7CBB6401A894AE9DCE3F1EE3D775D6766E4D12545F3397A171E82E24D5B58652
SHA-512:	009FEFE18B87B589EE041A45EF3A7B3CB04ED1738CE7199CB76722A58F328A1D86A7006BF31505A64F9BE4DE2B0448F273A3CEE10DC40D0B0FEA1D1C6115A404
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.<.c.o.n.f.i.g.u.r.a.t.i.o.n.>.......<.r.u.n.t.i.m.e.>.........<.a.s.s.e.m.b.l.y.B.i.n.d.i.n.g. .x.m.l.n.s.=.".u.r.n.:.s.c.h.e.m.a.s.-.m.i.c.r.o.s.o.f.t.-.c.o.m.:.a.s.m...v.1.".>...........<.d.e.p.e.n.d.e.n.t.A.s.s.e.m.b.l.y.>.............<.a.s.s.e.m.b.l.y.I.d.e.n.t.i.t.y. .p.u.b.l.i.c.K.e.y.T.o.k.e.n.=.".7.1.e.9.b.c.e.1.1.1.e.9.4.2.9.c.". .n.a.m.e.=.".M.i.c.r.o.s.o.f.t...O.f.f.i.c.e...I.n.t.e.r.o.p...A.c.c.e.s.s...D.a.o.". .c.u.l.t.u.r.e.=.".n.e.u.t.r.a.l.".>.<./.a.s.s.e.m.b.l.y.I.d.e.n.t.i.t.y.>.............<.b.i.n.d.i.n.g.R.e.d.i.r.e.c.t. .o.l.d.V.e.r.s.i.o.n.=.".1.2...0...0...0.". .n.e.w.V.e.r.s.i.o.n.=.".1.4...0...0...0.".>.<./.b.i.n.d.i.n.g.R.e.d.i.r.e.c.t.>...........<./.d.e.p.e.n.d.e.n.t.A.s.s.e.m.b.l.y.>.........<./.a.s.s.e.m.b.l.y.B.i.n.d.i.n.g.>.......<./.r.u.n.t.i.m.e.>.....<./.c.o.n.f.i.g.u.r.a.t.i.o.n.>.

C:\Windows\assembly\tmp\9Y4YXQIY\Policy.12.0.Microsoft.Office.Interop.Access.Dao.config (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	908
Entropy (8bit):	3.591501424910525
Encrypted:	false
SSDEEP:	24:QlLOpYplJrYlWBSKnjbc7ww9SWDdkR8Eob7wWqdWJP:yek1DH87ww9xdRBH0dm
MD5:	8A9FDA784C76AEBFCC8266727C31A77D
SHA1:	1E5C13D11DBB9252303BFAF3960A0FEC9C7EC238
SHA-256:	7CBB6401A894AE9DCE3F1EE3D775D6766E4D12545F3397A171E82E24D5B58652
SHA-512:	009FEFE18B87B589EE041A45EF3A7B3CB04ED1738CE7199CB76722A58F328A1D86A7006BF31505A64F9BE4DE2B0448F273A3CEE10DC40D0B0FEA1D1C6115A404
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.<.c.o.n.f.i.g.u.r.a.t.i.o.n.>.......<.r.u.n.t.i.m.e.>.........<.a.s.s.e.m.b.l.y.B.i.n.d.i.n.g. .x.m.l.n.s.=.".u.r.n.:.s.c.h.e.m.a.s.-.m.i.c.r.o.s.o.f.t.-.c.o.m.:.a.s.m...v.1.".>...........<.d.e.p.e.n.d.e.n.t.A.s.s.e.m.b.l.y.>.............<.a.s.s.e.m.b.l.y.I.d.e.n.t.i.t.y. .p.u.b.l.i.c.K.e.y.T.o.k.e.n.=.".7.1.e.9.b.c.e.1.1.1.e.9.4.2.9.c.". .n.a.m.e.=.".M.i.c.r.o.s.o.f.t...O.f.f.i.c.e...I.n.t.e.r.o.p...A.c.c.e.s.s...D.a.o.". .c.u.l.t.u.r.e.=.".n.e.u.t.r.a.l.".>.<./.a.s.s.e.m.b.l.y.I.d.e.n.t.i.t.y.>.............<.b.i.n.d.i.n.g.R.e.d.i.r.e.c.t. .o.l.d.V.e.r.s.i.o.n.=.".1.2...0...0...0.". .n.e.w.V.e.r.s.i.o.n.=.".1.4...0...0...0.".>.<./.b.i.n.d.i.n.g.R.e.d.i.r.e.c.t.>...........<./.d.e.p.e.n.d.e.n.t.A.s.s.e.m.b.l.y.>.........<./.a.s.s.e.m.b.l.y.B.i.n.d.i.n.g.>.......<./.r.u.n.t.i.m.e.>.....<./.c.o.n.f.i.g.u.r.a.t.i.o.n.>.

C:\Windows\assembly\tmp\9Y4YXQIY\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11664
Entropy (8bit):	6.086951835291407
Encrypted:	false
SSDEEP:	192:nT3qUGB8tXgWYbZ0czWXlQKPnEtObMacxc8hjXHUz1TrWmWA51c5kU:LjOWYbZ0czWXlLXci2jXHUDjg5x
MD5:	1AD4166C04970B0F4C69A3E7DDC3CC2D
SHA1:	E7F541D949BED2038B4DC8BF750D88296146471F
SHA-256:	31D7176CDF110C15A9001FBA733235FFFD8F3E62823E9C23B68F642C3C2AF53A
SHA-512:	A93729713E570F49151B4A70226A811FB7A64FA551BB320B8B7CBCEABA8534FA2F809E1300A665D36DBEDA83D8D84D51315810D4146C13AF4C7ED00A0D520C2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6.K...........!................~(... ...@....@.. ....................................@.................................((..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`(......H........ ..X...................P ........................................./...-W.0..........P.MG...E.!J.I..!...h6y.A=..!.%)m.'.. ...K...*........]...u..L..QT..EAG....i.bi.t9v..p..q......`U+.&BSJB............v2.0.50727......l.......#~......\|...#Strings............#US.........#GUID...........#Blob...............I......3....................................................Y.G...z.G.....G.....G.....G.....G.....G.....G...1.G...J.G...c.G.....G.....G.........................

C:\Windows\assembly\tmp\T50LY6O0\Microsoft.Office.interop.access.dao.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79744
Entropy (8bit):	5.749473118886424
Encrypted:	false
SSDEEP:	1536:VHjzVGyTrbq6VwaueouprFx/Eq8wHgW593vdn9rHU:VHjzYyTrOkwa1nprQq8SRln9o
MD5:	BB39161455A053800391C52840FC010A
SHA1:	A1E13CA23113E0FA31FD32D86308F46C781BD17B
SHA-256:	600D17C72C34E4EAC2F3B43B2E201409C0A3630906B47047A46103BF01B04466
SHA-512:	9FE0F50B4F27FD5A0C2E3470C2030B2FEE6D59FBB6CA8CA5AD9F117F2353943C874993D71E843777BD0F61A5E0C3DB71C54A4BD9AD2F84C99B306F6D98D013EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6.K...........!......... ........... ... ....@.. .......................`............@.................................t...W.... ..p............ .......@....................................................... ............... ..H............text........ ...................... ..`.rsrc...p.... ......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.998929423643008
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AccessDatabaseuser.exe
File size:	26'557'232 bytes
MD5:	46b666e01d7ea03bc65ec5e1249f7d4b
SHA1:	0aa027c5d00ca67dd85eafeeb7ab245226331823
SHA256:	86fecfce83469b3f40ee93e0b54f433209c2bf5626d7f475761024e3f2d4a324
SHA512:	e4a9511a6f9cfeaa250493e9e3e82e4ec49f57d8c99fe84a1c555437b1d7e77e54097516f3e0eee504cbee89697b999a37cec67eb083b6ace539e12b1356e45a
SSDEEP:	393216:0jMie1Z3vW5sCM974cstQ6SPD/ExTMUQ6azGdUWhtYBqSEzU/3JHeO8EtbN0IknS:0jSS7cgQ6Sr/E16dWvI6egy0tTFBkKcr
TLSH:	9B4733236BDC1131D59BB3F5082AABD046B595701930C72AF35AC8BCAF392917879B87
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................0.......&.Y.....!......f..........).....1.......!.......4.....Rich............PE..L....!`O.................l.

File Icon


Icon Hash:	674e4f45a7297639

Static PE Info

General

Entrypoint:	0x2e02eddc
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x2e000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F602197 [Wed Mar 14 04:41:59 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	97ad647a7b555e8379d6b7032a4c3349

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	02/05/2019 23:37:46 02/05/2020 23:37:46
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	6F00C8E4B0871786C50F94F4FDB5B1CE
Thumbprint SHA-1:	62009AAABDAE749FD47D19150958329BF6FF4B34
Thumbprint SHA-256:	B5DC4E58C8AFB9688734F6C5CF3ED0D4D89BF8366ACE982CC6B6854C480FC82E
Serial:	33000001519E8D8F4071A30E41000000000151

Entrypoint Preview

Instruction
call 00007FD974CE5473h
jmp 00007FD974CE176Dh
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 00007FD974CE1C1Bh
mov edi, edi
push ecx
mov dword ptr [ecx], 2E009AF4h
call 00007FD974CE54EBh
pop ecx
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
call 00007FD974CE18D8h
test byte ptr [ebp+08h], 00000001h
je 00007FD974CE18F9h
push esi
call 00007FD974CE18C1h
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
add ecx, 09h
push ecx
add eax, 09h
push eax
call 00007FD974CE5523h
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 2E009AF8h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FD974CE18FEh
test byte ptr [eax], 00000008h
je 00007FD974CE18F9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [2E001120h]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword ptr [ebp+14h]
push edi
xor edi, edi
cmp esi, edi
jne 00007FD974CE18F6h
xor eax, eax
jmp 00007FD974CE1957h
cmp dword ptr [ebp+00h], edi

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x46e4c	0x78	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d000	0x5348	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x19516e8	0x2448
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x53000	0x3bd4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x47a90	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xacf0	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x230	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x46714	0x100	.text
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x46b31	0x46c00	ac9c5d316ee52cd77017cebe8d38a901	False	0.4681150618374558	data	6.501753553713817	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x48000	0x4638	0x2c00	d74af3aa9602c3f5a123d11a40ef99de	False	0.2654474431818182	data	4.503636224887963	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4d000	0x5348	0x5400	ddd229dd5a124c043fa372a9b11790b3	False	0.1900576636904762	data	3.971649855924063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x53000	0x3bd4	0x3c00	1b85081af4620f34a65bc9c3657048e8	False	0.7677734375	data	6.678533556810769	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4d2f4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.41397849462365593
RT_ICON	0x4d5dc	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5641891891891891
RT_DIALOG	0x4d704	0xe4	data	English	United States	0.6491228070175439
RT_DIALOG	0x4d7e8	0xe4	data	English	United States	0.6535087719298246
RT_DIALOG	0x4d8cc	0xfe	data	English	United States	0.6062992125984252
RT_DIALOG	0x4d9cc	0xfe	data	English	United States	0.6141732283464567
RT_DIALOG	0x4dacc	0x158	data	English	United States	0.5261627906976745
RT_DIALOG	0x4dc24	0x158	data	English	United States	0.5261627906976745
RT_RCDATA	0x4dd7c	0x3e5e	data			0.13666541400476012
RT_GROUP_ICON	0x51bdc	0x22	data	English	United States	1.0
RT_VERSION	0x51c00	0x414	data	English	United States	0.3879310344827586
RT_MANIFEST	0x52014	0x331	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5250917992656059

Imports

DLL	Import
KERNEL32.dll	lstrlenW, FreeLibrary, GetProcAddress, LoadLibraryA, CloseHandle, GetExitCodeProcess, WaitForSingleObject, MultiByteToWideChar, lstrlenA, GetFileSize, CreateFileA, CreateDirectoryA, DeleteFileA, GetTempFileNameA, GetTempPathA, GetFullPathNameA, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, CopyFileA, MoveFileA, Sleep, Process32Next, Process32First, CreateToolhelp32Snapshot, CreateThread, ReadFile, ExpandEnvironmentStringsA, SetEvent, CreateEventA, SetFilePointer, WriteFile, CreateFileW, GetTempFileNameW, GetTempPathW, DeleteFileW, CreateProcessW, WideCharToMultiByte, LoadResource, FindResourceA, GetSystemDirectoryA, GetUserDefaultLangID, GetSystemDefaultLangID, GetVersionExA, GlobalFree, GlobalAlloc, CompareStringA, GetCurrentProcess, WritePrivateProfileStringA, GetWindowsDirectoryA, SetCurrentDirectoryA, CreateProcessA, GetDiskFreeSpaceExA, GetModuleFileNameA, SetLastError, GetCurrentDirectoryA, SetFileTime, DosDateTimeToFileTime, LocalAlloc, FlushFileBuffers, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, GetStringTypeW, LockResource, GetLastError, GetFileAttributesW, HeapFree, GetProcessHeap, GetCommandLineA, GetStartupInfoA, RaiseException, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlUnwind, GetFileAttributesA, ExitThread, GetCurrentThreadId, GetModuleHandleW, ExitProcess, HeapAlloc, GetStdHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, InterlockedDecrement, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, GetModuleHandleA, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, InterlockedExchange, InitializeCriticalSectionAndSpinCount, GetConsoleCP, GetConsoleMode, GetLocaleInfoA, LCMapStringA, LCMapStringW, GetStringTypeA
OLEAUT32.dll	VariantClear, VariantChangeType, SysAllocString, SysFreeString, VariantInit
VERSION.dll	GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
ole32.dll	CoCreateInstance, CLSIDFromProgID, CoInitialize, CoTaskMemFree
GDI32.dll	CreateFontIndirectA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 16:21:25.075073957 CET	57101	53	192.168.2.6	1.1.1.1
Jan 15, 2025 16:21:25.079981089 CET	53	57101	1.1.1.1	192.168.2.6
Jan 15, 2025 16:21:25.080385923 CET	57101	53	192.168.2.6	1.1.1.1
Jan 15, 2025 16:21:25.085268974 CET	53	57101	1.1.1.1	192.168.2.6
Jan 15, 2025 16:21:25.533427000 CET	57101	53	192.168.2.6	1.1.1.1
Jan 15, 2025 16:21:25.538458109 CET	53	57101	1.1.1.1	192.168.2.6
Jan 15, 2025 16:21:25.538522959 CET	57101	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 16:21:25.074510098 CET	53	61282	1.1.1.1	192.168.2.6

Target ID:	0
Start time:	10:21:06
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\AccessDatabaseuser.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AccessDatabaseuser.exe"
Imagebase:	0x2d360000
File size:	26'557'232 bytes
MD5 hash:	46B666E01D7EA03BC65EC5E1249F7D4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:21:08
Start date:	15/01/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7851b0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:21:08
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 6DCFC73376ADDBA52990B232DF33C952 C
Imagebase:	0x880000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:21:24
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding E0883EF17785BDC605A083E905F940CD
Imagebase:	0x880000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:21:32
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A0E0FCCBD52B915BB5099AA028D1FC6F E Global\MSI0000
Imagebase:	0x880000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	78

Executed Functions

Function 2D382FF7 Relevance: 49.2, APIs: 8, Strings: 20, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 2D383024
GetVersionExA.KERNEL32(?), ref: 2D38303F
GetVersionExA.KERNEL32(?), ref: 2D383056
GetLastError.KERNEL32 ref: 2D38305C
__CxxThrowException@8.LIBCMT ref: 2D383082

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

GetSystemDefaultLangID.KERNEL32(SYS.WIN.SPLEVEL,NONE,SYS.WIN.PLATFORM,WIN9X,SYS.WIN.VER,?), ref: 2D383133
GetUserDefaultLangID.KERNEL32(SYS.WIN.SYSTEMLCID,?), ref: 2D38315C
GetModuleFileNameW.KERNEL32(00000000,?,00000104,SYS.WIN.ARCHITECTURE,X86), ref: 2D3831F6

Strings

SYS.WIN.USERADMIN, xrefs: 2D38319A
X86, xrefs: 2D3831D6
SYS.WIN.SHELLVER, xrefs: 2D38322D
SYS.WIN.PACKAGEPATH, xrefs: 2D38320B
OPatchInstall: Failed to get the path to the EXE, xrefs: 2D38324C
UNKNOWN, xrefs: 2D3830D3, 2D3831C1
msi.dll, xrefs: 2D383217
SYS.WIN.SPLEVEL, xrefs: 2D383127
SYS.WIN.VER, xrefs: 2D3830B9
WIN9X, xrefs: 2D3830E1
SYS.WIN.PLATFORM, xrefs: 2D3830E6
X64, xrefs: 2D3831C8
IA64, xrefs: 2D3831CF
shell32.dll, xrefs: 2D383228
SYS.WIN.ARCHITECTURE, xrefs: 2D3831DB
SYS.WIN.USERLCID, xrefs: 2D383179
SYS.MSI.VER, xrefs: 2D38321C
NONE, xrefs: 2D383122
SYS.WIN.SYSTEMLCID, xrefs: 2D383150
WINNT, xrefs: 2D3830DA

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DefaultFileLangUserVersion$DispatcherErrorExceptionException@8LastModuleNameSystemThrowWrite_memset
String ID: IA64$NONE$OPatchInstall: Failed to get the path to the EXE$SYS.MSI.VER$SYS.WIN.ARCHITECTURE$SYS.WIN.PACKAGEPATH$SYS.WIN.PLATFORM$SYS.WIN.SHELLVER$SYS.WIN.SPLEVEL$SYS.WIN.SYSTEMLCID$SYS.WIN.USERADMIN$SYS.WIN.USERLCID$SYS.WIN.VER$UNKNOWN$WIN9X$WINNT$X64$X86$msi.dll$shell32.dll
API String ID: 2665424290-1166132504
Opcode ID: e1f0cfb3e53f3d21f0f829c7758834faf927eed17930df9c3d39bf48c0597984
Instruction ID: a65ca9d9c26dc989b318a61ed7331dd678de1bd219e275cffd9d6aec358e92e5
Opcode Fuzzy Hash: e1f0cfb3e53f3d21f0f829c7758834faf927eed17930df9c3d39bf48c0597984
Instruction Fuzzy Hash: 8351F6B1E09114ABDF219BA0CC85FBD72BDEB55601F448091E615F229FDB389E00C7B9

Function 2D37EC30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,SCRIPT,0000000A), ref: 2D37EC3F
GetLastError.KERNEL32 ref: 2D37EC49
__CxxThrowException@8.LIBCMT ref: 2D37EC66
LoadResource.KERNEL32(00000000,00000000), ref: 2D37EC6E
LockResource.KERNEL32(00000000), ref: 2D37EC79
SysAllocString.OLEAUT32(00000000), ref: 2D37EC80

Strings

SCRIPT, xrefs: 2D37EC38

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Resource$AllocErrorException@8FindLastLoadLockStringThrow
String ID: SCRIPT
API String ID: 2070536136-3967369404
Opcode ID: 3762740e90cb996da5b84c989ffddbef5a49436bef135e44635532e9b194a8da
Instruction ID: 6460f17c1dce5f15d3f650a47b8ee68075d4b520ee29a11c4f05891857767df4
Opcode Fuzzy Hash: 3762740e90cb996da5b84c989ffddbef5a49436bef135e44635532e9b194a8da
Instruction Fuzzy Hash: 2AF04439E08646BFD7119BB0C889FAE7BBCEF14641F004490E602F6255DB78D604D7A9

Function 2D38784B Relevance: 4.5, APIs: 3, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 2D387852
GetProcAddress.KERNEL32(00000000,?), ref: 2D387867
FreeLibrary.KERNELBASE(00000000), ref: 2D387873

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID:
API String ID: 145871493-0
Opcode ID: 3280828a9c04f1ab7b5e2dbf7ee0e43613ac086e27b0c97fe5bd5c5c7072e751
Instruction ID: b3218e4996e4f835ade1271b34f35f9e2b3ebb9846f150be1d05934c7f73ab9e
Opcode Fuzzy Hash: 3280828a9c04f1ab7b5e2dbf7ee0e43613ac086e27b0c97fe5bd5c5c7072e751
Instruction Fuzzy Hash: 2EE0EC36841129BB5B122B61DC09DDB7B6DEE06AA37008152FD4596211C62ACD54A6E8

Function 2D373001 Relevance: 3.0, APIs: 2, Instructions: 31comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE(?,?), ref: 2D373020
CoCreateInstance.OLE32(?,?,?,2D362FE0), ref: 2D373038

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 743448ba8356d50f916bbd55c849f01eabeace770d0d2d0f5186ddebf23bcc33
Instruction ID: 67df1f8cf104322cb4c6ef1fbbb10655909f2ce5f8c8e372120efb3f8ed0ac28
Opcode Fuzzy Hash: 743448ba8356d50f916bbd55c849f01eabeace770d0d2d0f5186ddebf23bcc33
Instruction Fuzzy Hash: 4BF08C32A00109BB8B01DFA9CD49DDFBBBCEB59650B01401EB602F3200DA74EA00CBB9

Function 2D37EB78 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32 ref: 2D37EB7F
SysAllocString.OLEAUT32(00000000), ref: 2D37EBA5
FindResourceA.KERNEL32(00000000,MANIFEST,0000000A), ref: 2D37EBCC

Strings

MANIFEST, xrefs: 2D37EBC5

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: AllocClearFindResourceStringVariant
String ID: MANIFEST
API String ID: 317432608-1623847948
Opcode ID: 300fba7d6ad704aa57e50524c4c03c5efc318b8c433de7145ec21a4096e58469
Instruction ID: b0b385cbbc818ea6a2e37779a500451ec035aad67e07145499eaa3600ddf50da
Opcode Fuzzy Hash: 300fba7d6ad704aa57e50524c4c03c5efc318b8c433de7145ec21a4096e58469
Instruction Fuzzy Hash: 5511D33590460ABBE7119BB0CC49BAA7BFCEF10606F008465F606FA201EB789604C7A8

Function 2D37A4FE Relevance: 15.1, APIs: 10, Instructions: 79
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongA.USER32(?,00000008,?), ref: 2D37A518
GetDlgItem.USER32(?,000003E8), ref: 2D37A535
GetDlgItem.USER32(?,00000002), ref: 2D37A53D
SendMessageA.USER32(?,00000030,0E0A0D77,00000001), ref: 2D37A54E
SendMessageA.USER32(?,00000030,0E0A0D77,00000001), ref: 2D37A558
SendMessageA.USER32(00000110,00000030,0E0A0D77,00000001), ref: 2D37A562
GetWindowLongA.USER32(?,00000008), ref: 2D37A56E
KiUserCallbackDispatcher.NTDLL(?), ref: 2D37A597

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: MessageSend$ItemLongWindow$CallbackDispatcherUser
String ID:
API String ID: 1186804443-0
Opcode ID: 93f731a9b87f5bc6d3ab54eb70cad72254d9da53ee27e79a08e1e53b74ac5569
Instruction ID: 1c8c073e9293601c4b252dc34fa2883401c4123a04e5743708145cb7d320dd7b
Opcode Fuzzy Hash: 93f731a9b87f5bc6d3ab54eb70cad72254d9da53ee27e79a08e1e53b74ac5569
Instruction Fuzzy Hash: 55219031648618BAFB029F64CC59FA97BFEAF14BA5F008015F7496A1D0C6BC99448A90

Function 2D36F5CB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000208,?), ref: 2D36F5FD
GetLastError.KERNEL32 ref: 2D36F607
__CxxThrowException@8.LIBCMT ref: 2D36F62D
__snwprintf_s.LIBCMT ref: 2D36F64C
CreateFileW.KERNELBASE(?,C0000000,00000001,00000000,00000001,00000080,00000000,?,?,?,?,?,?,00000000,2D3A1F6C), ref: 2D36F66B
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,2D3A1F6C), ref: 2D36F676
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000,2D3A1F6C), ref: 2D36F698

Strings

%s%s (%i).%s, xrefs: 2D36F641

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ErrorLast$CloseCreateException@8FileHandlePathTempThrow__snwprintf_s
String ID: %s%s (%i).%s
API String ID: 851263882-4104947418
Opcode ID: 757089e28cd55d889906b4ddefb6a83c8c2e4329ebe4d273199f708e36087733
Instruction ID: f7b2794bf5d0fc046c02c8fa3532ff1ea389245a2dcfbe04518517c86d03f870
Opcode Fuzzy Hash: 757089e28cd55d889906b4ddefb6a83c8c2e4329ebe4d273199f708e36087733
Instruction Fuzzy Hash: 3A217971A04218ABEB218A60CC85FEA737DEB05714F2081A5F711F61D5DB749A808BBD

Function 2D381A56 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 2D381A60

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

__CxxThrowException@8.LIBCMT ref: 2D381BE0

Part of subcall function 2D38F117: __lock.LIBCMT ref: 2D38F135
Part of subcall function 2D38F117: ___sbh_find_block.LIBCMT ref: 2D38F140
Part of subcall function 2D38F117: ___sbh_free_block.LIBCMT ref: 2D38F14F
Part of subcall function 2D38F117: RtlFreeHeap.NTDLL(00000000,?,2D3A6180,0000000C,2D392583,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C), ref: 2D38F17F
Part of subcall function 2D38F117: GetLastError.KERNEL32(?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D), ref: 2D38F190

Part of subcall function 2D36D44F: char_traits.LIBCPMT ref: 2D36D474

Strings

OPatchInstall: Creating system property ', xrefs: 2D381A6C
CSession::createStandardProperty, xrefs: 2D381BC2
' with value ', xrefs: 2D381AB1
' was already created, xrefs: 2D381BAE
OPatchInstall: The system property ', xrefs: 2D381B66

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ErrorException@8FileFreeH_prolog3HeapLastThrowWrite___sbh_find_block___sbh_free_block__lockchar_traits
String ID: ' was already created$' with value '$CSession::createStandardProperty$OPatchInstall: Creating system property '$OPatchInstall: The system property '
API String ID: 428937594-843738436
Opcode ID: 694c4e662b44295b46715412f775206f33c5faf24adbefc0f24770b92c354fed
Instruction ID: c711e06450db4f03e422f117e522c9ab3c84546246fe30a581ee6fe73eedc49d
Opcode Fuzzy Hash: 694c4e662b44295b46715412f775206f33c5faf24adbefc0f24770b92c354fed
Instruction Fuzzy Hash: A0516731A05219AEDF25DB50CC50BEDBB75EF61304F128199E21ABA1E1DB702F84CBA5

Function 2D3866D8 Relevance: 12.2, APIs: 8, Instructions: 237
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 2D3866E2
GetFileVersionInfoSizeA.VERSION(?,?,000000A8,2D382E33,?,00000000,2D3612A4,2D361344,00000000,OPatchInstall: Getting version of the system dll '), ref: 2D386710
GetLastError.KERNEL32(?,?,000000A8,2D382E33,?,00000000,2D3612A4,2D361344,00000000,OPatchInstall: Getting version of the system dll '), ref: 2D38671C

Part of subcall function 2D36D404: char_traits.LIBCPMT ref: 2D36D429

Part of subcall function 2D36E7F7: __strftime_l.LIBCMT ref: 2D36E809

Part of subcall function 2D3865D3: __EH_prolog3.LIBCMT ref: 2D3865DA

Part of subcall function 2D38652F: std::_String_base::_Xlen.LIBCPMT ref: 2D38656C

__CxxThrowException@8.LIBCMT ref: 2D386739
GlobalAlloc.KERNEL32(00000040,00000000,?,?,000000A8,2D382E33,?,00000000,2D3612A4,2D361344,00000000,OPatchInstall: Getting version of the system dll '), ref: 2D386741
GetFileVersionInfoA.VERSION(?,00000000,?,00000000), ref: 2D38676D
VerQueryValueA.VERSION(?,2D367790,?,?,?,00000000,?,00000000), ref: 2D386782
GlobalFree.KERNEL32(?), ref: 2D38699C

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocErrorException@8FreeH_prolog3H_prolog3_LastQuerySizeString_base::_ThrowValueXlen__strftime_lchar_traitsstd::_
String ID:
API String ID: 1266200685-0
Opcode ID: 827200e7d2a29708be8764345486c56dfc00192dc470b4ab2b225d89163d6e50
Instruction ID: 47e2fee17680163fe3287afb39d47b69dca26ceac6dfa37d7a428d5e5392daee
Opcode Fuzzy Hash: 827200e7d2a29708be8764345486c56dfc00192dc470b4ab2b225d89163d6e50
Instruction Fuzzy Hash: 5E91A271C08258FECB11DBA4DC80EEEBBB8EF65310F108159F215B3296EB345A09CB61

Function 2D382D3E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 2D382D48
_memset.LIBCMT ref: 2D382D74
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 2D382D8D
GetLastError.KERNEL32 ref: 2D382D97
__CxxThrowException@8.LIBCMT ref: 2D382DBD

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

OPatchInstall: Getting version of the system dll ', xrefs: 2D382DEE

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DirectoryDispatcherErrorExceptionException@8H_prolog3_catch_LastSystemThrowUser_memset
String ID: OPatchInstall: Getting version of the system dll '
API String ID: 2618885068-2740981447
Opcode ID: 38e9b06d21ff125bc02cc3efac5242a78f8b5dc3f493df96c89b62cf8620620e
Instruction ID: 78894276777736f04ceb39b903ab28b6c4141519e153da32a9960faa24a77c48
Opcode Fuzzy Hash: 38e9b06d21ff125bc02cc3efac5242a78f8b5dc3f493df96c89b62cf8620620e
Instruction Fuzzy Hash: D8315C72904268ABCB24DB60CC85BDD77B8EB64301F1181D5E209F7292DB746F84CFA5

Function 2D39079C Relevance: 9.1, APIs: 6, Instructions: 71
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___set_flsgetvalue.LIBCMT ref: 2D3907CD
__calloc_crt.LIBCMT ref: 2D3907D9
__getptd.LIBCMT ref: 2D3907E6
CreateThread.KERNELBASE(?,?,2D390719,00000000,?,?), ref: 2D39081D
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 2D390827
__dosmaperr.LIBCMT ref: 2D39083F

Part of subcall function 2D392E82: __getptd_noexit.LIBCMT ref: 2D392E82

Part of subcall function 2D38F391: __decode_pointer.LIBCMT ref: 2D38F39C

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
String ID:
API String ID: 1803633139-0
Opcode ID: c43bbec2c66c6fcfbf13df4e99cec224f695ea8c90c4ddd7b0a9982cb3d500b2
Instruction ID: bf80c8d5744f949cd97eaa19026620bf91d12887755e187ee85e134acf558cd2
Opcode Fuzzy Hash: c43bbec2c66c6fcfbf13df4e99cec224f695ea8c90c4ddd7b0a9982cb3d500b2
Instruction Fuzzy Hash: 0E11C472508609BFDB01AFA4CC819DE77A8FF14260FA18039F605F6191EB319A41CBA0

Function 2D36D1FD Relevance: 7.6, APIs: 5, Instructions: 84
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00000000), ref: 2D36D21B
WideCharToMultiByte.KERNELBASE(?,00000000,00000000,00000001,?,00000001,00000000,00000000), ref: 2D36D24E
GetLastError.KERNEL32(?,00000001,00000000,00000000), ref: 2D36D259
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000001,00000000,00000000), ref: 2D36D272
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000000,00000000,00000000,?,00000001,00000000,00000000), ref: 2D36D2A0

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: b49efd6cdec0fead5c9baef7f0e24eb2acb78e9cb95d71895b8bfdef75c357c1
Instruction ID: a920f034db61721ab969ee995d21d90e7e6d666a7208c9659c73b7a553669740
Opcode Fuzzy Hash: b49efd6cdec0fead5c9baef7f0e24eb2acb78e9cb95d71895b8bfdef75c357c1
Instruction Fuzzy Hash: FD213B72801124BBDB214F56DC44EAF7FBDEF46BA4F108114FA48A6114C6718E50DBF8

Function 2D389959 Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 2D389996
GetLastError.KERNEL32 ref: 2D3899A8
__CxxThrowException@8.LIBCMT ref: 2D3899DC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 2D389A31
GetLastError.KERNEL32 ref: 2D389A37

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CreateDirectoryErrorLast$Exception@8Throw
String ID:
API String ID: 1240546814-0
Opcode ID: c0f7641ecd15e41f709c11bdb92a4d432b4acee78d9b3156a91e033cd55aff42
Instruction ID: 612e9191d70f543da8379835679a560c0b2f883f4d57f990009af2656fe46a4d
Opcode Fuzzy Hash: c0f7641ecd15e41f709c11bdb92a4d432b4acee78d9b3156a91e033cd55aff42
Instruction Fuzzy Hash: 5321FB35E04219ABDB11DB24CC45BEAB7BC9F65740F1141A1D640F7192DA74DB848FA0

Function 2D3887D7 Relevance: 7.6, APIs: 5, Instructions: 77
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 2D388810
__CxxThrowException@8.LIBCMT ref: 2D388852
CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 2D388889
GetLastError.KERNEL32(?,00000002,00000080,?,?,?,2D3A1F6C), ref: 2D38889A
SetFileTime.KERNELBASE(00000000,?,?,?), ref: 2D3888B6

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: File$CreateErrorException@8LastThrowTime_memset
String ID:
API String ID: 3537502443-0
Opcode ID: d83ed8746d1e4f104008d1ba6d03d2d66841063cd2667bc37426d115828d7311
Instruction ID: 343c2bd404cc01e95ab636493fd0ffd0a5efe12f1b8c1abbca1ea46a17ef9d90
Opcode Fuzzy Hash: d83ed8746d1e4f104008d1ba6d03d2d66841063cd2667bc37426d115828d7311
Instruction Fuzzy Hash: 0921AE76D08218BEDB109BA4DC81FDA77BCEB29750F108195E284F7181CAB49A848FA0

Function 2D37A683 Relevance: 7.6, APIs: 5, Instructions: 57
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 2D37A6AA
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 2D37A6B4
GetLastError.KERNEL32 ref: 2D37A6C1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 2D37A705
CloseHandle.KERNELBASE(?), ref: 2D37A70E

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CloseCreateErrorEventException@8HandleLastObjectSingleThrowWait
String ID:
API String ID: 3382691732-0
Opcode ID: 0a68b700f10f2a3eb7aaa3de1a4ceedf327aeec3032ace82dc1e05003d9872a7
Instruction ID: 758ffbc5f3a90c72d02f98942ebb1afe380a716db8352357ebc5f3bbfa3c3c9f
Opcode Fuzzy Hash: 0a68b700f10f2a3eb7aaa3de1a4ceedf327aeec3032ace82dc1e05003d9872a7
Instruction Fuzzy Hash: C011E735808644BFCB219F61CC44CAB7FBCEF95750B00C15AF5A5A2211E7349644DBA4

Function 2D37A619 Relevance: 7.5, APIs: 5, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 2D37A5CB: CreateDialogParamW.USER32(00000000,-00000065,00000000,Function_0001A4FE), ref: 2D37A5E9
Part of subcall function 2D37A5CB: GetLastError.KERNEL32 ref: 2D37A5F3
Part of subcall function 2D37A5CB: __CxxThrowException@8.LIBCMT ref: 2D37A610

SetEvent.KERNEL32(?), ref: 2D37A634
IsDialogMessage.USER32(?,?), ref: 2D37A64F
TranslateMessage.USER32(?), ref: 2D37A65D
DispatchMessageA.USER32(?), ref: 2D37A667
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 2D37A674

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Message$Dialog$CallbackCreateDispatchDispatcherErrorEventException@8LastParamThrowTranslateUser
String ID:
API String ID: 1063205569-0
Opcode ID: 0c1a63633889e7d3e006c667e3ecf6e07a777a92b9931547f234eba28824b376
Instruction ID: 382b3e30ffee492b594cca6e9adbc630378d4a174f05416fb3aa4f43634df179
Opcode Fuzzy Hash: 0c1a63633889e7d3e006c667e3ecf6e07a777a92b9931547f234eba28824b376
Instruction Fuzzy Hash: BAF08172A04519BFDB01AFB4CC88EAF77BDBE046543004925F655E2140D23CD9158BA4

Function 2D38F117 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 2D38F135

Part of subcall function 2D3934BE: __amsg_exit.LIBCMT ref: 2D3934E0
Part of subcall function 2D3934BE: EnterCriticalSection.KERNEL32(?,?,?,2D39263D,0000000D,2D3A62C8,00000008,2D390778,?,00000000), ref: 2D3934E8

___sbh_find_block.LIBCMT ref: 2D38F140
___sbh_free_block.LIBCMT ref: 2D38F14F
RtlFreeHeap.NTDLL(00000000,?,2D3A6180,0000000C,2D392583,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C), ref: 2D38F17F
GetLastError.KERNEL32(?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D), ref: 2D38F190

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock
String ID:
API String ID: 2877530213-0
Opcode ID: db6aed1af361bd5681d3a5acdb6eff8fbc33cda160fd6316d4fc0bf1a535701c
Instruction ID: ff6322d39193a7b01f1ae1e52da163c9812eb3801b9ff7719f56c8abe3ddff64
Opcode Fuzzy Hash: db6aed1af361bd5681d3a5acdb6eff8fbc33cda160fd6316d4fc0bf1a535701c
Instruction Fuzzy Hash: 59016275D09715BBDB265FB1D8057AE3B74EF10762F51C014E654F71C1DB388640CA98

Function 2D37A3D8 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E8), ref: 2D37A3ED
GetDlgItem.USER32(?,00000002), ref: 2D37A3F5
SetWindowTextW.USER32(00000000,00000000), ref: 2D37A403
SetWindowTextW.USER32(00000000,00000000), ref: 2D37A413
SetWindowTextW.USER32(?,00000000), ref: 2D37A424

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: TextWindow$Item
String ID:
API String ID: 1634842743-0
Opcode ID: 2d24782148456b2bd8ae8dd3328d4ca7ff71e8c5b6cfb6104ef499967b78ae83
Instruction ID: 11d0001972fe95b066562c510dccf1883f4a3c0a4287554418d600f6671d7ab8
Opcode Fuzzy Hash: 2d24782148456b2bd8ae8dd3328d4ca7ff71e8c5b6cfb6104ef499967b78ae83
Instruction Fuzzy Hash: BBF03036600218FBEB025F51CC09BAA7B7EFF08765F408035F60966291CBBB4960DBA0

Function 2D37C74E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D37C755
std::bad_exception::bad_exception.LIBCMT ref: 2D37C77D

Part of subcall function 2D36DF57: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DF60

__CxxThrowException@8.LIBCMT ref: 2D37C78B

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

map/set<T> too long, xrefs: 2D37C765

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: map/set<T> too long
API String ID: 4068783259-1285458680
Opcode ID: 69c8dcb9a265c7ad30f4513bfa558f170d0c5919b0e068745ebe81fb130fc40b
Instruction ID: a5578f076a0ff38f30708f5114db0984c57ee5d71de3c6030acc3176ffdeba3d
Opcode Fuzzy Hash: 69c8dcb9a265c7ad30f4513bfa558f170d0c5919b0e068745ebe81fb130fc40b
Instruction Fuzzy Hash: 7C410935604A40AFE711CF58C584EA9BBF5FF19304F0A8098D649AB762D779FC81CB90

Function 2D38962B Relevance: 6.2, APIs: 4, Instructions: 160timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D389632
DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 2D38970C
__CxxThrowException@8.LIBCMT ref: 2D3897C8
__EH_prolog3.LIBCMT ref: 2D3897D5

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: H_prolog3Time$DateException@8FileThrow
String ID:
API String ID: 1328005015-0
Opcode ID: 7247f77bd2f282466e03de69324c749acbb2493687fea49c7464f7d9830c9a32
Instruction ID: 21b25d1fc7394a86e2c0ab3b15a64759669a6f83de9d348344ea169d9bf1549a
Opcode Fuzzy Hash: 7247f77bd2f282466e03de69324c749acbb2493687fea49c7464f7d9830c9a32
Instruction Fuzzy Hash: F451AF71914209EFCB15CFA4C988EADB7B9FF18320F518519E256FB592CB30EA44CB60

Function 2D388364 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 2D388388
_memset.LIBCMT ref: 2D3883C9
KiUserCallbackDispatcher.NTDLL(00000029,00000154,?,00000000), ref: 2D3883E8
CreateFontIndirectA.GDI32(?), ref: 2D3883F9

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CallbackCreateDispatcherFontIndirectUserVersion_memset
String ID:
API String ID: 439434407-0
Opcode ID: 739bbdb6cf4b1bff0f7dd70fb2f3a1c6a99fd6b122d46c8aae06474bfb01433d
Instruction ID: 94426b7bef6ebaf8c7cb745df337df17ba6cc60883200c20dfba4ae4af051cff
Opcode Fuzzy Hash: 739bbdb6cf4b1bff0f7dd70fb2f3a1c6a99fd6b122d46c8aae06474bfb01433d
Instruction Fuzzy Hash: F011A170A04208ABDB91DF74DD05BDDB7FCAB05744F004095DA09F7383EBB89A498BA5

Function 2D39069B Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 2D3906AE

Part of subcall function 2D398B4B: __FindPESection.LIBCMT ref: 2D398BA6

__getptd_noexit.LIBCMT ref: 2D3906BE
__freeptd.LIBCMT ref: 2D3906C8
ExitThread.KERNEL32 ref: 2D3906D1

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: 1217f4812387c28250f5c7e8768503dd5179d84a1e259b1b33dbcd85ffccd626
Instruction ID: f2bf505739015fe0768b9ea387711bf848a8481c1e3bc1ceda5f3ed00bdd2deb
Opcode Fuzzy Hash: 1217f4812387c28250f5c7e8768503dd5179d84a1e259b1b33dbcd85ffccd626
Instruction Fuzzy Hash: FFD01275004606E7D7051771C91BBB577ADEB90A50F518020EB00B6568DFB4C481D5BC

Function 2D3910AE Relevance: 4.6, APIs: 3, Instructions: 78memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 2D3910D1
__NMSG_WRITE.LIBCMT ref: 2D3910D8
RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9), ref: 2D391127

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7684f30a0384c1b6c85823405e942b039120854939a5236f72e1447f2a65aa24
Instruction ID: bd639b0e47f7ce0022770f18a1bbb62724a37b8d0ba0f84478129285bb29030f
Opcode Fuzzy Hash: 7684f30a0384c1b6c85823405e942b039120854939a5236f72e1447f2a65aa24
Instruction Fuzzy Hash: D411B9326096567AD3121B29DC42BEA735DEF11AA0F128121EB44BB3D1DB71D941C7D4

Function 2D38EF83 Relevance: 4.5, APIs: 3, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 2D3910AE: __FF_MSGBANNER.LIBCMT ref: 2D3910D1
Part of subcall function 2D3910AE: __NMSG_WRITE.LIBCMT ref: 2D3910D8
Part of subcall function 2D3910AE: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9), ref: 2D391127

std::bad_alloc::bad_alloc.LIBCMT ref: 2D38EFC0

Part of subcall function 2D38EF68: std::exception::exception.LIBCMT ref: 2D38EF74

std::bad_exception::bad_exception.LIBCMT ref: 2D38EFD4
__CxxThrowException@8.LIBCMT ref: 2D38EFE2

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: AllocateException@8HeapThrowstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 3585760706-0
Opcode ID: 2f4686eabb90d40329875c4d7dbbee36d575876fe62d4f897ddf0db3605a1a8f
Instruction ID: d78d825895ad310942fcfaa30ec3661aeb2d5ae5edb5aa7b75b2465739bcae1a
Opcode Fuzzy Hash: 2f4686eabb90d40329875c4d7dbbee36d575876fe62d4f897ddf0db3605a1a8f
Instruction Fuzzy Hash: 71F02727A0C20836CF046770EC159993FAADF21558F128026DE01F61A2EFB6DA05C390

Function 2D37A5CB Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

CreateDialogParamW.USER32(00000000,-00000065,00000000,Function_0001A4FE), ref: 2D37A5E9
GetLastError.KERNEL32 ref: 2D37A5F3
__CxxThrowException@8.LIBCMT ref: 2D37A610

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CreateDialogDispatcherErrorExceptionException@8LastParamThrowUser
String ID:
API String ID: 4168822975-0
Opcode ID: 6d158320f279958b54b7b635607df89783ae39122e6a523d0e3e073fb97e11cd
Instruction ID: 33c4678bcafe9de88f6d81b476d703d0cef17fa6f1b446f356f09a201d3d49f1
Opcode Fuzzy Hash: 6d158320f279958b54b7b635607df89783ae39122e6a523d0e3e073fb97e11cd
Instruction Fuzzy Hash: 62E065B6914644BF9708DF71CC4ADBB3BACDB255497048039F502E6111EA79D64086A5

Function 2D38E033 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 2D38E057

Strings

W, xrefs: 2D38E047

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8Throw
String ID: W
API String ID: 2005118841-655174618
Opcode ID: 1177747a82480896055f3e2e3f66cfabff626a0010d6650c0813ddf002be5960
Instruction ID: 3883dbfc198dcab6c5cdc857fdb88675ffecd3b7cda8ac0b8c2dad40c9098523
Opcode Fuzzy Hash: 1177747a82480896055f3e2e3f66cfabff626a0010d6650c0813ddf002be5960
Instruction Fuzzy Hash: A631BEB1904605EFD720CBA5C8849AAB7F9FB10386F00882DE752F7692C776EA44CB51

Function 2D38981A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 2D36E7F7: __strftime_l.LIBCMT ref: 2D36E809

__CxxThrowException@8.LIBCMT ref: 2D38986C

Strings

cabinstance\, xrefs: 2D38987F

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8Throw__strftime_l
String ID: cabinstance\
API String ID: 3492712547-1471073468
Opcode ID: fdeeb46806db4a7c5373056d05bab01a692d1c26ad556711a1b6739dfdace575
Instruction ID: bfe352ab3c3be56362a7b007c5b18f41885f6bb81837e076cf93b710b330ed34
Opcode Fuzzy Hash: fdeeb46806db4a7c5373056d05bab01a692d1c26ad556711a1b6739dfdace575
Instruction Fuzzy Hash: FF218071A09219AEDB01CFA5CC859EEBBBDEF1A304F400069EA02FB257D635D904C7B1

Function 2D386655 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,?), ref: 2D3866AF
__CxxThrowException@8.LIBCMT ref: 2D3866D2

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CharException@8NextThrow
String ID:
API String ID: 455092827-0
Opcode ID: 06b93b7398fd8a3bc32e40db27029c07993c3fcf398b00c38259bdf5bbf18bac
Instruction ID: f2bb26399ab0b997f2f024af1e1a793306956a4f321a591e59dd271b1d3dd4e7
Opcode Fuzzy Hash: 06b93b7398fd8a3bc32e40db27029c07993c3fcf398b00c38259bdf5bbf18bac
Instruction Fuzzy Hash: 6611C8B54047C5AEC721CF38D490AAABBE8EF4A210F14842ADD96E7246D774D640CB60

Function 2D3884F9 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000000), ref: 2D38852E
ReadFile.KERNELBASE(00000000,?,?,00000000,00000000), ref: 2D388546

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 1534725c37feb32b0fbbcb525f327f8b377cf44ff2c6903f79d8d5862e4bbe32
Instruction ID: a0c343dbaf1ea54a653a37c01a1fa1f44734565188a3ae779734109597a363de
Opcode Fuzzy Hash: 1534725c37feb32b0fbbcb525f327f8b377cf44ff2c6903f79d8d5862e4bbe32
Instruction Fuzzy Hash: E4018432610704AFDB10CA28DC01F5AB7FDAB84764F204A29F526E2591E770EE04DB54

Function 2D37B535 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 2D37B563
__CxxThrowException@8.LIBCMT ref: 2D37B571

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8Throwstd::bad_exception::bad_exception
String ID:
API String ID: 953301-0
Opcode ID: f3fc899cb5e7ae2aea061c4feab9c2e4535a081c8b04b5fdbf9e02b49c7a155e
Instruction ID: 07175ec2685af48e25d91de2202be3343e0f7179ccc5d662a54c73fc12ded90a
Opcode Fuzzy Hash: f3fc899cb5e7ae2aea061c4feab9c2e4535a081c8b04b5fdbf9e02b49c7a155e
Instruction Fuzzy Hash: D6E02672A1020429D70CE278C856EAE77BA9B20620F10C62EDA23F10C1EE74E2048294

Function 2D36D02A Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 2D36D058
__CxxThrowException@8.LIBCMT ref: 2D36D066

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8Throwstd::bad_exception::bad_exception
String ID:
API String ID: 953301-0
Opcode ID: 559408b4da7d03279e3a6a0515bb9183fd49a4f0dfbc30d749324c6d765d93a5
Instruction ID: b50bc744e53efbe102c18193803cce885dd1ca8f313d23be73747d237d145fd9
Opcode Fuzzy Hash: 559408b4da7d03279e3a6a0515bb9183fd49a4f0dfbc30d749324c6d765d93a5
Instruction Fuzzy Hash: E1E02032D1020415C70CD674D445E9E33A9AB50610F10862ED532F10C5EF70D209C1E4

Function 2D3906D8 Relevance: 3.0, APIs: 2, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2D3906E4

Part of subcall function 2D392592: __getptd_noexit.LIBCMT ref: 2D392595
Part of subcall function 2D392592: __amsg_exit.LIBCMT ref: 2D3925A2

Part of subcall function 2D39069B: __IsNonwritableInCurrentImage.LIBCMT ref: 2D3906AE
Part of subcall function 2D39069B: __getptd_noexit.LIBCMT ref: 2D3906BE
Part of subcall function 2D39069B: __freeptd.LIBCMT ref: 2D3906C8
Part of subcall function 2D39069B: ExitThread.KERNEL32 ref: 2D3906D1

__XcptFilter.LIBCMT ref: 2D390705

Part of subcall function 2D3919BF: __getptd_noexit.LIBCMT ref: 2D3919C7

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: __getptd_noexit$CurrentExitFilterImageNonwritableThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 393088965-0
Opcode ID: 05cf2879c8f36310f18ed76e431aacc8fbdf0f7ba363ecedac43c6b11077c738
Instruction ID: f6c8314ef17c7b744d486735d47b2230b83a8cfe8181363a16faa8bf11b0d52d
Opcode Fuzzy Hash: 05cf2879c8f36310f18ed76e431aacc8fbdf0f7ba363ecedac43c6b11077c738
Instruction Fuzzy Hash: 0DE0ECB5944A049FE718ABA0C949EAE7765EF64216F218088E202BB2A1CB359D40DB20

Function 2D37A321 Relevance: 3.0, APIs: 2, Instructions: 12windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EA), ref: 2D37A32B
PostMessageA.USER32(00000000,00000402,00000000,00000000), ref: 2D37A33C

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ItemMessagePost
String ID:
API String ID: 1313159582-0
Opcode ID: 0c0df5a0c746531c0749eba097a7817e77b20ff178d921de2aa8efab4168b07c
Instruction ID: af2ab8d78ee5b293ccce800d0d00feb71ff106ea8d12fda41d98d6d6e6bc4a35
Opcode Fuzzy Hash: 0c0df5a0c746531c0749eba097a7817e77b20ff178d921de2aa8efab4168b07c
Instruction Fuzzy Hash: 43C01272280208BBDA026BA4CC1EF493A2EBB14B06F008010B301681E0C6B669209A9A

Function 2D37A346 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,?,2D372F9E), ref: 2D37A34D
UpdateWindow.USER32(?), ref: 2D37A355

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Window$ShowUpdate
String ID:
API String ID: 2310006639-0
Opcode ID: 32a273827ff65ebee6baed6a4ab06fb16a9a94062b50bef7d2b58cc4c9e46887
Instruction ID: 49bb4882e647b726b4873a751ec03298ada03ccd0034148dca3299fd3e3b7418
Opcode Fuzzy Hash: 32a273827ff65ebee6baed6a4ab06fb16a9a94062b50bef7d2b58cc4c9e46887
Instruction Fuzzy Hash: 8BC04C35100020FFEA225F14EC1DAC5BA7AEF04751B120455B1815116496B60C549B94

Function 2D390DAB Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 2D390DB3

Part of subcall function 2D390D80: GetModuleHandleW.KERNEL32(mscoree.dll,?,2D390DB8,?,?,2D3910E7,000000FF,0000001E,?,2D395247,?,00000001,?,?,2D393448,00000018), ref: 2D390D8A
Part of subcall function 2D390D80: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 2D390D9A

ExitProcess.KERNEL32 ref: 2D390DBC

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 8577403666ede84add5c33028a6a72306d61b5438bf6e22ef44d44cd8cd7be5b
Instruction ID: cf4cf403a793273b5d61d29049e0f5ccff176ba6cfd6092332cf139d855e5fb5
Opcode Fuzzy Hash: 8577403666ede84add5c33028a6a72306d61b5438bf6e22ef44d44cd8cd7be5b
Instruction Fuzzy Hash: D3B09231004148BBCB022F52CC0988D3F2AEB80AA1F218020F90809130DF72AD92EAD8

Function 2D36D65E Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2D36D665

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: bf3cbf17043fcccb61e9991cb1f18e86d1acbbebae54799e683722e9ed0670f5
Instruction ID: 7174cc22ddb9cceb9cc42ef997871a59d9c11d6d0615c00ad93cacf648f92084
Opcode Fuzzy Hash: bf3cbf17043fcccb61e9991cb1f18e86d1acbbebae54799e683722e9ed0670f5
Instruction Fuzzy Hash: DB11E271A00105EBDB04CF56D880B6DB3A6FB94300F60C116E719BB1C4CB71EA50CBE4

Function 2D36D94A Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 2D36D95C

Part of subcall function 2D39E53A: __EH_prolog3.LIBCMT ref: 2D39E541
Part of subcall function 2D39E53A: std::bad_exception::bad_exception.LIBCMT ref: 2D39E55E
Part of subcall function 2D39E53A: __CxxThrowException@8.LIBCMT ref: 2D39E56C
Part of subcall function 2D39E53A: __EH_prolog3.LIBCMT ref: 2D39E579
Part of subcall function 2D39E53A: std::bad_exception::bad_exception.LIBCMT ref: 2D39E596
Part of subcall function 2D39E53A: __CxxThrowException@8.LIBCMT ref: 2D39E5A4
Part of subcall function 2D39E53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?), ref: 2D39E623

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8H_prolog3Throwstd::bad_exception::bad_exception$ExceptionRaiseString_base::_Xlenstd::_
String ID:
API String ID: 2643941598-0
Opcode ID: 9aa9379ee6d03de0388cc4f685cf3521d9f9eaf8e40ef1c4c90425cf1a350527
Instruction ID: 46e1db2d6e81b72d16fa69efccaffe172c967dda2ce44927680b28fac733191a
Opcode Fuzzy Hash: 9aa9379ee6d03de0388cc4f685cf3521d9f9eaf8e40ef1c4c90425cf1a350527
Instruction Fuzzy Hash: 7CF02B3170811056C7225D3BF800B2EA6DACBD1964F15851AE547F718DDD71D68082FA

Function 2D3893F4 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2D3893FB

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: eeeb9618f22f07f42da709f129ba7c4b6a8f32a4ab7cd908856ddac9dcaf3f42
Instruction ID: 5f1282e911147c464e482a4a36bec4c33f17bbe8d79812ec16d33329438cc873
Opcode Fuzzy Hash: eeeb9618f22f07f42da709f129ba7c4b6a8f32a4ab7cd908856ddac9dcaf3f42
Instruction Fuzzy Hash: 5AF08C76905215ABCB46CF68C804A5E7BA5FB04BA4F11C316E634FB2D1C7708A008BA5

Function 2D36D44F Relevance: 1.5, APIs: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

char_traits.LIBCPMT ref: 2D36D474

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: 64b5e76114a4de8b38d16f184df7f2683c58bf65642a74f44cf39c2b673d6b96
Instruction ID: 5a9c3781b3de4652737c8be67bf5c7dd67f4fb470cd6429e055a6b76ebd599e5
Opcode Fuzzy Hash: 64b5e76114a4de8b38d16f184df7f2683c58bf65642a74f44cf39c2b673d6b96
Instruction Fuzzy Hash: B0F05532004204AADB305F8AD804B5ABBECEF65310F00C02EF68866152CA70F558C7F4

Function 2D37BDEF Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2D37BDF6

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 113112561ec0f0ea7570c31252b116a891adf9d5f38c982fd3d22190240d213a
Instruction ID: 95b8dcc9c9f78f5523ae135f31a3d15cc0ca601e5ed03fcb345fcffed7d56223
Opcode Fuzzy Hash: 113112561ec0f0ea7570c31252b116a891adf9d5f38c982fd3d22190240d213a
Instruction Fuzzy Hash: 16E06D36905618ABEF018F94C901BDE3F71EF28B54F018005FB00BA2D0C3B68E60A7E2

Function 2D3928D6 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 2D3928EB

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: e3ace702fe54e0c77e4db638721a618b450f28d679c044d32056262b79d4dd1b
Instruction ID: 685258ad756d200d66f05957eabdee37544712d632cabfc200d1af9b386a1c5b
Opcode Fuzzy Hash: e3ace702fe54e0c77e4db638721a618b450f28d679c044d32056262b79d4dd1b
Instruction Fuzzy Hash: 12D05E76A543057FD7029E76EC097663BECA784B95F008435F80CC6240FA78C640DA48

Function 2D38847B Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,?,?,00000000,00000000), ref: 2D388492

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: da4320dcef766df28b63d533c794c9dda68e892b7c7ee5396e72c4d3550aa243
Instruction ID: 26acfb0f55b43f7630d5e947b89681b25f6f5ab33a0e3ebc6f0e0745490e9502
Opcode Fuzzy Hash: da4320dcef766df28b63d533c794c9dda68e892b7c7ee5396e72c4d3550aa243
Instruction Fuzzy Hash: 85E08C32510108FBDB01CBA0DD02FCD7B7CBB04368F208114B511EA091C375DA109B54

Function 2D381158 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 2D381162

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: H_prolog3_catch_
String ID:
API String ID: 1329019490-0
Opcode ID: 097ba1b738138fcaa1287d32cc9196a17925e1a49824dc45df17fa4483296a62
Instruction ID: 650fac9be684d6f40e454bebff44a47690005cf282475bbd7754b87b8f01c66d
Opcode Fuzzy Hash: 097ba1b738138fcaa1287d32cc9196a17925e1a49824dc45df17fa4483296a62
Instruction Fuzzy Hash: FCD05E74904204CBE7048B50C844F48B770FF14300F20C18CE208EB291CB325D84CF06

Function 2D390FC7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 2D390FD3

Part of subcall function 2D390E9B: __lock.LIBCMT ref: 2D390EA9
Part of subcall function 2D390E9B: __decode_pointer.LIBCMT ref: 2D390EE0
Part of subcall function 2D390E9B: __decode_pointer.LIBCMT ref: 2D390EF5
Part of subcall function 2D390E9B: __decode_pointer.LIBCMT ref: 2D390F1F
Part of subcall function 2D390E9B: __decode_pointer.LIBCMT ref: 2D390F35
Part of subcall function 2D390E9B: __decode_pointer.LIBCMT ref: 2D390F42
Part of subcall function 2D390E9B: __initterm.LIBCMT ref: 2D390F71
Part of subcall function 2D390E9B: __initterm.LIBCMT ref: 2D390F81

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: acadcc02bfd9079f89b0c25eae59b9327680af0b1a3ec0deb8ccac89bf6db98b
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: ABB0923298420833DA201542EC02F963B0A87D0AA0E294020BA5C2D1A0A9B2A9618089

Function 2D37A30F Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

PostMessageA.USER32(?,00008001,00000000,00000000), ref: 2D37A31A

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0622457f2d9b24fde4042635299b9affe1b0582e29c9c09fe81b9e940c58d149
Instruction ID: 3cff973e474086c7ec3a940c9990c1478ad04f592b59f4bd33f6f875bb03bdf5
Opcode Fuzzy Hash: 0622457f2d9b24fde4042635299b9affe1b0582e29c9c09fe81b9e940c58d149
Instruction Fuzzy Hash: 8CB00170790610BAEEA29B25CE5AF043A67BB42F09F204094B3456C5E08AA629589A4A

Non-executed Functions

Function 2D388222 Relevance: 49.1, APIs: 14, Strings: 14, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,?,2D3883AE), ref: 2D38822F
GetProcAddress.KERNEL32(00000000,MessageBoxW), ref: 2D38824B
GetProcAddress.KERNEL32(00000000,SetWindowTextW), ref: 2D388260
GetProcAddress.KERNEL32(00000000,DialogBoxParamW), ref: 2D388275
GetProcAddress.KERNEL32(00000000,CreateDialogParamW), ref: 2D38828A
LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,2D3883AE), ref: 2D38829E
GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 2D3882B0
GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 2D3882C1
GetProcAddress.KERNEL32(00000000,GetModuleFileNameW), ref: 2D3882D2
GetProcAddress.KERNEL32(00000000,GetCurrentDirectoryW), ref: 2D3882E3
GetProcAddress.KERNEL32(00000000,SetCurrentDirectoryW), ref: 2D3882F4
GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 2D388305
GetProcAddress.KERNEL32(00000000,GetTempPathW), ref: 2D388316
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExW), ref: 2D388327

Strings

MoveFileExW, xrefs: 2D3882AA
MessageBoxW, xrefs: 2D388245
CreateDialogParamW, xrefs: 2D388284
GetCurrentDirectoryW, xrefs: 2D3882DD
kernel32.dll, xrefs: 2D388299
SetCurrentDirectoryW, xrefs: 2D3882EE
SetWindowTextW, xrefs: 2D38825A
user32.dll, xrefs: 2D38822A
CreateProcessW, xrefs: 2D3882FF
GetModuleFileNameW, xrefs: 2D3882CC
GetTempPathW, xrefs: 2D388310
DialogBoxParamW, xrefs: 2D38826F
GetDiskFreeSpaceExW, xrefs: 2D388321
CreateFileW, xrefs: 2D3882BB

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateDialogParamW$CreateFileW$CreateProcessW$DialogBoxParamW$GetCurrentDirectoryW$GetDiskFreeSpaceExW$GetModuleFileNameW$GetTempPathW$MessageBoxW$MoveFileExW$SetCurrentDirectoryW$SetWindowTextW$kernel32.dll$user32.dll
API String ID: 2238633743-1099696723
Opcode ID: 3682c8cf80455df4805748a923f3804938d241ef3ef5ba9ade2bb506f68aee6f
Instruction ID: 74c6ce79a3850d6c8e95d9b5075920b1c8d74a8506f8657f2f30c1bb89c19f9c
Opcode Fuzzy Hash: 3682c8cf80455df4805748a923f3804938d241ef3ef5ba9ade2bb506f68aee6f
Instruction Fuzzy Hash: 65316674A4061679C7179F39ECE1AB62BFDEA95B81384402AD500F2347DF69C4019BB9

Function 2D3970F3 Relevance: 7.6, APIs: 5, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

__NMSG_WRITE.LIBCMT ref: 2D397114

Part of subcall function 2D3917DA: __set_error_mode.LIBCMT ref: 2D39180B
Part of subcall function 2D3917DA: __set_error_mode.LIBCMT ref: 2D39181C
Part of subcall function 2D3917DA: _strcpy_s.LIBCMT ref: 2D391850
Part of subcall function 2D3917DA: __invoke_watson.LIBCMT ref: 2D391861
Part of subcall function 2D3917DA: GetModuleFileNameA.KERNEL32(00000000,2D3AABB1,00000104), ref: 2D39187D
Part of subcall function 2D3917DA: _strcpy_s.LIBCMT ref: 2D391892
Part of subcall function 2D3917DA: __invoke_watson.LIBCMT ref: 2D3918A5
Part of subcall function 2D3917DA: __invoke_watson.LIBCMT ref: 2D3918E8

_raise.LIBCMT ref: 2D397125
_memset.LIBCMT ref: 2D3971B7
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,1FFFFFFF), ref: 2D3971E9
UnhandledExceptionFilter.KERNEL32(?,?,?,1FFFFFFF), ref: 2D3971F6

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: __invoke_watson$ExceptionFilterUnhandled__set_error_mode_strcpy_s$FileModuleName_memset_raise
String ID:
API String ID: 3251567315-0
Opcode ID: 9bed5a0933111ec7d1e7f3e031411fdfee399cf753959c0fa724f245972dfa2f
Instruction ID: c1f14a51c2bb43ec2cd887bd41b147b7a89ce52c45797fad2d372c7d33a562f8
Opcode Fuzzy Hash: 9bed5a0933111ec7d1e7f3e031411fdfee399cf753959c0fa724f245972dfa2f
Instruction Fuzzy Hash: 1131F57591132DABDB21DF65C8997C9BBB8AF58710F1040DAA50CBB250DB789BC0CF98

Function 2D38F7A3 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 2D3951EB
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 2D395200
UnhandledExceptionFilter.KERNEL32(2D36A230), ref: 2D39520B
GetCurrentProcess.KERNEL32(C0000409), ref: 2D395227
TerminateProcess.KERNEL32(00000000), ref: 2D39522E

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 10d46071afcc656e4f0431eca1e0d379ddd6c22d329c59ef2e9a7ea2a6f4b50c
Instruction ID: 71852bac9afbbec80cb56ebe90cf55ac96f8fc140731fc89c3bee09e6f57b27b
Opcode Fuzzy Hash: 10d46071afcc656e4f0431eca1e0d379ddd6c22d329c59ef2e9a7ea2a6f4b50c
Instruction Fuzzy Hash: 0621CEB8A01208BBD702CF69D0A47D83BBEFB58B90F50411AE56896750E7789981CF6D

Function 2D38EBE3 Relevance: 2.5, APIs: 2, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 2D38EC06
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 2D38EC17

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: d076e5cdecff3c4806461916a01076326d516c08c123bc103340dd6b15194c6b
Instruction ID: 85e668162a96d8ed435861192bd3f3b015a92a56614719ca6a82ef5c0667548f
Opcode Fuzzy Hash: d076e5cdecff3c4806461916a01076326d516c08c123bc103340dd6b15194c6b
Instruction Fuzzy Hash: 37F08275A003006FDB119B61C80AF63BBED9F45751F018428F659E7242CB76E840CBA5

Function 2D387E35 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 2D387E59

Part of subcall function 2D38F117: __lock.LIBCMT ref: 2D38F135
Part of subcall function 2D38F117: ___sbh_find_block.LIBCMT ref: 2D38F140
Part of subcall function 2D38F117: ___sbh_free_block.LIBCMT ref: 2D38F14F
Part of subcall function 2D38F117: RtlFreeHeap.NTDLL(00000000,?,2D3A6180,0000000C,2D392583,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C), ref: 2D38F17F
Part of subcall function 2D38F117: GetLastError.KERNEL32(?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D), ref: 2D38F190

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Free$DiskErrorHeapLastSpace___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1140605925-0
Opcode ID: d297bcc39455f48cb78fb1e1849f257aff95ed5c85e583408dadec6d2bc30ada
Instruction ID: 8d3a64d0e5535a219f4cf467cee4ab3da9dd39b6b92191f8d517655dbc88dfda
Opcode Fuzzy Hash: d297bcc39455f48cb78fb1e1849f257aff95ed5c85e583408dadec6d2bc30ada
Instruction Fuzzy Hash: AEE06D3280011AABCF119F64EC41ADA7B79FB14245F008061FA45E21A0DB309D60DB90

Function 2D3812BA Relevance: 42.5, APIs: 1, Strings: 23, Instructions: 470COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 2D38179B

Strings

SYS.ARGS.LANGVALUEREADONLY, xrefs: 2D381719
SYS.ARGS.HELPREADONLY, xrefs: 2D38174C
SYS.ARGS.EXTRACTREADONLY, xrefs: 2D381674
SYS.ARGS.NORESTART, xrefs: 2D3813A9
SYS.ARGS.LANG, xrefs: 2D381485
SYS.ARGS.EXTRACTPATHREADONLY, xrefs: 2D3816AB
SYS.ARGS.FORCERESTART, xrefs: 2D3813E0
SYS.ARGS.QUIETREADONLY, xrefs: 2D38152A
SYS.ARGS.EXTRACT, xrefs: 2D381417
SYS.ARGS.PASSIVE, xrefs: 2D381372
SYS.ARGS.LOGPATHREADONLY, xrefs: 2D381598
SYS.ARGS.EXTRACTPATH, xrefs: 2D38144E
SYS.ARGS.HELP, xrefs: 2D3814F3
SYS.ARGS.LANGVALUE, xrefs: 2D3814BC
SYS.ARGS.LOGREADONLY, xrefs: 2D381561
SYS.ARGS.LANGREADONLY, xrefs: 2D3816E2
SYS.ARGS.LOG, xrefs: 2D381304
SYS.ARGS.LOGPATH, xrefs: 2D38133B
CSession::setArgumentValue, xrefs: 2D38177F
SYS.ARGS.NORESTARTREADONLY, xrefs: 2D381606
SYS.ARGS.PASSIVEREADONLY, xrefs: 2D3815CF
SYS.ARGS.QUIET, xrefs: 2D3812C9
SYS.ARGS.FORCERESTARTREADONLY, xrefs: 2D38163D

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8Throw
String ID: CSession::setArgumentValue$SYS.ARGS.EXTRACT$SYS.ARGS.EXTRACTPATH$SYS.ARGS.EXTRACTPATHREADONLY$SYS.ARGS.EXTRACTREADONLY$SYS.ARGS.FORCERESTART$SYS.ARGS.FORCERESTARTREADONLY$SYS.ARGS.HELP$SYS.ARGS.HELPREADONLY$SYS.ARGS.LANG$SYS.ARGS.LANGREADONLY$SYS.ARGS.LANGVALUE$SYS.ARGS.LANGVALUEREADONLY$SYS.ARGS.LOG$SYS.ARGS.LOGPATH$SYS.ARGS.LOGPATHREADONLY$SYS.ARGS.LOGREADONLY$SYS.ARGS.NORESTART$SYS.ARGS.NORESTARTREADONLY$SYS.ARGS.PASSIVE$SYS.ARGS.PASSIVEREADONLY$SYS.ARGS.QUIET$SYS.ARGS.QUIETREADONLY
API String ID: 2005118841-1953358270
Opcode ID: 621b4a1eb589686dd9eb6478aa61653259f8eef033eea72139a9cc49d6b066f4
Instruction ID: dd8273bff6bddd51f21b8f5421cf8c228cccba2328d573cc74ba66cf4aab365e
Opcode Fuzzy Hash: 621b4a1eb589686dd9eb6478aa61653259f8eef033eea72139a9cc49d6b066f4
Instruction Fuzzy Hash: DAE1134F7221024BC7250F39CC469E2A6767FA1EE07D98AA8D545FB64BF731CE458360

Function 2D37B1EF Relevance: 27.2, APIs: 18, Instructions: 154windowCOMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,00000008,?), ref: 2D37B20F
GetDlgItem.USER32(?,000003EC), ref: 2D37B221
GetDlgItem.USER32(?,000003E8), ref: 2D37B22C
GetDlgItem.USER32(?,000003E9), ref: 2D37B237
GetDlgItem.USER32(?,000003EA), ref: 2D37B242
SetWindowTextW.USER32(00000110,?), ref: 2D37B25B
SetWindowTextW.USER32(?,?), ref: 2D37B272
SetWindowTextW.USER32(?,?), ref: 2D37B28F
SetWindowTextW.USER32(?,?), ref: 2D37B2A6
SetWindowTextW.USER32(?,?), ref: 2D37B2BB
SendMessageA.USER32(?,00000030,0E0A0D77,00000001), ref: 2D37B2DB
SendMessageA.USER32(00000110,00000030,0E0A0D77,00000001), ref: 2D37B2E4
SendMessageA.USER32(?,00000030,0E0A0D77,00000001), ref: 2D37B2ED
SendMessageA.USER32(?,00000030,0E0A0D77,00000001), ref: 2D37B2F6
SendMessageA.USER32(?,00000030,0E0A0D77,00000001), ref: 2D37B2FF
GetWindowLongA.USER32(?,00000008), ref: 2D37B30A
GetDlgItem.USER32(?,000003EC), ref: 2D37B33C
EnableWindow.USER32(00000000,00000000), ref: 2D37B358

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Window$ItemMessageSendText$Long$Enable
String ID:
API String ID: 2063855303-0
Opcode ID: 17ab98a9f0e1dd86f271927249234ec4c8e3649aee6a9ee6fef4ae66c15a503c
Instruction ID: e98dc827a3f17f44d045b1eac918748ddf7c1004a9f17922b0ea3ef3fdb4a6f6
Opcode Fuzzy Hash: 17ab98a9f0e1dd86f271927249234ec4c8e3649aee6a9ee6fef4ae66c15a503c
Instruction Fuzzy Hash: 06414B31640A58BBEB129F21CC89EAF7BBEFF45B95F004415F606A6190D779A940CB60

Function 2D37E3B1 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Part of subcall function 2D380323: __EH_prolog3.LIBCMT ref: 2D38032A

__CxxThrowException@8.LIBCMT ref: 2D37E405

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

MainPleaReg, xrefs: 2D37E465
OPatchInstall: CActionReportError::initFromElement starts, xrefs: 2D37E3BF
UiLcid, xrefs: 2D37E3DE
DetailsPreBody, xrefs: 2D37E4B9
OPatchInstall: CActionReportError::initFromElement ends, xrefs: 2D37E50E
MainNoReportBtn, xrefs: 2D37E49D
GeneralReportee, xrefs: 2D37E4D5
MainReportBtn, xrefs: 2D37E481
GeneralAppName, xrefs: 2D37E44D
MainIntroReg, xrefs: 2D37E438
MainCaption, xrefs: 2D37E40E
MainIntroBold, xrefs: 2D37E423
FilesToSend, xrefs: 2D37E4F1

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8FileH_prolog3ThrowUserWrite
String ID: DetailsPreBody$FilesToSend$GeneralAppName$GeneralReportee$MainCaption$MainIntroBold$MainIntroReg$MainNoReportBtn$MainPleaReg$MainReportBtn$OPatchInstall: CActionReportError::initFromElement ends$OPatchInstall: CActionReportError::initFromElement starts$UiLcid
API String ID: 74031213-3528283118
Opcode ID: 135f94ba1adbd9b0dca5acd91136128b0279768bd109619079e9802c48aa0333
Instruction ID: 2d808e83273f65b98e636b624864cb17d46f2c5893d6d9dcdd9da0a83b97c687
Opcode Fuzzy Hash: 135f94ba1adbd9b0dca5acd91136128b0279768bd109619079e9802c48aa0333
Instruction Fuzzy Hash: F631C661204A417BEA25DA60CCD1DFE63DDEB64084FC58058FAC6F715BDB74AA0683B8

Function 2D392432 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,2D3A62A0,0000000C,2D39256D,00000000,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C), ref: 2D392444
__crt_waiting_on_module_handle.LIBCMT ref: 2D39244F

Part of subcall function 2D390D27: Sleep.KERNEL32(000003E8,?,?,2D392354,KERNEL32.DLL,?,2D3923C0,?,2D390724), ref: 2D390D33
Part of subcall function 2D390D27: GetModuleHandleW.KERNEL32(?,?,?,2D392354,KERNEL32.DLL,?,2D3923C0,?,2D390724), ref: 2D390D3C

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 2D392478
GetProcAddress.KERNEL32(?,DecodePointer), ref: 2D392488
__lock.LIBCMT ref: 2D3924AA
InterlockedIncrement.KERNEL32(2D3A9D98), ref: 2D3924B7
__lock.LIBCMT ref: 2D3924CB
___addlocaleref.LIBCMT ref: 2D3924E9

Strings

EncodePointer, xrefs: 2D39246C
DecodePointer, xrefs: 2D392480
KERNEL32.DLL, xrefs: 2D39243E, 2D392443, 2D39244E

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 0a2c8bb1ce8cdf3d4986d16617102ea125d6c6ca675310569bed6a988638bd6d
Instruction ID: 00bfd23a948f737fe5d3b16cca046ab8fbd70c0006a4f0d66943557c566ecef1
Opcode Fuzzy Hash: 0a2c8bb1ce8cdf3d4986d16617102ea125d6c6ca675310569bed6a988638bd6d
Instruction Fuzzy Hash: 3211DF74808B01AFD7218F35C840B9ABBF4FF10314F50C529E5A9B33A0CB349A40CB68

Function 2D387B60 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 127fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 2D387B8E
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 2D387C00
CloseHandle.KERNEL32(00000000), ref: 2D387C10
GetFullPathNameA.KERNEL32(?,00000104,?,00000000), ref: 2D387C34
GetFullPathNameA.KERNEL32(?,00000104,?,00000000), ref: 2D387C98

Part of subcall function 2D38F117: __lock.LIBCMT ref: 2D38F135
Part of subcall function 2D38F117: ___sbh_find_block.LIBCMT ref: 2D38F140
Part of subcall function 2D38F117: ___sbh_free_block.LIBCMT ref: 2D38F14F
Part of subcall function 2D38F117: RtlFreeHeap.NTDLL(00000000,?,2D3A6180,0000000C,2D392583,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C), ref: 2D38F17F
Part of subcall function 2D38F117: GetLastError.KERNEL32(?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D), ref: 2D38F190

WritePrivateProfileStringA.KERNEL32(rename,?,?,?), ref: 2D387CDE

Strings

rename, xrefs: 2D387CD9
\, xrefs: 2D387BAE
NUL, xrefs: 2D387C73
wininit.ini, xrefs: 2D387BD2

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: FullNamePath$CloseCreateDirectoryErrorFileFreeHandleHeapLastPrivateProfileStringWindowsWrite___sbh_find_block___sbh_free_block__lock
String ID: NUL$\$rename$wininit.ini
API String ID: 2841488213-281785890
Opcode ID: f77f7ddf924487ab23edeb51e52314bded13a94c35c15c0a53022ec1fe50b1ae
Instruction ID: 3cada10be5bb6e35f888bb74fea587270d61ede0fa47b53446cf0b1ece5d96cf
Opcode Fuzzy Hash: f77f7ddf924487ab23edeb51e52314bded13a94c35c15c0a53022ec1fe50b1ae
Instruction Fuzzy Hash: BC41A1B1904218BBDB21DB64CC85FEA77BDEF55710F1041A5E259F3191EAB09B84CF60

Function 2D379536 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 119COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 2D379540

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Part of subcall function 2D380323: __EH_prolog3.LIBCMT ref: 2D38032A

__CxxThrowException@8.LIBCMT ref: 2D379595

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

Path, xrefs: 2D379570
Access64Bit, xrefs: 2D3795B3
OPatchInstall: CActionRegistry::initFromElement starts, xrefs: 2D379550
OPatchInstall: Will access the 32 bit view of the registry, xrefs: 2D379684
OPatchInstall: Will access the 64 bit view of the registry, xrefs: 2D37967D
OPatchInstall: CActionRegistry::initFromElement ends, xrefs: 2D379696
OPatchInstall: Will process the path ', xrefs: 2D379610

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8FileH_prolog3H_prolog3_ThrowUserWrite
String ID: Access64Bit$OPatchInstall: CActionRegistry::initFromElement ends$OPatchInstall: CActionRegistry::initFromElement starts$OPatchInstall: Will access the 32 bit view of the registry$OPatchInstall: Will access the 64 bit view of the registry$OPatchInstall: Will process the path '$Path
API String ID: 1431807431-566466653
Opcode ID: a5df6bd4623961213deb101d8fd9b307c5afc6a135cd5fca6e62ab1024e46b3c
Instruction ID: 9e54f210cd7760c0f928f0b83e3fc4e389b3ecbd12be1a3f6910fd5250ee5c56
Opcode Fuzzy Hash: a5df6bd4623961213deb101d8fd9b307c5afc6a135cd5fca6e62ab1024e46b3c
Instruction Fuzzy Hash: 32412332A04604AADB11DB60CC80BFCB376FF79714F46C259D605B7296CB34AA81C7B6

Function 2D373392 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Part of subcall function 2D3804F3: __EH_prolog3_GS.LIBCMT ref: 2D3804FD

__CxxThrowException@8.LIBCMT ref: 2D3733E5

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

ComponentId, xrefs: 2D3733BC
KeyPath, xrefs: 2D37348D
OPatchInstall: CActionMsiGetComponentProperties::initFromElement starts, xrefs: 2D3733A0
OPatchInstall: CActionMsiGetComponentProperties::initFromElement ends, xrefs: 2D37349C
OPatchInstall: Will check for the ComponentId ', xrefs: 2D3733EA
for product ', xrefs: 2D37342F
ProductCode, xrefs: 2D37341C
Exists, xrefs: 2D37347A

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8FileH_prolog3_ThrowUserWrite
String ID: ComponentId$Exists$KeyPath$OPatchInstall: CActionMsiGetComponentProperties::initFromElement ends$OPatchInstall: CActionMsiGetComponentProperties::initFromElement starts$OPatchInstall: Will check for the ComponentId '$ProductCode$for product '
API String ID: 3074503020-716134250
Opcode ID: d7cb55db6adf9dfed7ffb152f3259afccb49302aa159f9edf28b67a6e3218962
Instruction ID: 2008b1e3f0e52e1ba2ae8619fe17eb94fbbfad0e1e063e31406db087d37b10c1
Opcode Fuzzy Hash: d7cb55db6adf9dfed7ffb152f3259afccb49302aa159f9edf28b67a6e3218962
Instruction Fuzzy Hash: 2A21D872348604775E2ADB10CCD0CFD661AEFF5548B4AC024EA52B725BCF34AE4586F9

Function 2D389B16 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 2D389B3A
LoadLibraryA.KERNEL32(?,2D3612A4,2D361344,?,OPatchInstlal: Loading OGA dll from '), ref: 2D389B76
GetLastError.KERNEL32 ref: 2D389B85
GetProcAddress.KERNEL32(00000000,LegitCheck), ref: 2D389BAF
GetLastError.KERNEL32 ref: 2D389BBA
GetProcAddress.KERNEL32(SetPartnerID), ref: 2D389BE7

Strings

LegitCheck, xrefs: 2D389BA9
SetPartnerID, xrefs: 2D389BDC
OPatchInstlal: Loading OGA dll from ', xrefs: 2D389B45

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: AddressErrorLastProc$Exception@8LibraryLoadThrow
String ID: LegitCheck$OPatchInstlal: Loading OGA dll from '$SetPartnerID
API String ID: 1197632057-2232419435
Opcode ID: 321b6855017cca622e059680b965bc8b8c40f4a0c12cfa88b5b7fa5c253314e1
Instruction ID: 646efa078c43c1e4cc1b91dd527a229c8e423d469a93cbdabcfbcd459293cbdb
Opcode Fuzzy Hash: 321b6855017cca622e059680b965bc8b8c40f4a0c12cfa88b5b7fa5c253314e1
Instruction Fuzzy Hash: D3216275A04105BBCB02DFA0CC849ED3BB9EB64741F018066EA01F7256EBB4DA40DBF9

Function 2D3861D4 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

__CxxThrowException@8.LIBCMT ref: 2D38620C

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

__CxxThrowException@8.LIBCMT ref: 2D386253

Strings

OPatchInstall: CMSIProductVersion::getKeyPath() called, xrefs: 2D3861DE
OPatchInstall: Product ', xrefs: 2D38625D
not installed, xrefs: 2D386287, 2D38628C
' is , xrefs: 2D386271
installed, xrefs: 2D38627D
VersionMajor, xrefs: 2D386221

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8Throw$DispatcherExceptionFileUserWrite
String ID: ' is $OPatchInstall: CMSIProductVersion::getKeyPath() called$OPatchInstall: Product '$VersionMajor$installed$not installed
API String ID: 3782066653-2208943399
Opcode ID: 982c7d51477d1c51c4aea6ad314aa837387514ec29931a7f32028362f8c534c8
Instruction ID: ca1f3e3e8c3a49960be25f80871f315f6d2c2b250d66cddefd8f1e2788154960
Opcode Fuzzy Hash: 982c7d51477d1c51c4aea6ad314aa837387514ec29931a7f32028362f8c534c8
Instruction Fuzzy Hash: 3C110536B046547ACA21D7A4CC80AFE726EDFF4504F1AC095E202F724ADA74AF0183F9

Function 2D3734B7 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Part of subcall function 2D3804F3: __EH_prolog3_GS.LIBCMT ref: 2D3804FD

__CxxThrowException@8.LIBCMT ref: 2D37350B

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

ProductName, xrefs: 2D373570
OPatchInstall: CActionMsiGetProductProperties::initFromElement starts, xrefs: 2D3734C5
OPatchInstall: CActionMsiGetProductProperties::initFromElement ends, xrefs: 2D37357F
ProductCode, xrefs: 2D3734E2
OPatchInstall: Will check for the Product Code ', xrefs: 2D373510
Version, xrefs: 2D37355D
Exists, xrefs: 2D37354A

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8FileH_prolog3_ThrowUserWrite
String ID: Exists$OPatchInstall: CActionMsiGetProductProperties::initFromElement ends$OPatchInstall: CActionMsiGetProductProperties::initFromElement starts$OPatchInstall: Will check for the Product Code '$ProductCode$ProductName$Version
API String ID: 3074503020-2798100323
Opcode ID: 64ba42268e9f2b354d2f247859d625175856bc5c89ae551dfe7576e4aa3e1557
Instruction ID: c4f71aecdf91fd9f2d5ba51b8df830922b6ed5dffd5cc76b618e809040eac7b5
Opcode Fuzzy Hash: 64ba42268e9f2b354d2f247859d625175856bc5c89ae551dfe7576e4aa3e1557
Instruction Fuzzy Hash: 8721AE322485047B4A16EB10CC90CFE775AFBA5214B4AC025EA56F7256CF34AA4287E9

Function 2D37FB55 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 2D37FB5C

Part of subcall function 2D37FAE1: __EH_prolog3_GS.LIBCMT ref: 2D37FAE8
Part of subcall function 2D37FAE1: _wcsrchr.LIBCMT ref: 2D37FB0E

Strings

SYS.PATCH, xrefs: 2D37FBE3
SYS.WIN, xrefs: 2D37FB93
SYS.MSI, xrefs: 2D37FBF7
SYS.ARGS, xrefs: 2D37FBCF
SYS.LANG, xrefs: 2D37FB7F
SYS.PROC, xrefs: 2D37FBA7
SYS.ERROR, xrefs: 2D37FBBB

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: H_prolog3_$_wcsrchr
String ID: SYS.ARGS$SYS.ERROR$SYS.LANG$SYS.MSI$SYS.PATCH$SYS.PROC$SYS.WIN
API String ID: 780983759-822222514
Opcode ID: 9308246278200e73b91d5b311333ef9ea4b6cfacef8e86861220956c7e065577
Instruction ID: f7d081213616432c060ced7d35444e9e45dae3059755cd15c3da80855866cb2d
Opcode Fuzzy Hash: 9308246278200e73b91d5b311333ef9ea4b6cfacef8e86861220956c7e065577
Instruction Fuzzy Hash: 15216FBAC08A4A56EF54D7A8D841FED6378FB152A0F50C456EB40F70C6DA39D04586B8

Function 2D385F39 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70fileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000103,?,2D361670,2D3A94F0,00000004), ref: 2D385F66
GetLastError.KERNEL32 ref: 2D385F70
__CxxThrowException@8.LIBCMT ref: 2D385F96

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

CreateFileA.KERNEL32(2D3A94F0,80000000,00000000,00000000,00000001,00000000,00000000), ref: 2D385FCD
GetLastError.KERNEL32(?,?,?,?,2D3A1F6C), ref: 2D385FD8

Strings

OPatchInstall: Could not create a path for the temp file, xrefs: 2D385FE5
%sopatchinstall(%i).log, xrefs: 2D385FAE

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ErrorFileLast$CreateDispatcherExceptionException@8PathTempThrowUserWrite
String ID: %sopatchinstall(%i).log$OPatchInstall: Could not create a path for the temp file
API String ID: 244066722-719883549
Opcode ID: 47dc587eca060ab023694eca46ddb68c4ad171f08eae060e44f308ddfb5814ec
Instruction ID: 149dec6498bfb1f2ddbc81cf419cb66835bb67fdb614d35ebcf981d365a50849
Opcode Fuzzy Hash: 47dc587eca060ab023694eca46ddb68c4ad171f08eae060e44f308ddfb5814ec
Instruction Fuzzy Hash: 6711AF76D04108ABDB219B64CC84FFE77BDEB25754F0041A5F645F2282DB749E808FA9

Function 2D3982E8 Relevance: 13.6, APIs: 9, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2D3982F8

Part of subcall function 2D392592: __getptd_noexit.LIBCMT ref: 2D392595
Part of subcall function 2D392592: __amsg_exit.LIBCMT ref: 2D3925A2

Part of subcall function 2D397FE3: __getptd.LIBCMT ref: 2D397FEF
Part of subcall function 2D397FE3: __amsg_exit.LIBCMT ref: 2D39800F

getSystemCP.LIBCMT ref: 2D39830D

Part of subcall function 2D398087: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 2D398096
Part of subcall function 2D398087: GetOEMCP.KERNEL32(00000000,?), ref: 2D3980B0

__malloc_crt.LIBCMT ref: 2D398323

Part of subcall function 2D395236: Sleep.KERNEL32(00000000,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D,2D3A62C8,00000008), ref: 2D395257

__setmbcp_nolock.LIBCMT ref: 2D398346

Part of subcall function 2D398103: getSystemCP.LIBCMT ref: 2D39811E

InterlockedDecrement.KERNEL32(?), ref: 2D39835E
InterlockedIncrement.KERNEL32(00000000), ref: 2D398383
__lock.LIBCMT ref: 2D39839E
InterlockedDecrement.KERNEL32 ref: 2D398415
InterlockedIncrement.KERNEL32(00000000), ref: 2D398439

Part of subcall function 2D38F117: __lock.LIBCMT ref: 2D38F135
Part of subcall function 2D38F117: ___sbh_find_block.LIBCMT ref: 2D38F140
Part of subcall function 2D38F117: ___sbh_free_block.LIBCMT ref: 2D38F14F
Part of subcall function 2D38F117: RtlFreeHeap.NTDLL(00000000,?,2D3A6180,0000000C,2D392583,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C), ref: 2D38F17F
Part of subcall function 2D38F117: GetLastError.KERNEL32(?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D), ref: 2D38F190

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Interlocked$DecrementIncrementLocaleSystem__amsg_exit__getptd__lock$ErrorFreeHeapLastSleepUpdateUpdate::____sbh_find_block___sbh_free_block__getptd_noexit__malloc_crt__setmbcp_nolock
String ID:
API String ID: 3643110423-0
Opcode ID: 3df9e2e73ded6d5034aa11ea323272c5362a18b9c62b6570e362b053742b4db6
Instruction ID: 55a5f1c193cecf32e6a3e12c9689995ceb6b018329593bca42f8a0165a0f77e9
Opcode Fuzzy Hash: 3df9e2e73ded6d5034aa11ea323272c5362a18b9c62b6570e362b053742b4db6
Instruction Fuzzy Hash: 0E41CF75A08204ABDB019F78C8807D97BF8FF48354F518929D982FB391DB38D981CBA4

Function 2D38BF57 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 2D38BF61
__CxxThrowException@8.LIBCMT ref: 2D38BF87
_memset.LIBCMT ref: 2D38BFA5
_memset.LIBCMT ref: 2D38BFBD

Strings

W, xrefs: 2D38BF71
(, xrefs: 2D38BFD9
VersionString, xrefs: 2D38BFD3

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: _memset$Exception@8H_prolog3_Throw
String ID: ($VersionString$W
API String ID: 2480781943-4079459477
Opcode ID: 558555e4bcce9c251829ce4fc9931f8ed741b9f43fb5430781d5f4dcfef6da38
Instruction ID: 5d5eef83544ec6b6b1fab3c8d77bca575f11f59cbab9f48095fac805898ccd13
Opcode Fuzzy Hash: 558555e4bcce9c251829ce4fc9931f8ed741b9f43fb5430781d5f4dcfef6da38
Instruction Fuzzy Hash: E1313072906228AAD721DB90CC84FEF7B7DEF15650F008195E309F7156DB709A84CFA1

Function 2D36F770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 2D36F793
GetLastError.KERNEL32 ref: 2D36F79D
__CxxThrowException@8.LIBCMT ref: 2D36F7C3

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

GetTempFileNameA.KERNEL32(?,OWP,00000000,?), ref: 2D36F7D7
DeleteFileA.KERNEL32(?), ref: 2D36F7E2
CreateDirectoryA.KERNEL32(?,00000000), ref: 2D36F7EF

Strings

OWP, xrefs: 2D36F7CB

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: FileTemp$CreateDeleteDirectoryDispatcherErrorExceptionException@8LastNamePathThrowUser
String ID: OWP
API String ID: 1319299049-437684616
Opcode ID: 29b1fa34d9ccb81d06a30cb040f1ff0e9ac7c384e1e602b22a613856d2891ac5
Instruction ID: cda4472a925f01eb7e136aaf6f11871dd1222fb439dff89d5c3a28be094a1925
Opcode Fuzzy Hash: 29b1fa34d9ccb81d06a30cb040f1ff0e9ac7c384e1e602b22a613856d2891ac5
Instruction Fuzzy Hash: 6D014C35E04219ABDB119B60CD49FEA77BCAF19B80F004095E645F6184DBB4DA848AEC

Function 2D381C7D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 2D381C87

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Part of subcall function 2D38F117: __lock.LIBCMT ref: 2D38F135
Part of subcall function 2D38F117: ___sbh_find_block.LIBCMT ref: 2D38F140
Part of subcall function 2D38F117: ___sbh_free_block.LIBCMT ref: 2D38F14F
Part of subcall function 2D38F117: RtlFreeHeap.NTDLL(00000000,?,2D3A6180,0000000C,2D392583,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C), ref: 2D38F17F
Part of subcall function 2D38F117: GetLastError.KERNEL32(?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D), ref: 2D38F190

Part of subcall function 2D37EEC5: __EH_prolog3.LIBCMT ref: 2D37EECF

__CxxThrowException@8.LIBCMT ref: 2D381DA5

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Part of subcall function 2D36D44F: char_traits.LIBCPMT ref: 2D36D474

Strings

CSession::setProperty, xrefs: 2D381D89
OPatchInstall: Setting property ', xrefs: 2D381C9A
SYS.ARGS, xrefs: 2D381D65
' to value ', xrefs: 2D381CE0

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherErrorExceptionException@8FileFreeH_prolog3H_prolog3_HeapLastThrowUserWrite___sbh_find_block___sbh_free_block__lockchar_traits
String ID: ' to value '$CSession::setProperty$OPatchInstall: Setting property '$SYS.ARGS
API String ID: 2542246481-3239059933
Opcode ID: 45c8ccb3fd19e5a320718020a4b1ea79f35cb0cf54211eb430bf2a77c3c6db5b
Instruction ID: 5c4de2efab20d8cd9b5567f57f537b37ce6b729c85bd893bde709ece7d25ffbf
Opcode Fuzzy Hash: 45c8ccb3fd19e5a320718020a4b1ea79f35cb0cf54211eb430bf2a77c3c6db5b
Instruction Fuzzy Hash: 2851AD71D08218ABCF15DBA4CC90BEDBB79EF64300F118199E256B3195DF706A89CBA4

Function 2D39E572 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D39E579
std::bad_exception::bad_exception.LIBCMT ref: 2D39E596

Part of subcall function 2D36DFA2: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DFAB

__CxxThrowException@8.LIBCMT ref: 2D39E5A4

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?), ref: 2D39E623
LoadLibraryA.KERNELBASE(?,?,?), ref: 2D39E6A0
GetLastError.KERNEL32 ref: 2D39E6AC
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 2D39E6DF

Strings

$, xrefs: 2D39E5F8
invalid string position, xrefs: 2D39E57E

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception$Raise$DispatcherErrorException@8H_prolog3LastLibraryLoadThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: $$invalid string position
API String ID: 1674345223-739374724
Opcode ID: a7ad13a88237c0e190fd85da52cccd47ccf409acc6b007c1bd968e53eee6dba3
Instruction ID: b50632d3e29d36f706cd775ccc77d647c938542fd5b5bf6564c18fe582a5c665
Opcode Fuzzy Hash: a7ad13a88237c0e190fd85da52cccd47ccf409acc6b007c1bd968e53eee6dba3
Instruction Fuzzy Hash: D1213971D01208AFCB14CFA9D980ADEB7F9EF48310F14842AE945F7340E774A944CB64

Function 2D37068A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 2D3706A4
GetLastError.KERNEL32 ref: 2D3706B1
__CxxThrowException@8.LIBCMT ref: 2D3706D9
CloseHandle.KERNEL32(00000000,2D3612A4,' already exsits, will be renaming it to a temporary file,?,OPatchInstall: The file '), ref: 2D370723

Strings

' already exsits, will be renaming it to a temporary file, xrefs: 2D37070A
OPatchInstall: The file ', xrefs: 2D3706F4

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CloseCreateErrorException@8FileHandleLastThrow
String ID: ' already exsits, will be renaming it to a temporary file$OPatchInstall: The file '
API String ID: 270997898-3382183290
Opcode ID: 2ec8fd4015df4102da6a372a1cd7248c659132d7a85c6aa1ec3b56ae5626b1e0
Instruction ID: 20434e2300cf42003ff5d7f0eedae62b2581dc4d3df48503009f8a2bab543854
Opcode Fuzzy Hash: 2ec8fd4015df4102da6a372a1cd7248c659132d7a85c6aa1ec3b56ae5626b1e0
Instruction Fuzzy Hash: C911E3366046047BEB159B70CC45DFE3B79EBA4561F018119FA02F6296CE789A4097A8

Function 2D36F994 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D36F99E

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Part of subcall function 2D380323: __EH_prolog3.LIBCMT ref: 2D38032A

__CxxThrowException@8.LIBCMT ref: 2D36F9EF

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

Path, xrefs: 2D36F9C6
OPatchInstall: CActionFile::initFromElements ends, xrefs: 2D36FA5E
OPatchInstall: CActionFile::initFromElement starts, xrefs: 2D36F9AA
OPatchInstall: Will check for file ', xrefs: 2D36F9F4

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: H_prolog3$DispatcherExceptionException@8FileThrowUserWrite
String ID: OPatchInstall: CActionFile::initFromElement starts$OPatchInstall: CActionFile::initFromElements ends$OPatchInstall: Will check for file '$Path
API String ID: 3043255952-219723760
Opcode ID: f470a4e526a291f3b7206f03f865a433e206b56a0cdf86f33d6c3636589200d1
Instruction ID: 0a1ed77d35f902a74574873945d5cdfdf0ac8db819caab8a9a5466c482428411
Opcode Fuzzy Hash: f470a4e526a291f3b7206f03f865a433e206b56a0cdf86f33d6c3636589200d1
Instruction Fuzzy Hash: FC11A536A046406BCB25DB20CC909EC6722AFF1604F56C058E606F719ACB70AF468BE9

Function 2D36E8FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2D36E90D

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

GetLastError.KERNEL32 ref: 2D36E96D
__CxxThrowException@8.LIBCMT ref: 2D36E98A

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

CloseHandle.KERNEL32(00000000), ref: 2D36E998

Strings

OPatchInstall: ShellExec ', xrefs: 2D36E920
open, xrefs: 2D36E92E

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CloseDispatcherErrorExceptionException@8FileHandleLastThrowUserWrite_memset
String ID: OPatchInstall: ShellExec '$open
API String ID: 1909066581-1602519316
Opcode ID: f22378a65af64f23b998f110bb0d1e12009827b3a1c38234567107df1bb40327
Instruction ID: 960a714a2288039fe0e087d5097ff36d7c384be0f2cf3b3c38e7578456e19166
Opcode Fuzzy Hash: f22378a65af64f23b998f110bb0d1e12009827b3a1c38234567107df1bb40327
Instruction Fuzzy Hash: 9711C236D00218BBCB10DBA0CC88AEE7BB9EFA0644F058015F601F6255DB349A41CBE8

Function 2D36F808 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetFullPathNameA.KERNEL32(?,00000104,?,00000000), ref: 2D36F83D
GetLastError.KERNEL32 ref: 2D36F847
__CxxThrowException@8.LIBCMT ref: 2D36F86D

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

GetTempFileNameA.KERNEL32(?,OPI,00000000,?), ref: 2D36F88A
DeleteFileA.KERNEL32(?), ref: 2D36F895

Strings

OPI, xrefs: 2D36F87E

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: FileName$DeleteDispatcherErrorExceptionException@8FullLastPathTempThrowUser
String ID: OPI
API String ID: 3431453736-826062735
Opcode ID: c1934c3f381732248b907f82aefb0d98abd9640b4ca61a4acc1302a9d858b2ef
Instruction ID: 2e44b663a8790dd72b521bfb428c0bdb754fd183e55b7953b3597d30621fda5e
Opcode Fuzzy Hash: c1934c3f381732248b907f82aefb0d98abd9640b4ca61a4acc1302a9d858b2ef
Instruction Fuzzy Hash: 72115E31E00219ABDB15DB64CD46BEE77BCAF18744F004095E605F7284DB74AA84CFE8

Function 2D37FC29 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 2D37FC30

Part of subcall function 2D37FAE1: __EH_prolog3_GS.LIBCMT ref: 2D37FAE8
Part of subcall function 2D37FAE1: _wcsrchr.LIBCMT ref: 2D37FB0E

Strings

SYS.PATCH, xrefs: 2D37FC7F
SYS.WIN, xrefs: 2D37FC4C
SYS.MSI, xrefs: 2D37FC90
SYS.ARGS, xrefs: 2D37FC6E
SYS.ERROR, xrefs: 2D37FC5D

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: H_prolog3_$_wcsrchr
String ID: SYS.ARGS$SYS.ERROR$SYS.MSI$SYS.PATCH$SYS.WIN
API String ID: 780983759-1584573799
Opcode ID: a2ee7306c5c2c84fc76ea9368ceb23e267b7735e71516d44a4980a01976a13ac
Instruction ID: 3730335ea60bae6046f6ee119ab77f09cee0fd567638cfef5dc04eda6141cb77
Opcode Fuzzy Hash: a2ee7306c5c2c84fc76ea9368ceb23e267b7735e71516d44a4980a01976a13ac
Instruction Fuzzy Hash: 21018062D0854559FB10D7B5EAC1BFD6778AF24244F10C114EA11F20D9EBB8E608CAB4

Function 2D36F552 Relevance: 10.5, APIs: 7, Instructions: 45fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,08000000,00000000), ref: 2D36F56B
GetLastError.KERNEL32 ref: 2D36F578
__CxxThrowException@8.LIBCMT ref: 2D36F595
GetFileSize.KERNEL32(00000000,00000000), ref: 2D36F59C
GetLastError.KERNEL32 ref: 2D36F5AC
CloseHandle.KERNEL32(00000000), ref: 2D36F5B5
CloseHandle.KERNEL32(00000000), ref: 2D36F5BF

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CloseErrorFileHandleLast$CreateException@8SizeThrow
String ID:
API String ID: 2650904697-0
Opcode ID: 3a41a7136fc3c745f0813f4f809e8052e02a161f0bca6aa98f6645ff951c30a1
Instruction ID: 6a23732d82fd1083ef0c15189de26edef1710e962dd05a875f61462556f150f8
Opcode Fuzzy Hash: 3a41a7136fc3c745f0813f4f809e8052e02a161f0bca6aa98f6645ff951c30a1
Instruction Fuzzy Hash: 0E012C36804154BBC7225F75DC0CE9A3FBCEB8AB61F108215FA25E6290DB345A00DAE8

Function 2D387770 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 2D387794
LoadLibraryA.KERNEL32(?), ref: 2D38779C
GetLastError.KERNEL32 ref: 2D3877AB
GetProcAddress.KERNEL32(00000000,Expression), ref: 2D3877D0
GetLastError.KERNEL32 ref: 2D3877DF

Strings

Expression, xrefs: 2D3877CA

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ErrorLast$AddressException@8LibraryLoadProcThrow
String ID: Expression
API String ID: 979385811-2540525009
Opcode ID: 6868e78d3e0c8c67a1acf90dfdf7a5e996f6b403219d196460471f194866c32a
Instruction ID: 481766e66a5f0e7c0a9671858a32ab1ee2965eb6e1d32d746b9d02e2866aa060
Opcode Fuzzy Hash: 6868e78d3e0c8c67a1acf90dfdf7a5e996f6b403219d196460471f194866c32a
Instruction Fuzzy Hash: 160100B5D08209BBDB12DF60C894ABE3BBDEB14641F008025F905E6216EB74D684CBA4

Function 2D383C96 Relevance: 9.1, APIs: 6, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 2D383CB3
GetLastError.KERNEL32 ref: 2D383CC1
__CxxThrowException@8.LIBCMT ref: 2D383CDE
GetFileSize.KERNEL32(00000000,00000000), ref: 2D383CE5
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 2D383D1C
CloseHandle.KERNEL32(?), ref: 2D383D2E

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: File$CloseCreateErrorException@8HandleLastReadSizeThrow
String ID:
API String ID: 1554728870-0
Opcode ID: 0b73bcc57c74e125c44d81350139b4b506fb1318a4564cb98920a8155934032a
Instruction ID: 0cbfe824d19d54489a857f52f4ae48c70d12ee00c432b9a63b57b0d4caf94948
Opcode Fuzzy Hash: 0b73bcc57c74e125c44d81350139b4b506fb1318a4564cb98920a8155934032a
Instruction Fuzzy Hash: 19118175904208BFDB019FA4CC88DAE7FBCEB192A0B108525F955E7251E7349E449BA4

Function 2D3946FD Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 2D394725

Part of subcall function 2D38F69E: __getptd.LIBCMT ref: 2D38F6AC
Part of subcall function 2D38F69E: __getptd.LIBCMT ref: 2D38F6BA

__getptd.LIBCMT ref: 2D39472F

Part of subcall function 2D392592: __getptd_noexit.LIBCMT ref: 2D392595
Part of subcall function 2D392592: __amsg_exit.LIBCMT ref: 2D3925A2

__getptd.LIBCMT ref: 2D39473D
__getptd.LIBCMT ref: 2D39474B
__getptd.LIBCMT ref: 2D394756
_CallCatchBlock2.LIBCMT ref: 2D39477C

Part of subcall function 2D38F743: __CallSettingFrame@12.LIBCMT ref: 2D38F78F

Part of subcall function 2D394823: __getptd.LIBCMT ref: 2D394832
Part of subcall function 2D394823: __getptd.LIBCMT ref: 2D394840

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 0a9946b08f7e2414ab9d955c98f971561d82cf2110e552643b4341efc1096828
Instruction ID: 0743d555289be706589235156fe5dd447877b4f291d1ced118fc7f80ecf603f2
Opcode Fuzzy Hash: 0a9946b08f7e2414ab9d955c98f971561d82cf2110e552643b4341efc1096828
Instruction Fuzzy Hash: 151104B9C04209DFDB00DFA4C844AEDBBB0FF18324F51C469E955E7250EB389A109F54

Function 2D3805F7 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D380601

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

__CxxThrowException@8.LIBCMT ref: 2D3806DE

Part of subcall function 2D38F117: __lock.LIBCMT ref: 2D38F135
Part of subcall function 2D38F117: ___sbh_find_block.LIBCMT ref: 2D38F140
Part of subcall function 2D38F117: ___sbh_free_block.LIBCMT ref: 2D38F14F
Part of subcall function 2D38F117: RtlFreeHeap.NTDLL(00000000,?,2D3A6180,0000000C,2D392583,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C), ref: 2D38F17F
Part of subcall function 2D38F117: GetLastError.KERNEL32(?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D), ref: 2D38F190

Strings

OPatchInstall: Setting system property ', xrefs: 2D38060D
' with value ', xrefs: 2D380652
CSession::setStandardProperty, xrefs: 2D3806C0

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ErrorException@8FileFreeH_prolog3HeapLastThrowWrite___sbh_find_block___sbh_free_block__lock
String ID: ' with value '$CSession::setStandardProperty$OPatchInstall: Setting system property '
API String ID: 3434176583-579691053
Opcode ID: cfd2021437de26023abee82646911bb74bf90ec6afe5ab20f7e06428bf0da2a4
Instruction ID: 1e7d15f2a67bb248ec5dcdcc459aa76c41e08344a744e18d0206f18f5fdb1b40
Opcode Fuzzy Hash: cfd2021437de26023abee82646911bb74bf90ec6afe5ab20f7e06428bf0da2a4
Instruction Fuzzy Hash: 0641883190420AAACF15DFA0CC91AED7B75EF60214F11C1A9E616B71E6DB305F898BA4

Function 2D37F35D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D37F367

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Strings

OPatchInstall: End of all properties, xrefs: 2D37F4A3
OPatchInstall: Logging all properties, xrefs: 2D37F373
' value ', xrefs: 2D37F406
OPatchInstall: Property ', xrefs: 2D37F3AF

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: FileH_prolog3Write
String ID: ' value '$OPatchInstall: End of all properties$OPatchInstall: Logging all properties$OPatchInstall: Property '
API String ID: 3581554285-1389568307
Opcode ID: ca472d874844de1027e6a8b471c6b424c45a350723100b366b2d328b882ce02a
Instruction ID: b1b984a3cba9b3fbcc2dccc79b4f7efe0b2ba870f6f2b7a4b767639a68765a69
Opcode Fuzzy Hash: ca472d874844de1027e6a8b471c6b424c45a350723100b366b2d328b882ce02a
Instruction Fuzzy Hash: 2A318032A046059BDB14DB50CC91AED73B6FF74304F5680A9D202F72E5DF34AE41CAA5

Function 2D388060 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 2D3880C2
CoTaskMemFree.OLE32(00000000), ref: 2D3880CB
__CxxThrowException@8.LIBCMT ref: 2D3880F1
CoTaskMemFree.OLE32(00000000), ref: 2D388105

Strings

A, xrefs: 2D388096

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: FreeTask$ErrorException@8LastThrow
String ID: A
API String ID: 4082772262-3554254475
Opcode ID: 7f9d91148af4b550367884fa76423bcc3feb82e8d2608ef02da5499b6dfe7645
Instruction ID: d25dbb05741700df38ceada1defa2faa091ddd70e88c3b546efddd071a686bbb
Opcode Fuzzy Hash: 7f9d91148af4b550367884fa76423bcc3feb82e8d2608ef02da5499b6dfe7645
Instruction Fuzzy Hash: 85115176A01218BBCB11DF65DC48ADE77FCAF58740F008195E509E3241DB38AA44CBA8

Function 2D379742 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Part of subcall function 2D379536: __EH_prolog3_GS.LIBCMT ref: 2D379540
Part of subcall function 2D379536: __CxxThrowException@8.LIBCMT ref: 2D379595

Part of subcall function 2D380323: __EH_prolog3.LIBCMT ref: 2D38032A

__CxxThrowException@8.LIBCMT ref: 2D3797A0

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

Type, xrefs: 2D3797A9
OPatchInstall: CActionWriteRegistry::initFromElement starts, xrefs: 2D379750
OPatchInstall: CActionWriteRegistry::initFromElement ends, xrefs: 2D3797BC
Data, xrefs: 2D379777

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8Throw$DispatcherExceptionFileH_prolog3H_prolog3_UserWrite
String ID: Data$OPatchInstall: CActionWriteRegistry::initFromElement ends$OPatchInstall: CActionWriteRegistry::initFromElement starts$Type
API String ID: 1690020135-351268825
Opcode ID: 7f47ce5a13d761a96ff5eef68bf5526c191a1853f56c063b4bea215ad72780d0
Instruction ID: 959289446d0128867d82c9459709ff7481ab62ee7dc9bace261f58766a3fbfa2
Opcode Fuzzy Hash: 7f47ce5a13d761a96ff5eef68bf5526c191a1853f56c063b4bea215ad72780d0
Instruction Fuzzy Hash: 9B0128323046043B4A159B20CC90CFE3B1BEFB8158B4AC125FB46B7217DF35EA4286B5

Function 2D3923F1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 2D392402

Part of subcall function 2D392305: TlsGetValue.KERNEL32(00000000,?,2D3923C0,?,2D390724), ref: 2D392317
Part of subcall function 2D392305: TlsGetValue.KERNEL32(00000005,?,2D3923C0,?,2D390724), ref: 2D39232E

TlsFree.KERNEL32(00000004,2D3928D1), ref: 2D392420
DeleteCriticalSection.KERNEL32(00000000,00000000,KERNEL32.DLL,?,2D3928D1), ref: 2D3933A8
DeleteCriticalSection.KERNEL32(00000004,KERNEL32.DLL,?,2D3928D1), ref: 2D3933D2

Strings

KERNEL32.DLL, xrefs: 2D393394

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CriticalDeleteSectionValue$Free__decode_pointer
String ID: KERNEL32.DLL
API String ID: 73151052-2576044830
Opcode ID: dccdefd02cdb7b0f9bf8db24b34a1529db0dcbcc49d3074b7cb823bfee2595de
Instruction ID: fd3b8c3c3732cc2adbb13c6701d7e251354cac18b7ed718f92bde69d91e87e8f
Opcode Fuzzy Hash: dccdefd02cdb7b0f9bf8db24b34a1529db0dcbcc49d3074b7cb823bfee2595de
Instruction Fuzzy Hash: D1018072640601ABC7655B28C8C56A6B3F9EB417343A1461AE9F4B76F0CB398C828765

Function 2D3818CF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Part of subcall function 2D36E1FC: __EH_prolog3.LIBCMT ref: 2D36E203

__CxxThrowException@8.LIBCMT ref: 2D381930

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

OPatchInstall: CActionReboot::execute starts, xrefs: 2D3818DF
OPatchInstall: Scheduling the reboot, xrefs: 2D3818F8
OPatchInstall: The reboot is scheduled, xrefs: 2D381935
OPatchInstall: CActionReboot::execute ends, xrefs: 2D381949

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8FileH_prolog3ThrowUserWrite
String ID: OPatchInstall: CActionReboot::execute ends$OPatchInstall: CActionReboot::execute starts$OPatchInstall: Scheduling the reboot$OPatchInstall: The reboot is scheduled
API String ID: 74031213-3592306054
Opcode ID: bb2a788b02c1bee2156e66faf70c937ed970c8afa2168d4ea2ec2220a52e3cd4
Instruction ID: 8d9da57280e3db32741ef6a1ea9f35e0fbb1885210ce7f4fe256d48c2ec4f9f0
Opcode Fuzzy Hash: bb2a788b02c1bee2156e66faf70c937ed970c8afa2168d4ea2ec2220a52e3cd4
Instruction Fuzzy Hash: F0F0367270462122D525AA35CC50EEF515F9FF1908F8AD019E602F619BDD785A4241F9

Function 2D394448 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2D394462

Part of subcall function 2D392592: __getptd_noexit.LIBCMT ref: 2D392595
Part of subcall function 2D392592: __amsg_exit.LIBCMT ref: 2D3925A2

__getptd.LIBCMT ref: 2D394473
__getptd.LIBCMT ref: 2D394481

Strings

csm, xrefs: 2D39445B
MOC, xrefs: 2D394454

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: f9f9dcfff0fae24ed862b18d4eada347b32ec052f356a63b91cdffcbbfd7a3ba
Instruction ID: 2e9bb0e171f8a84a211fd0a9432ee4de9045b875d603f2ff387f54312e39e830
Opcode Fuzzy Hash: f9f9dcfff0fae24ed862b18d4eada347b32ec052f356a63b91cdffcbbfd7a3ba
Instruction Fuzzy Hash: 19E04F791141048FC7009FA5D445BA873A8FB78239F96C0A1D50DDB322D738D940D756

Function 2D379AC4 Relevance: 7.7, APIs: 5, Instructions: 192COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 2D379B09
ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,?,?,00000000,00000002,00000000,?), ref: 2D379BF7
GetLastError.KERNEL32(?,?,00000000,00000002,00000000,?), ref: 2D379C08
ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,?,?,00000000,00000002,00000000,?), ref: 2D379C56
GetLastError.KERNEL32(?,?,00000000,00000002,00000000,?), ref: 2D379C88

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: EnvironmentErrorExpandLastStrings$Exception@8Throw
String ID:
API String ID: 3874821722-0
Opcode ID: b753053096963d46297761f6051045b68dd86a11a88fab3fff63dbe98b6de1c1
Instruction ID: 6f0f15532dfdb7327d388084771b9d61f82d0afe9d632a2cc61af850243f39d4
Opcode Fuzzy Hash: b753053096963d46297761f6051045b68dd86a11a88fab3fff63dbe98b6de1c1
Instruction Fuzzy Hash: 27614A75D0864EAFDF01DFA4D891CFEBBB8EF18300B118169E601B7261DB759A04DBA4

Function 2D387F19 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000000,00000000), ref: 2D387F2C
SetLastError.KERNEL32(00000008), ref: 2D387F49

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID:
API String ID: 152501406-0
Opcode ID: 29523339c5b730be5e0c765d46c4f56a11ef45bed742f66f1ca25cfd809ca0ac
Instruction ID: 7e6c121b7f8712a63d1686c359aa108d2f8fe136732621f7c6755e67b323c8f1
Opcode Fuzzy Hash: 29523339c5b730be5e0c765d46c4f56a11ef45bed742f66f1ca25cfd809ca0ac
Instruction Fuzzy Hash: 1411E573808014BBCF122B26DC09F993B7AEF953A1F018061F659F51D2DF708A80CAE4

Function 2D397FE3 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2D397FEF

Part of subcall function 2D392592: __getptd_noexit.LIBCMT ref: 2D392595
Part of subcall function 2D392592: __amsg_exit.LIBCMT ref: 2D3925A2

__amsg_exit.LIBCMT ref: 2D39800F
__lock.LIBCMT ref: 2D39801F
InterlockedDecrement.KERNEL32(?), ref: 2D39803C
InterlockedIncrement.KERNEL32(010D1688), ref: 2D398067

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 787dfb0ad3f6d29a27bef0f4e1f89d76ba5bbc9cbb69f1297f9cdabb95506bff
Instruction ID: 06d2929f6e89863a40afc79684a0c3de4bc2b8034f32b67f054897b33e76ff59
Opcode Fuzzy Hash: 787dfb0ad3f6d29a27bef0f4e1f89d76ba5bbc9cbb69f1297f9cdabb95506bff
Instruction Fuzzy Hash: 83019236E06A11BBD7529F65C40A7ED77B4FF44B60F118105EA10B7780DB38A940DBD5

Function 2D388C32 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D388C39
std::bad_exception::bad_exception.LIBCMT ref: 2D388C62

Part of subcall function 2D36DFA2: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DFAB

__CxxThrowException@8.LIBCMT ref: 2D388C70

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

invalid map/set<T> iterator, xrefs: 2D388C4A

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid map/set<T> iterator
API String ID: 4068783259-152884079
Opcode ID: d52b6a3c48c3c47cac4ff993b10aea5dfa9eb2edcf1c9e7d86a05886a9f64203
Instruction ID: 4646ae061bcfb7dbf3c6f36c8f580d00bc84d293544ec94dd46ed7764a3b3464
Opcode Fuzzy Hash: d52b6a3c48c3c47cac4ff993b10aea5dfa9eb2edcf1c9e7d86a05886a9f64203
Instruction Fuzzy Hash: B5A18C7090A281DFD726CF24D580BA5BFF1BF55304F19C489D289AB297D3B6E885CB90

Function 2D38A4EB Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D38A4F2
std::bad_exception::bad_exception.LIBCMT ref: 2D38A51B

Part of subcall function 2D36DFA2: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DFAB

__CxxThrowException@8.LIBCMT ref: 2D38A529

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

invalid map/set<T> iterator, xrefs: 2D38A503

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid map/set<T> iterator
API String ID: 4068783259-152884079
Opcode ID: e670edc4af79bef4ca16c33c91d1d4bd0203187d9cd2422abf383cfc0695f912
Instruction ID: 6842d45691cb65394fe1d033e586d8965155aa233236f840c29329beea83d9f5
Opcode Fuzzy Hash: e670edc4af79bef4ca16c33c91d1d4bd0203187d9cd2422abf383cfc0695f912
Instruction Fuzzy Hash: F5A16AB0A0C2959FDB02CF24C480B65BBE1BF19314F29C589D58AAF297C375E885CF94

Function 2D3749C2 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 215COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D3749C9
std::bad_exception::bad_exception.LIBCMT ref: 2D3749F2

Part of subcall function 2D36DFA2: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DFAB

__CxxThrowException@8.LIBCMT ref: 2D374A00

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

invalid map/set<T> iterator, xrefs: 2D3749DA

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid map/set<T> iterator
API String ID: 4068783259-152884079
Opcode ID: c59ecf06f617d55c9c5e61bd484d324ce52f0db6e8ce0279b2935063dce1976a
Instruction ID: 0bdde11be562e8f53b36403988e667d3090883c4701c6694d8ba49e2e78e60a9
Opcode Fuzzy Hash: c59ecf06f617d55c9c5e61bd484d324ce52f0db6e8ce0279b2935063dce1976a
Instruction Fuzzy Hash: 7CA16FB0E08A91DFE742CF24C484B65BBF5BF19324F258588D1996B252C3B9FC85CB94

Function 2D37C8A2 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D37C8A9
std::bad_exception::bad_exception.LIBCMT ref: 2D37C8D2

Part of subcall function 2D36DFA2: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DFAB

__CxxThrowException@8.LIBCMT ref: 2D37C8E0

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

invalid map/set<T> iterator, xrefs: 2D37C8BA

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid map/set<T> iterator
API String ID: 4068783259-152884079
Opcode ID: 55d71ad8012f584b546e4251c9c3fdf131d57464754abaf664dc6d64e23f15be
Instruction ID: f2c162d79a36b79132b77659d00b9cc7a5748b7364da75e4aee670dd6885bb3d
Opcode Fuzzy Hash: 55d71ad8012f584b546e4251c9c3fdf131d57464754abaf664dc6d64e23f15be
Instruction Fuzzy Hash: B5A16F70909A81DFF792CF64C584BA5BBF1BF16304F19C488D2896B257D37AE885CB90

Function 2D37D8ED Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D37D8F7

Part of subcall function 2D36D19F: __EH_prolog3.LIBCMT ref: 2D36D1A6

__CxxThrowException@8.LIBCMT ref: 2D37D960

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Strings

Parameter, xrefs: 2D37D903
OPatchInstall: Will use the parameter ', xrefs: 2D37D9FF

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: H_prolog3$Exception@8FileThrowWrite
String ID: OPatchInstall: Will use the parameter '$Parameter
API String ID: 3235903053-1315047
Opcode ID: c262fd85ba0b475b48642cc3215c881a1d7773d0ecb3c28349c83ad743924052
Instruction ID: 77c0193b7644594b3277e1106e6e281c1290c98b2e009512bc97841d459215ac
Opcode Fuzzy Hash: c262fd85ba0b475b48642cc3215c881a1d7773d0ecb3c28349c83ad743924052
Instruction Fuzzy Hash: 8751AE71A0464ADFDF00CF94C880AEEBBB5FF55204F148068E606FB295CB349E45CBA0

Function 2D388F16 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D388F1D
std::bad_exception::bad_exception.LIBCMT ref: 2D388F45

Part of subcall function 2D36DF57: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DF60

__CxxThrowException@8.LIBCMT ref: 2D388F53

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

map/set<T> too long, xrefs: 2D388F2D

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: map/set<T> too long
API String ID: 4068783259-1285458680
Opcode ID: 25310a91d66e70fa3e4dc8cb45e6e3012eea5d00f5d982e5032dfe060d578e4e
Instruction ID: 4ce1699f92581709ea0fbe9f5d8c7d1094cc6de98e39ff542add9796ceb9557f
Opcode Fuzzy Hash: 25310a91d66e70fa3e4dc8cb45e6e3012eea5d00f5d982e5032dfe060d578e4e
Instruction Fuzzy Hash: A34139766046409FD711CF58D584EA9BBF6BF59304F0A8088EA49AB393D772FC81CB91

Function 2D36E038 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D36E03F
std::bad_exception::bad_exception.LIBCMT ref: 2D36E067

Part of subcall function 2D36DF57: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DF60

__CxxThrowException@8.LIBCMT ref: 2D36E075

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

map/set<T> too long, xrefs: 2D36E04F

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: map/set<T> too long
API String ID: 4068783259-1285458680
Opcode ID: 4b011b6c261ec8391850ffc900ab18900c26f1c6a842e51367896947056264f6
Instruction ID: 3d6ee80794b1e5094a04f459ca28d0fbdfd2f01d933c2d2ee19968a4ac3a45b4
Opcode Fuzzy Hash: 4b011b6c261ec8391850ffc900ab18900c26f1c6a842e51367896947056264f6
Instruction Fuzzy Hash: 264134716042509FD701CF2AC484AA5BBF1BF19314F0AC188DA49AB7A6C771EC89CFE5

Function 2D38BA71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D38BA78
std::bad_exception::bad_exception.LIBCMT ref: 2D38BAA0

Part of subcall function 2D36DF57: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DF60

__CxxThrowException@8.LIBCMT ref: 2D38BAAE

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

map/set<T> too long, xrefs: 2D38BA88

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: map/set<T> too long
API String ID: 4068783259-1285458680
Opcode ID: 698a6c8c2d52a9495d04485046b0de0a2ea6aa138b5ed436b678484fa2d863df
Instruction ID: ab043f396945671ed3055fbb2a9f01a323f3e029f97fc1f1d1f7792caa04a15f
Opcode Fuzzy Hash: 698a6c8c2d52a9495d04485046b0de0a2ea6aa138b5ed436b678484fa2d863df
Instruction Fuzzy Hash: 104138716046459FD702CF18C0C4EA6BBF5BF19314F1A8188D54AAB7A7C7B5EC81CB90

Function 2D38198E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2D3819AD
__CxxThrowException@8.LIBCMT ref: 2D3819D6

Strings

' to be extracted to ', xrefs: 2D381A12
OPatchInstall: Adding the file with Id ', xrefs: 2D3819FC

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8Throw_memset
String ID: ' to be extracted to '$OPatchInstall: Adding the file with Id '
API String ID: 3963884845-339039882
Opcode ID: fd412d0d1d055fa3b8a4e825d329b1887bcaebfb261e355434b1aa453691deaf
Instruction ID: f739ac3a33ee5256180834819249f7096d1ddda2df465a9e60b03a8391749609
Opcode Fuzzy Hash: fd412d0d1d055fa3b8a4e825d329b1887bcaebfb261e355434b1aa453691deaf
Instruction Fuzzy Hash: EF110833A0852436CA129E64CC40DEE3729DFB2664F46C215FE11FA2D6CE349B0143E5

Function 2D397D99 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,2D3901BF), ref: 2D397D9E
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 2D397DAE

Strings

IsProcessorFeaturePresent, xrefs: 2D397DA8
KERNEL32, xrefs: 2D397D99

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 4c23221a75755089949ff04ee5b0d545151481e804a78921f60f012bef2fe408
Instruction ID: 2584ecfa318817557c4303a3b13e2f760911f25dab51d21ecaea10ddc5015913
Opcode Fuzzy Hash: 4c23221a75755089949ff04ee5b0d545151481e804a78921f60f012bef2fe408
Instruction Fuzzy Hash: 5BF03060944909A3DB001FA1E8097BF7B78BB81786F810990D292B01D8DF3580B4C299

Function 2D37A431 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Part of subcall function 2D37A30F: PostMessageA.USER32(?,00008001,00000000,00000000), ref: 2D37A31A

WaitForSingleObject.KERNEL32(00000000,000000FF,2D3612A4,OPatchInstall: Closing the Dialog thread), ref: 2D37A466
CloseHandle.KERNEL32(00000000), ref: 2D37A46F

Strings

OPatchInstall: The dialog thread is closed, xrefs: 2D37A479
OPatchInstall: Closing the Dialog thread, xrefs: 2D37A441

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CloseFileHandleMessageObjectPostSingleWaitWrite
String ID: OPatchInstall: Closing the Dialog thread$OPatchInstall: The dialog thread is closed
API String ID: 3185453390-2827411991
Opcode ID: 9a33da27fe5ace1d6c8995181687dc2c304a6448e26b0fae31dae239d7eab018
Instruction ID: c843ee3ee59eb520dc4a20c986960e42dd1544ed918d49d859183a8e7f927d0f
Opcode Fuzzy Hash: 9a33da27fe5ace1d6c8995181687dc2c304a6448e26b0fae31dae239d7eab018
Instruction Fuzzy Hash: 76F027333085117BCA125714CC80BBDF26AFBE0519F46C224E215B12A8CF381C9293D9

Function 2D370635 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D37063C
std::bad_exception::bad_exception.LIBCMT ref: 2D37066A

Part of subcall function 2D36DF57: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DF60

__CxxThrowException@8.LIBCMT ref: 2D370678

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

list<T> too long, xrefs: 2D370652

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: list<T> too long
API String ID: 4068783259-4027344264
Opcode ID: e1e8483606ff898c1a8b3f8e7c4c02071160dccaa535b3bad60ef7ae1214f805
Instruction ID: d355200c47f56a925079b41b6259e8d047983b2c8be9238edcff08cfda807e4d
Opcode Fuzzy Hash: e1e8483606ff898c1a8b3f8e7c4c02071160dccaa535b3bad60ef7ae1214f805
Instruction Fuzzy Hash: 47F03077D1421496CB04DAB0C880ADD77B4EF78254F268524D604FB159E634DA45C7E4

Function 2D37FA5D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D37FA64
std::bad_exception::bad_exception.LIBCMT ref: 2D37FA92

Part of subcall function 2D36DF57: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DF60

__CxxThrowException@8.LIBCMT ref: 2D37FAA0

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

list<T> too long, xrefs: 2D37FA7A

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: list<T> too long
API String ID: 4068783259-4027344264
Opcode ID: 6f365b701ab057823452bd5fb62f4e33722fb46a2df78d2ab6a0a9284f844b5e
Instruction ID: d5a21a0aeadfb0f17fdf8e4f11db502999b18e9123cd9783bfdf506b69fcb06f
Opcode Fuzzy Hash: 6f365b701ab057823452bd5fb62f4e33722fb46a2df78d2ab6a0a9284f844b5e
Instruction Fuzzy Hash: E7F0A073D102049BCB04DAB0C880ADC73B4AF78310F268214DA04FB1C9E634DA05C7E4

Function 2D38B6B2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D38B6B9
std::bad_exception::bad_exception.LIBCMT ref: 2D38B6D6

Part of subcall function 2D36DF57: std::runtime_error::runtime_error.LIBCPMT ref: 2D36DF60

__CxxThrowException@8.LIBCMT ref: 2D38B6E4

Part of subcall function 2D38EE42: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 2D38EE84

Strings

vector<T> too long, xrefs: 2D38B6BE

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: DispatcherExceptionException@8H_prolog3ThrowUserstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: vector<T> too long
API String ID: 4068783259-3788999226
Opcode ID: 96f2b50a614e7422ec1249629f887a844c755b8575c1a0879420c9fecdbb3d02
Instruction ID: 1faa81bf2442e9bed32f17938b225ba1f227d8dbba01f0212ea31bae360df047
Opcode Fuzzy Hash: 96f2b50a614e7422ec1249629f887a844c755b8575c1a0879420c9fecdbb3d02
Instruction Fuzzy Hash: 6ED0E272804108AADB04D6E0CC80AED73B8EB24200F568014E700BA099EA749A08C6B5

Function 2D36F368 Relevance: 6.3, APIs: 5, Instructions: 74stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 2D36F383
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,?,00000001), ref: 2D36F3B0
GetLastError.KERNEL32(?,00000001), ref: 2D36F3BB
MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,00000001), ref: 2D36F3D4
MultiByteToWideChar.KERNEL32(?,00000000,?,?,?,?,?,00000001), ref: 2D36F3FA

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: 871f69aff593c73d29750939a852bc67324299fc608df63e833725462f9f4063
Instruction ID: c5d9de8e5e76e16c545ce70ee2d750068f35ae2e001047925a5337059c65d45a
Opcode Fuzzy Hash: 871f69aff593c73d29750939a852bc67324299fc608df63e833725462f9f4063
Instruction Fuzzy Hash: 0C113036801128FBCF225F92CC44D9EBF7DEF457A0B118161FA04EA154D6318A11DBF4

Function 2D38EA25 Relevance: 6.1, APIs: 4, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,231091CD,?,?,?,?,?,2D3A19AF,000000FF), ref: 2D38EA94
GetLastError.KERNEL32(?,?,?,?,?,2D3A19AF,000000FF), ref: 2D38EAA0

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 0c2130176f6239e4763d195bebd036f1124e85245f79700872d46efbef578462
Instruction ID: ca038201943ca38e0713b971baa4a670c982c377f703c35472c1825bf4b8a6de
Opcode Fuzzy Hash: 0c2130176f6239e4763d195bebd036f1124e85245f79700872d46efbef578462
Instruction Fuzzy Hash: E131FBB2F44205BBD7108F65CC46F6A77E8EB54F20F104229FA15F72C1D679E5008294

Function 2D39A4F8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 2D39A52C
__isleadbyte_l.LIBCMT ref: 2D39A560
MultiByteToWideChar.KERNEL32(00000080,00000009,2D38FADD,?,00000000,00000000,?,?,?,?,2D38FADD), ref: 2D39A591
MultiByteToWideChar.KERNEL32(00000080,00000009,2D38FADD,00000001,00000000,00000000,?,?,?,?,2D38FADD), ref: 2D39A5FF

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e5eb2e83da889db1e4bc6dccfcaa2f0e3a07a6d136d94a841b9e9c7cf69fc5ff
Instruction ID: 6a43bb291a7fa2d6b2cb3353ce2577a0952283052cce41dcb793adeb2fe9f4db
Opcode Fuzzy Hash: e5eb2e83da889db1e4bc6dccfcaa2f0e3a07a6d136d94a841b9e9c7cf69fc5ff
Instruction Fuzzy Hash: EE31A331B18245EFDB11CF64C8819FE7BB5FF01321F158669E9A5AB195E330D940DB50

Function 2D36F48A Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 2D36F4A6
__CxxThrowException@8.LIBCMT ref: 2D36F4C3
GetLastError.KERNEL32 ref: 2D36F4E0
GetLastError.KERNEL32 ref: 2D36F509

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ErrorLast$Exception@8Throw
String ID:
API String ID: 4186728697-0
Opcode ID: b8802fde3ce81e44d273283133ad32cc34a2d45d9f1eb7038a4c731946a80b79
Instruction ID: 352c71a1269a09956156d9a3b9dc32a9c9ba3014d5c01264527b277a96f56e1a
Opcode Fuzzy Hash: b8802fde3ce81e44d273283133ad32cc34a2d45d9f1eb7038a4c731946a80b79
Instruction Fuzzy Hash: B321E735A05118BBCB129FA1CC09EDE7F7EFF05651B008060FA05E1254DB358A50EBA8

Function 2D3933F9 Relevance: 6.1, APIs: 4, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 2D393415

Part of subcall function 2D391985: __set_error_mode.LIBCMT ref: 2D391987
Part of subcall function 2D391985: __set_error_mode.LIBCMT ref: 2D391994
Part of subcall function 2D391985: __NMSG_WRITE.LIBCMT ref: 2D3919AC
Part of subcall function 2D391985: __NMSG_WRITE.LIBCMT ref: 2D3919B6

__NMSG_WRITE.LIBCMT ref: 2D39341C

Part of subcall function 2D3917DA: __set_error_mode.LIBCMT ref: 2D39180B
Part of subcall function 2D3917DA: __set_error_mode.LIBCMT ref: 2D39181C
Part of subcall function 2D3917DA: _strcpy_s.LIBCMT ref: 2D391850
Part of subcall function 2D3917DA: __invoke_watson.LIBCMT ref: 2D391861
Part of subcall function 2D3917DA: GetModuleFileNameA.KERNEL32(00000000,2D3AABB1,00000104), ref: 2D39187D
Part of subcall function 2D3917DA: _strcpy_s.LIBCMT ref: 2D391892
Part of subcall function 2D3917DA: __invoke_watson.LIBCMT ref: 2D3918A5
Part of subcall function 2D3917DA: __invoke_watson.LIBCMT ref: 2D3918E8

Part of subcall function 2D390DAB: ___crtCorExitProcess.LIBCMT ref: 2D390DB3
Part of subcall function 2D390DAB: ExitProcess.KERNEL32 ref: 2D390DBC

__malloc_crt.LIBCMT ref: 2D393443

Part of subcall function 2D395236: Sleep.KERNEL32(00000000,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D,2D3A62C8,00000008), ref: 2D395257

__lock.LIBCMT ref: 2D393460

Part of subcall function 2D392E82: __getptd_noexit.LIBCMT ref: 2D392E82

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: __set_error_mode$__invoke_watson$ExitProcess_strcpy_s$FileModuleNameSleep___crt__getptd_noexit__lock__malloc_crt
String ID:
API String ID: 3046035180-0
Opcode ID: 81ad7f97a8be10fbdf44ac9f09473db5e7103828070655728951246468e11896
Instruction ID: 7dcd23ffb2415a9ca66b6ae7131dfa7555bf4a92e72d60f7aa303cec60ecdbd9
Opcode Fuzzy Hash: 81ad7f97a8be10fbdf44ac9f09473db5e7103828070655728951246468e11896
Instruction Fuzzy Hash: A01160B660C206A9E7166F70D842AAD63A4FB61724F53C039D391BB2C0DA7445818B51

Function 2D387E7F Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000008), ref: 2D387E9A
GetModuleFileNameA.KERNEL32(?,00000000,?), ref: 2D387EAC
GetLastError.KERNEL32 ref: 2D387EB8
SetLastError.KERNEL32(00000000), ref: 2D387EC8

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ErrorLast$FileModuleName
String ID:
API String ID: 1026760046-0
Opcode ID: 89a26e8cc59f0c33defd9b3cea66c7dde511ef0d9da4d0e1cb32190f802b9d46
Instruction ID: bdac560ee3b9850e996e492404620dccd43c9f7a76c0dd502e37bffafe1310ec
Opcode Fuzzy Hash: 89a26e8cc59f0c33defd9b3cea66c7dde511ef0d9da4d0e1cb32190f802b9d46
Instruction Fuzzy Hash: D0012E72808115BBCF122B25DC05EDE3BBAEFA5360F014065F615F6292EF3089A0DBA4

Function 2D387FC9 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000008), ref: 2D387FE4
GetTempPathA.KERNEL32(?,00000000), ref: 2D387FF3
GetLastError.KERNEL32 ref: 2D387FFF
SetLastError.KERNEL32(00000000), ref: 2D38800F

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ErrorLast$PathTemp
String ID:
API String ID: 3558416190-0
Opcode ID: e556749e4208f76e2880dd34d4fa939c2dffa28094391cb9602776f76f217e07
Instruction ID: 036fbfdc808cb7554773416b0896192f64bdd8de23b017231b244a23810e2b91
Opcode Fuzzy Hash: e556749e4208f76e2880dd34d4fa939c2dffa28094391cb9602776f76f217e07
Instruction Fuzzy Hash: B201F5B2809015BBCF122B24EC05EDE3B79EF553B1F014061F619F51D2EF708A80DAA4

Function 2D397C64 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 2D397C8A

Part of subcall function 2D397AAF: __fltout2.LIBCMT ref: 2D397ADB

__cftog_l.LIBCMT ref: 2D397CB0
__cftoe_l.LIBCMT ref: 2D397CE2

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 2ef324df24ac3f8c9f3617f72cf59e807ab471f4231ba61044c9a089b628c9c0
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 1D114BB204414ABBCF125F94DC42CEE3F66BB58294F458815FF58691B0D236CAB2EF81

Function 2D385E92 Relevance: 6.0, APIs: 4, Instructions: 48fileCOMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 2D385EBB
CreateFileA.KERNEL32(2D3A94F0,C0000000,00000001,00000000,00000004,00000000,00000000,?), ref: 2D385ECF
GetLastError.KERNEL32(?,C0000000,00000001,00000000,00000004,00000000,00000000,?,2D3A1F6C), ref: 2D385EE0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 2D385F03

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: File$CreateErrorException@8LastPointerThrow
String ID:
API String ID: 588245994-0
Opcode ID: 3caa63eebaa595ec30c50f1a0df590daa26a1b61f2167b7f5c2ce57ab6d03f1e
Instruction ID: 5176cf659e1d2b3cde1f035aaf641b5502f843f98f1e53ba26b500c252f3416c
Opcode Fuzzy Hash: 3caa63eebaa595ec30c50f1a0df590daa26a1b61f2167b7f5c2ce57ab6d03f1e
Instruction Fuzzy Hash: 72019A36804744BBC720D774CC49EDF7BBCEB86B20F104299F261F21D1DB70A54586A8

Function 2D39874D Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2D398759

Part of subcall function 2D392592: __getptd_noexit.LIBCMT ref: 2D392595
Part of subcall function 2D392592: __amsg_exit.LIBCMT ref: 2D3925A2

__getptd.LIBCMT ref: 2D398770
__amsg_exit.LIBCMT ref: 2D39877E
__lock.LIBCMT ref: 2D39878E

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 03b8e0ba8ee43a43ecf1480b1e3a9b1819a43bb8209c59b989c4e17813e0c84e
Instruction ID: 348752853776b6e1bffbd35073035aac5042d28b5edcbb04378d0c7e4341011b
Opcode Fuzzy Hash: 03b8e0ba8ee43a43ecf1480b1e3a9b1819a43bb8209c59b989c4e17813e0c84e
Instruction Fuzzy Hash: B8F09A36A48A009BD351ABB4C841BDC73E0FBA0720F92CA19E691B72D0CB389940EB51

Function 2D3946B2 Relevance: 6.0, APIs: 4, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 2D3946B9
__getptd.LIBCMT ref: 2D3946BE

Part of subcall function 2D392592: __getptd_noexit.LIBCMT ref: 2D392595
Part of subcall function 2D392592: __amsg_exit.LIBCMT ref: 2D3925A2

__getptd.LIBCMT ref: 2D3946E5
__CxxThrowException@8.LIBCMT ref: 2D3946F7

Part of subcall function 2D3950A1: __decode_pointer.LIBCMT ref: 2D3950B3

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: __getptd$Exception@8H_prolog3_catchThrow__amsg_exit__decode_pointer__getptd_noexit
String ID:
API String ID: 2601141776-0
Opcode ID: 062e9d736ab92be418a01d710c2063309cb188e0219e317cb746a712188494dd
Instruction ID: 2213c1f56021a2915a735193bd01cb4bdc4afc6f549dc4cec8993696535d6a6c
Opcode Fuzzy Hash: 062e9d736ab92be418a01d710c2063309cb188e0219e317cb746a712188494dd
Instruction Fuzzy Hash: 97E086BA5086049BF704ABB1C819BDC3260EF30325F16C15993597A2D2CA708980C756

Function 2D386374 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 2D38633B: __CxxThrowException@8.LIBCMT ref: 2D38636D

__CxxThrowException@8.LIBCMT ref: 2D3863BB

Strings

' is ', xrefs: 2D38640E
OPatchInstall: Key path for component ', xrefs: 2D3863FA

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8Throw
String ID: ' is '$OPatchInstall: Key path for component '
API String ID: 2005118841-3441123739
Opcode ID: 32c317cd6431b22fe2c1ecc8bb05954c1d592e55d28e4fd1840b7705a9df0bcd
Instruction ID: f536bb82e6644bb692b002b605d36ada785119ceb16643b90827c5b75bfd991a
Opcode Fuzzy Hash: 32c317cd6431b22fe2c1ecc8bb05954c1d592e55d28e4fd1840b7705a9df0bcd
Instruction Fuzzy Hash: 42110336A086447BCB20D6A4CC80EFE777DEFB5604F468459E602F3196CB706A4587A5

Function 2D373284 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 2D3732B2
__CxxThrowException@8.LIBCMT ref: 2D3732C0

Strings

OPatchInstall: CMSIProductDetection created for ProductCode ', xrefs: 2D3732D2

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: Exception@8Throwstd::bad_exception::bad_exception
String ID: OPatchInstall: CMSIProductDetection created for ProductCode '
API String ID: 953301-272183199
Opcode ID: 0300f2fdd8ed1fb76651f2ba19ed087537551a352be9abc8d9c324664c7df499
Instruction ID: 39fdff74e050d5d384371396544156452eb85d1e2f38dffe7084e68afe995dee
Opcode Fuzzy Hash: 0300f2fdd8ed1fb76651f2ba19ed087537551a352be9abc8d9c324664c7df499
Instruction Fuzzy Hash: C6014733B1821432CB08A224DC50DEE775ADBF0924F06C12AFA26F21D6DE70A65042E8

Function 2D37EEC5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 2D37EECF

Part of subcall function 2D385E3A: WriteFile.KERNEL32(FFFFFFFF,?,?,00000000,00000000,2D3A94F0,2D3A94F0,?,2D3732DE,OPatchInstall: CMSIProductDetection created for ProductCode ',?,?,?,?), ref: 2D385E68

Part of subcall function 2D38F117: __lock.LIBCMT ref: 2D38F135
Part of subcall function 2D38F117: ___sbh_find_block.LIBCMT ref: 2D38F140
Part of subcall function 2D38F117: ___sbh_free_block.LIBCMT ref: 2D38F14F
Part of subcall function 2D38F117: RtlFreeHeap.NTDLL(00000000,?,2D3A6180,0000000C,2D392583,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C), ref: 2D38F17F
Part of subcall function 2D38F117: GetLastError.KERNEL32(?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D), ref: 2D38F190

Strings

' used incorrectly in operation ', xrefs: 2D37EF20
OPatchInstall: Property ', xrefs: 2D37EEDB

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: ErrorFileFreeH_prolog3HeapLastWrite___sbh_find_block___sbh_free_block__lock
String ID: ' used incorrectly in operation '$OPatchInstall: Property '
API String ID: 236043024-410500087
Opcode ID: 2981769a88d0904195fc9fb9f9b13e44af6af6f32e12d606bdd539c595c791b0
Instruction ID: 59bc7998d2106dddad1f9b5ccbad63a50279ee8192455ae1ab5c0401ae702489
Opcode Fuzzy Hash: 2981769a88d0904195fc9fb9f9b13e44af6af6f32e12d606bdd539c595c791b0
Instruction Fuzzy Hash: 8411A031A042199BCF29DB20CC416EC7732EFB0715F128095D205BA1E5CF305F81DB69

Function 2D36DBA2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,OPIUninitialize), ref: 2D36DBDC
FreeLibrary.KERNEL32(?), ref: 2D36DBF3

Strings

OPIUninitialize, xrefs: 2D36DBD4

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: OPIUninitialize
API String ID: 3013587201-3377397007
Opcode ID: a1b1c9f585ed1e9a311acce56c254422f4b168b4a3ac395114e206bcb2761778
Instruction ID: bc87fe015029f7b84a3fac9fab9693b0cd3663590e63a4b4c6c6d725c3e748c7
Opcode Fuzzy Hash: a1b1c9f585ed1e9a311acce56c254422f4b168b4a3ac395114e206bcb2761778
Instruction Fuzzy Hash: 7C01213190411ABFCF45EF95DC90DEE7BB9FF25204F014065E512B32A9DB309A45CBA4

Function 2D387DCB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2D387DDE
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 2D387E0C

Part of subcall function 2D38F117: __lock.LIBCMT ref: 2D38F135
Part of subcall function 2D38F117: ___sbh_find_block.LIBCMT ref: 2D38F140
Part of subcall function 2D38F117: ___sbh_free_block.LIBCMT ref: 2D38F14F
Part of subcall function 2D38F117: RtlFreeHeap.NTDLL(00000000,?,2D3A6180,0000000C,2D392583,00000000,?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C), ref: 2D38F17F
Part of subcall function 2D38F117: GetLastError.KERNEL32(?,2D395247,?,00000001,?,?,2D393448,00000018,2D3A6310,0000000C,2D3934D9,?,?,?,2D39263D,0000000D), ref: 2D38F190

Strings

D, xrefs: 2D387DEF

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: CreateErrorFreeHeapLastProcess___sbh_find_block___sbh_free_block__lock_memset
String ID: D
API String ID: 921166304-2746444292
Opcode ID: 43ab215e9b923d8c5323db930b8106a308d5411ffb6e58bd5069c850a040a846
Instruction ID: a6cd6e005921e8f7239368daf2b79ff3351ea83a4646ab733ef25dd0a302f7fd
Opcode Fuzzy Hash: 43ab215e9b923d8c5323db930b8106a308d5411ffb6e58bd5069c850a040a846
Instruction Fuzzy Hash: 2EF06D75801128ABDB209B60DC05EDEBB79EB14210F008152EA08F3280EA346E49CFA8

Function 2D394823 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 2D38F6F1: __getptd.LIBCMT ref: 2D38F6F7
Part of subcall function 2D38F6F1: __getptd.LIBCMT ref: 2D38F707

__getptd.LIBCMT ref: 2D394832

Part of subcall function 2D392592: __getptd_noexit.LIBCMT ref: 2D392595
Part of subcall function 2D392592: __amsg_exit.LIBCMT ref: 2D3925A2

__getptd.LIBCMT ref: 2D394840

Strings

csm, xrefs: 2D39484E

Memory Dump Source

Source File: 00000000.00000002.2508402933.000000002D361000.00000020.00000001.01000000.00000003.sdmp, Offset: 2D360000, based on PE: true

Associated: 00000000.00000002.2508356506.000000002D360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508451994.000000002D3A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2508490056.000000002D3AD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d360000_AccessDatabaseuser.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2ad2863a9b49dce4497e55dd7acd28658ef6168b0d44ac2102e30996a0e3f681
Instruction ID: b20028960c0681e868746c37ccc3c6e24f84a022f506111ede4afa6d1482b4e1
Opcode Fuzzy Hash: 2ad2863a9b49dce4497e55dd7acd28658ef6168b0d44ac2102e30996a0e3f681
Instruction Fuzzy Hash: E10186348087469BCB248F65C4516FCB3F5FF24331F51852DD546B62A1CB32CA91CB05

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to lowest risk score due to lack of data" ] }
Date: unknown

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AccessDatabaseuser.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\594d16.rbs

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL

Windows Analysis Report
AccessDatabaseuser.exe