Edit tour

Windows Analysis Report
EzvizStudioSetups.exe

Overview

General Information

Sample name:	EzvizStudioSetups.exe
Analysis ID:	1428616
MD5:	1c3069311cc648d664f9325cdcbf3fde
SHA1:	49e68542d9769901cd3e544389a39b22ca2d2a9f
SHA256:	8bf31bd97688fe481b0dca7b21733e04f92da65bb5d1726f9c00a22effe5bdf2
Infos:

Detection

PrivateLoader

Score:	32
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Yara detected PrivateLoader

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking mutex)

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

EzvizStudioSetups.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\EzvizStudioSetups.exe" MD5: 1C3069311CC648D664F9325CDCBF3FDE)

EzvizStudioSetups.tmp (PID: 7428 cmdline: "C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp" /SL5="$2047E,46096349,63488,C:\Users\user\Desktop\EzvizStudioSetups.exe" MD5: 3A19CEEF46D5B5A68F039F505AFB5407)

NpfDetectApp.exe (PID: 7844 cmdline: "C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe" /q MD5: 191F9AAA1C9DC443D70096D556C046BB)

update_server.exe (PID: 66392 cmdline: "C:\Program Files (x86)\Ezviz Studio\update_server.exe" /VERYSILENT MD5: 21658E7290EAEB93D83403D2E5B5F458)

update_server.tmp (PID: 66408 cmdline: "C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp" /SL5="$104C2,2352971,53760,C:\Program Files (x86)\Ezviz Studio\update_server.exe" /VERYSILENT MD5: 9D321C7096F4BCAEB6F3D8D1636E1744)

ModProperties.exe (PID: 66500 cmdline: "C:\Program Files (x86)\hicloud\update_server\ModProperties.exe" update_server MD5: B614020DF9D482886A5345B7A3A5F0E8)

startUp.exe (PID: 66508 cmdline: "C:\Program Files (x86)\hicloud\update_server\startUp.exe" MD5: 0F5FF2EEF7CCB672743BBA3A881A3A56)

SPUpDateServer.exe (PID: 7884 cmdline: "C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe" MD5: 5863EBA0EB8924542F5BD5658371ACB1)

EzvizStudio.exe (PID: 7940 cmdline: "C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe" MD5: FD309D34FEDEE887AE36EC54730C89CB)

startUp.exe (PID: 2484 cmdline: "C:\Program Files (x86)\hicloud\update_server\startUp.exe" MD5: 0F5FF2EEF7CCB672743BBA3A881A3A56)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PrivateLoader	According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://any.run/cybersecurity-blog/privateloader-analyzing-the-encryption-and-decryption-of-a-modern-loader/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem	https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Ezviz Studio\is-22416.tmp	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security

Sigma Signatures

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\hicloud\update_server\startUp.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp, ProcessId: 66408, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPUpDateServerrun

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D648D0 CryptSetProviderExA,OpenSSLDie,OpenSSLDie,CryptSignHashW,memset,EqualPrefixSid,EventAccessQuery,EventAccessRemove,	11_2_00D648D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7B0D0 SSL_CTX_flush_sessions,CRYPTO_lock,lh_doall_arg,CRYPTO_lock,	11_2_00D7B0D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D788C0 LogonUserExA,CRYPTO_malloc,ERR_put_error,memset,EVP_sha1,EVP_sha1,EVP_sha1,EVP_sha1,	11_2_00D788C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D560F0 EVP_MD_CTX_init,RSA_up_ref,ERR_put_error,DHparams_dup,ERR_put_error,BN_dup,BN_dup,DH_generate_key,EC_KEY_new_by_curve_name,ERR_put_error,EC_KEY_dup,ERR_put_error,UI_get0_user_data,X509_TRUST_get0_name,EC_KEY_generate_key,ERR_put_error,X509_TRUST_get_flags,UI_get0_user_data,X509_TRUST_get0_name,EC_GROUP_get_degree,ERR_put_error,ENGINE_get_pkey_asn1_meths,ERR_put_error,UI_get0_user_data,EC_POINT_point2oct,CRYPTO_malloc,BN_CTX_new,UI_get0_user_data,EC_POINT_point2oct,ERR_put_error,BN_CTX_free,ERR_put_error,ERR_put_error,BN_num_bits,EVP_PKEY_size,BUF_MEM_grow_clean,ERR_put_error,BN_bn2bin,memcpy,CRYPTO_free,strncpy,EVP_MD_CTX_set_flags,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,RSA_sign,ERR_put_error,EVP_MD_CTX_cleanup,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_SignFinal,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_free,BN_CTX_free,EVP_MD_CTX_cleanup,	11_2_00D560F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D780F0 SSL_new,ERR_put_error,ERR_put_error,CRYPTO_malloc,memset,OpenSSLDie,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_add_lock,CRYPTO_add_lock,BUF_memdup,BUF_memdup,CRYPTO_malloc,memcpy,SSL_free,ERR_put_error,SSL_clear,CRYPTO_new_ex_data,	11_2_00D780F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D62090 ERR_put_error,X509_NAME_ENTRY_get_object,X509_NAME_ENTRY_get_object,EVP_MD_size,OpenSSLDie,EVP_CIPHER_CTX_flags,EVP_CIPHER_CTX_flags,CRYPTO_memcmp,COMP_expand_block,RegisterEventSourceA,ERR_put_error,ERR_put_error,ERR_put_error,	11_2_00D62090
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D708A0 pqueue_size,CRYPTO_malloc,pitem_new,CredWriteW,pqueue_insert,ERR_put_error,CRYPTO_free,CRYPTO_free,WmiEnumerateGuids,CRYPTO_free,WmiEnumerateGuids,ERR_put_error,	11_2_00D708A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D51050 ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,SSL_get_ciphers,sk_dup,ERR_put_error,FreeEncryptedFileMetadata,ERR_put_error,sk_num,sk_value,sk_find,sk_delete,sk_num,sk_free,ERR_put_error,memcpy,	11_2_00D51050
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D74860 SSL_has_matching_session_id,memcpy,RemoteRegQueryInfoKeyWrapper,memset,CRYPTO_lock,lh_retrieve,CRYPTO_lock,	11_2_00D74860
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5F010 CRYPTO_free,CRYPTO_malloc,memcpy,	11_2_00D5F010
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6A810 SSL_state,CRYPTO_malloc,RAND_pseudo_bytes,ERR_put_error,CRYPTO_free,RAND_pseudo_bytes,CRYPTO_free,ERR_put_error,	11_2_00D6A810
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D77010 SSL_set_SSL_CTX,ObjectCloseAuditAlarmA,OpenSSLDie,ObjectDeleteAuditAlarmA,CRYPTO_add_lock,ObjectOpenAuditAlarmA,SSL_CTX_free,	11_2_00D77010
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D70810 CRYPTO_free,	11_2_00D70810
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D74820 SSL_set_generate_session_id,CRYPTO_lock,CRYPTO_lock,	11_2_00D74820
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D789D0 CRYPTO_add_lock,RSA_free,DH_free,EC_KEY_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_free,	11_2_00D789D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7A1D0 SSL_get1_session,CRYPTO_lock,CRYPTO_lock,	11_2_00D7A1D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D641F0 CredBackupCredentials,X509_get_pubkey,CredDeleteA,CredEncryptAndMarshalBinaryBlob,X509_certificate_type,CredEnumerateA,EVP_PKEY_free,	11_2_00D641F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D671A0 CRYPTO_free,LsaLookupPrivilegeDisplayName,	11_2_00D671A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6D1A0 X509_NAME_ENTRY_get_object,X509_NAME_ENTRY_get_object,EVP_MD_size,OpenSSLDie,pqueue_peek,X509_PURPOSE_get0_name,X509_TRUST_get0_name,__iob_func,fprintf,RAND_bytes,X509_NAME_ENTRY_get_object,X509_NAME_ENTRY_get_object,EVP_MD_size,OpenSSLDie,pqueue_peek,X509_TRUST_get_flags,X509_PURPOSE_get0_name,EVP_CIPHER_CTX_ctrl,EVP_Cipher,X509_PURPOSE_get0_name,X509_PURPOSE_get0_name,X509_NAME_ENTRY_get_object,X509_NAME_ENTRY_get_object,EVP_MD_size,CryptDuplicateKey,memmove,	11_2_00D6D1A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7B9A0 CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_mem_ctrl,sk_new,CRYPTO_malloc,COMP_zlib,CRYPTO_free,sk_push,sk_sort,CRYPTO_mem_ctrl,CRYPTO_lock,CRYPTO_lock,	11_2_00D7B9A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D78950 X509_free,EVP_PKEY_free,sk_pop_free,CRYPTO_free,	11_2_00D78950
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7B150 SSL_CTX_add_session,CRYPTO_add_lock,CRYPTO_lock,lh_insert,SSL_SESSION_free,SSL_SESSION_free,SSL_CTX_ctrl,SSL_CTX_ctrl,SSL_CTX_ctrl,lh_retrieve,lh_delete,SSL_SESSION_free,SSL_CTX_ctrl,SSL_CTX_ctrl,CRYPTO_lock,	11_2_00D7B150
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D76140 CRYPTO_free,CRYPTO_free,GetFileSecurityA,	11_2_00D76140
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D76170 SSL_CTX_free,CRYPTO_add_lock,X509_VERIFY_PARAM_free,SSL_CTX_flush_sessions,CRYPTO_free_ex_data,lh_free,X509_STORE_free,sk_free,sk_free,sk_pop_free,sk_pop_free,sk_free,CRYPTO_free,SSL_CTX_SRP_CTX_free,ENGINE_finish,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_00D76170
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6C960 CRYPTO_malloc,EVP_CIPHER_CTX_init,COMP_CTX_free,COMP_CTX_new,CRYPTO_malloc,SaferSetLevelInformation,EVP_CIPHER_CTX_new,EVP_MD_CTX_create,COMP_CTX_free,COMP_CTX_new,EVP_CIPHER_CTX_cleanup,UI_get0_user_data,X509_PURPOSE_get0_name,X509_TRUST_get0_name,memcpy,X509_PURPOSE_get0_name,EVP_PKEY_new_mac_key,EVP_DigestSignInit,EVP_PKEY_free,UI_get0_user_data,X509_PURPOSE_get0_name,EVP_CipherInit_ex,EVP_CIPHER_CTX_ctrl,EVP_CipherInit_ex,X509_PURPOSE_get0_name,EVP_CIPHER_CTX_ctrl,ERR_put_error,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,	11_2_00D6C960
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D51910 RAND_pseudo_bytes,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,d2i_X509,sk_new_null,sk_push,EVP_MD_CTX_init,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,i2d_X509,CRYPTO_malloc,i2d_X509,EVP_DigestUpdate,CRYPTO_free,CRYPTO_free,X509_get_pubkey,EVP_VerifyFinal,EVP_PKEY_free,EVP_MD_CTX_cleanup,X509_free,CRYPTO_add_lock,ERR_put_error,sk_free,X509_free,	11_2_00D51910
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5A910 SSL_CTX_remove_session,SSL_SESSION_free,ERR_put_error,CRYPTO_free,CRYPTO_malloc,ERR_put_error,memcpy,EVP_sha256,EVP_Digest,	11_2_00D5A910
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D83930 SSL_shutdown,SSL_set_connect_state,SSL_set_accept_state,SSL_clear,BIO_ctrl,BIO_ctrl,SSL_set_connect_state,SSL_set_accept_state,_time64,SSL_get_rbio,BIO_push,CRYPTO_add_lock,BIO_ctrl,SSL_pending,BIO_ctrl,BIO_clear_flags,BIO_ctrl,BIO_copy_next_retry,SSL_set_bio,CRYPTO_add_lock,BIO_free_all,CRYPTO_add_lock,BIO_clear_flags,SSL_do_handshake,SSL_get_error,BIO_set_flags,BIO_set_flags,BIO_set_flags,SSL_free,SSL_dup,BIO_ctrl,SSL_get_info_callback,BIO_ctrl,	11_2_00D83930
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D73120 SSL_state,CRYPTO_malloc,RAND_pseudo_bytes,RAND_pseudo_bytes,CRYPTO_free,ERR_put_error,	11_2_00D73120
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D772D0 SSL_CTX_get_ex_data,CRYPTO_get_ex_data,	11_2_00D772D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D772C0 SSL_CTX_set_ex_data,CRYPTO_set_ex_data,	11_2_00D772C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D812C0 d2i_SSL_SESSION,SSL_SESSION_new,asn1_GetSequence,d2i_ASN1_INTEGER,CRYPTO_free,d2i_ASN1_INTEGER,ASN1_INTEGER_get,CRYPTO_free,d2i_ASN1_OCTET_STRING,d2i_ASN1_OCTET_STRING,OpenSSLDie,memcpy,d2i_ASN1_OCTET_STRING,memcpy,d2i_ASN1_OCTET_STRING,memcpy,CRYPTO_free,ASN1_get_object,d2i_ASN1_INTEGER,ASN1_const_check_infinite_end,ASN1_INTEGER_get,CRYPTO_free,_time64,ASN1_get_object,d2i_ASN1_INTEGER,ASN1_const_check_infinite_end,ASN1_INTEGER_get,CRYPTO_free,X509_free,ASN1_get_object,d2i_X509,ASN1_const_check_infinite_end,ASN1_get_object,d2i_ASN1_OCTET_STRING,ASN1_const_check_infinite_end,memcpy,CRYPTO_free,ASN1_get_object,d2i_ASN1_INTEGER,ASN1_const_check_infinite_end,ASN1_INTEGER_get,CRYPTO_free,ASN1_get_object,d2i_ASN1_OCTET_STRING,ASN1_const_check_infinite_end,BUF_strndup,CRYPTO_free,ASN1_get_object,d2i_ASN1_OCTET_STRING,ASN1_const_check_infinite_end,BUF_strndup,CRYPTO_free,ASN1_get_object,d2i_ASN1_OCTET_STRING,ASN1_const_check_infinite_end,BUF_strndup,CRYPTO_free,ASN1_get_object,d2i_ASN1_INTEGER,ASN1_const_check_infinite_end,ASN1_INTEGER_get,CRYPTO_free,ASN1_get_object,d2i_ASN1_OCTET_STRING,ASN1_const_check_infinite_end,ASN1_get_object,d2i_ASN1_OCTET_STRING,ASN1_const_check_infinite_end,CRYPTO_free,ASN1_get_object,d2i_ASN1_OCTET_STRING,ASN1_const_check_infinite_end,BUF_strndup,CRYPTO_free,asn1_const_Finish,ERR_put_error,asn1_add_error,SSL_SESSION_free,	11_2_00D812C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D532F0 X509_get_pubkey,ElfRegisterEventSourceA,RSA_public_encrypt,ERR_put_error,EVP_PKEY_free,ERR_put_error,	11_2_00D532F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D63AF0 SetUserFileEncryptionKeyEx,UsePinForEncryptedFilesA,	11_2_00D63AF0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6A2E0 CRYPTO_free,CRYPTO_malloc,	11_2_00D6A2E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7A290 SSL_SESSION_new,CRYPTO_malloc,ERR_put_error,memset,_time64,CRYPTO_new_ex_data,	11_2_00D7A290
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D77290 SSL_CTX_get_ex_new_index,CRYPTO_get_ex_new_index,	11_2_00D77290
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7F290 X509_check_private_key,ClearEventLogA,X509_check_private_key,ERR_clear_error,CredBackupCredentials,ERR_put_error,X509_get_pubkey,EVP_PKEY_copy_parameters,EVP_PKEY_free,ERR_clear_error,RSA_flags,X509_check_private_key,X509_free,EVP_PKEY_free,CRYPTO_add_lock,	11_2_00D7F290
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D77A80 SSL_CTX_new,ERR_put_error,SSL_get_ex_data_X509_STORE_CTX_idx,ERR_put_error,CRYPTO_malloc,memset,memset,LogonUserExA,lh_new,X509_STORE_new,sk_num,X509_VERIFY_PARAM_new,EVP_get_digestbyname,EVP_get_digestbyname,EVP_get_digestbyname,sk_new_null,CRYPTO_new_ex_data,SSL_COMP_get_compression_methods,RAND_pseudo_bytes,RAND_bytes,RAND_bytes,SSL_CTX_SRP_CTX_init,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,ERR_put_error,SSL_CTX_free,	11_2_00D77A80
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D712B0 pqueue_peek,pqueue_peek,pqueue_pop,CRYPTO_free,WmiEnumerateGuids,pqueue_peek,	11_2_00D712B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7A250 SSL_SESSION_set_ex_data,CRYPTO_set_ex_data,	11_2_00D7A250
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D77250 SSL_set_ex_data,CRYPTO_set_ex_data,	11_2_00D77250
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D70A50 ConvertAccessToSecurityDescriptorA,X509_NAME_ENTRY_get_object,X509_NAME_ENTRY_get_object,EVP_MD_size,OpenSSLDie,EVP_CIPHER_CTX_flags,EVP_CIPHER_CTX_flags,CRYPTO_memcmp,GetAccessPermissionsForObjectA,ERR_put_error,	11_2_00D70A50
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D63240 AddUsersToEncryptedFileEx,CredUnmarshalCredentialW,X509_NAME_ENTRY_get_object,X509_NAME_ENTRY_get_object,EVP_MD_size,DecryptFileW,EVP_CIPHER_CTX_flags,DuplicateEncryptionInfoFile,X509_get_issuer_name,ERR_put_error,EncryptFileA,BIO_ctrl,	11_2_00D63240
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7A270 SSL_SESSION_get_ex_data,CRYPTO_get_ex_data,	11_2_00D7A270
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D77270 SSL_get_ex_data,CRYPTO_get_ex_data,	11_2_00D77270
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D69230 CRYPTO_free,CRYPTO_malloc,memcpy,	11_2_00D69230
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D77220 SSL_get_ex_new_index,CRYPTO_get_ex_new_index,	11_2_00D77220
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7A220 SSL_SESSION_get_ex_new_index,CRYPTO_get_ex_new_index,	11_2_00D7A220
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D69BD0 ERR_put_error,CRYPTO_free,	11_2_00D69BD0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6E3C0 SSL_extension_supported,CRYPTO_realloc,	11_2_00D6E3C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D72BC0 OpenSSLDie,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,memcpy,OpenSSLDie,pitem_new,pqueue_insert,	11_2_00D72BC0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D643F0 CRYPTO_lock,CredProfileUnloaded,CredProtectA,CRYPTO_lock,CRYPTO_free,	11_2_00D643F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D773F0 SSL_CTX_use_psk_identity_hint,ERR_put_error,CRYPTO_free,BUF_strdup,	11_2_00D773F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D723F0 EVP_CIPHER_CTX_free,EVP_MD_CTX_destroy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_00D723F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7A3E0 SSL_SESSION_free,CRYPTO_add_lock,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,	11_2_00D7A3E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D833E0 SSL_CONF_CTX_free,CRYPTO_free,CRYPTO_free,	11_2_00D833E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D543B0 CRYPTO_malloc,memset,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_00D543B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D713B0 pqueue_pop,CRYPTO_free,WmiEnumerateGuids,GetOverlappedAccessResults,GetSecurityInfoExA,SSL_state,	11_2_00D713B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D543BF memset,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_00D543BF
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D533A0 ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,sk_set_cmp_func,SSL_get_ciphers,sk_set_cmp_func,sk_num,sk_value,sk_find,sk_num,sk_num,ERR_put_error,sk_value,CRYPTO_add_lock,ERR_put_error,memcpy,ERR_put_error,	11_2_00D533A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D833A0 SSL_CONF_CTX_new,CRYPTO_malloc,	11_2_00D833A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7DB50 SSL_COMP_add_compression_method,CRYPTO_mem_ctrl,CRYPTO_malloc,sk_find,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,sk_push,CRYPTO_mem_ctrl,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,	11_2_00D7DB50
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D72350 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memset,	11_2_00D72350
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5AB40 CRYPTO_free,BUF_memdup,ERR_put_error,	11_2_00D5AB40
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D64360 CredIsProtectedA,CRYPTO_lock,CRYPTO_lock,CRYPTO_malloc,CredProfileLoadedEx,	11_2_00D64360
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6AB10 CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_00D6AB10
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D75B00 sk_zero,CRYPTO_free,BUF_memdup,sk_new_null,ERR_put_error,QueryServiceLockStatusW,sk_push,ERR_put_error,ERR_put_error,ERR_put_error,sk_free,	11_2_00D75B00
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D76B00 SSL_CTX_add_session,CRYPTO_add_lock,SSL_SESSION_free,_time64,SSL_CTX_flush_sessions,	11_2_00D76B00
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7AB00 CRYPTO_malloc,CRYPTO_add_lock,CRYPTO_add_lock,BUF_strdup,BUF_strdup,sk_dup,CRYPTO_dup_ex_data,BUF_strdup,BUF_memdup,BUF_memdup,BUF_memdup,BUF_strdup,ERR_put_error,SSL_SESSION_free,	11_2_00D7AB00
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7B320 abort,memcpy,CRYPTO_lock,lh_retrieve,CRYPTO_add_lock,CRYPTO_lock,CRYPTO_add_lock,SSL_CTX_add_session,ERR_put_error,_time64,SSL_CTX_remove_session,SSL_SESSION_free,SSL_SESSION_free,	11_2_00D7B320
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D58CC0 ERR_put_error,CRYPTO_malloc,ERR_put_error,memcpy,	11_2_00D58CC0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5D4C0 ERR_put_error,ERR_put_error,sk_new,CRYPTO_free,CRYPTO_malloc,memcpy,ERR_put_error,PerfEnumerateCounterSetInstances,ERR_put_error,ERR_put_error,ERR_put_error,d2i_X509_NAME,sk_push,sk_pop_free,ERR_put_error,ERR_clear_error,ERR_put_error,ERR_put_error,ERR_put_error,sk_pop_free,	11_2_00D5D4C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D54CF0 RegConnectRegistryW,SSL_state,RegConnectRegistryExW,SetLastError,AuditQuerySystemPolicy,AuditQueryPerUserPolicy,MakeAbsoluteSD,X509_NAME_ENTRY_get_object,EVP_MD_size,OpenSSLDie,SetSecurityDescriptorGroup,CRYPTO_memcmp,X509_get_serialNumber,memcpy,ERR_put_error,	11_2_00D54CF0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6B4E0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_malloc,memcpy,strncmp,CRYPTO_malloc,memcpy,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,d2i_OCSP_RESPID,sk_new_null,sk_push,sk_pop_free,d2i_X509_EXTENSIONS,SSL_get_srtp_profiles,CRYPTO_free,OCSP_RESPID_free,OCSP_RESPID_free,SaferiIsDllAllowed,OCSP_RESPID_free,ERR_put_error,	11_2_00D6B4E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7CCE0 CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,CRYPTO_free,ERR_put_error,strncmp,CRYPTO_free,CRYPTO_free,sk_new_null,CRYPTO_free,sk_push,CRYPTO_free,sk_dup,sk_free,sk_free,sk_free,sk_set_cmp_func,sk_sort,	11_2_00D7CCE0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D54490 EnableTrace,ERR_put_error,CRYPTO_malloc,EVP_CIPHER_CTX_init,CRYPTO_malloc,ERR_put_error,EVP_CIPHER_CTX_init,OpenSSLDie,OpenSSLDie,GetSecurityDescriptorSacl,EVP_EncryptInit_ex,EVP_DecryptInit_ex,	11_2_00D54490
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D77480 SSL_use_psk_identity_hint,ERR_put_error,CRYPTO_free,BUF_strdup,	11_2_00D77480
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D79C80 CRYPTO_malloc,ERR_put_error,memset,RSA_up_ref,DHparams_dup,ERR_put_error,BN_dup,ERR_put_error,BN_dup,EC_KEY_dup,ERR_put_error,CRYPTO_add_lock,CRYPTO_add_lock,X509_chain_up_ref,CRYPTO_malloc,memcpy,EVP_sha1,EVP_sha1,EVP_sha1,EVP_sha1,CRYPTO_malloc,memcpy,ERR_put_error,ERR_put_error,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,CRYPTO_add_lock,CRYPTO_add_lock,RSA_free,DH_free,EC_KEY_free,	11_2_00D79C80
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7D4B0 SSL_CIPHER_description,CRYPTO_malloc,BIO_snprintf,	11_2_00D7D4B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D784B0 SSL_dup,SSL_new,SSL_copy_session_id,SSL_set_session_id_context,X509_VERIFY_PARAM_get_depth,X509_VERIFY_PARAM_set_depth,CRYPTO_dup_ex_data,BIO_ctrl,BIO_ctrl,X509_VERIFY_PARAM_inherit,sk_dup,sk_dup,sk_dup,sk_num,sk_value,X509_NAME_dup,sk_set,sk_num,X509_NAME_free,SSL_free,	11_2_00D784B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D60C50 OPENSSL_cleanse,CRYPTO_free,	11_2_00D60C50
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6FC40 CRYPTO_malloc,memset,pqueue_new,pqueue_new,pqueue_new,pqueue_new,pqueue_new,FreeInheritedFromArray,pqueue_free,pqueue_free,pqueue_free,pqueue_free,pqueue_free,CRYPTO_free,	11_2_00D6FC40
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D78C70 GetStringConditionFromBinary,sk_new_null,sk_push,CRYPTO_add_lock,	11_2_00D78C70
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5A460 sk_new_null,ERR_put_error,d2i_X509,sk_push,CredFindBestCredentialW,ERR_put_error,ERR_clear_error,sk_value,PerfQueryCounterSetRegistrationInfo,X509_get_pubkey,CredBackupCredentials,EVP_PKEY_missing_parameters,ERR_put_error,CRYPTO_add_lock,X509_free,X509_free,CRYPTO_add_lock,X509_free,EVP_PKEY_free,X509_free,sk_pop_free,	11_2_00D5A460
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6A410 CRYPTO_free,CRYPTO_malloc,memcpy,	11_2_00D6A410
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D69430 CRYPTO_free,CRYPTO_free,CRYPTO_malloc,memcpy,SSL_ctrl,CRYPTO_malloc,memcpy,CRYPTO_free,CRYPTO_malloc,memcpy,BUF_strdup,ERR_put_error,	11_2_00D69430
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D83430 SSL_CONF_CTX_set1_prefix,BUF_strdup,CRYPTO_free,	11_2_00D83430
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6DC20 CRYPTO_malloc,CRYPTO_malloc,ERR_put_error,memcpy,memcpy,ERR_put_error,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	11_2_00D6DC20
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D79C20 X509_STORE_free,CRYPTO_add_lock,	11_2_00D79C20
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D635D0 OpenSSLDie,SSL_state,ERR_put_error,ERR_put_error,FreeEncryptionCertificateHashList,CredUnmarshalCredentialW,X509_NAME_ENTRY_get_object,X509_NAME_ENTRY_get_object,EVP_MD_size,EVP_CIPHER_CTX_flags,X509_get_issuer_name,ERR_put_error,memcpy,QueryUsersOnEncryptedFile,	11_2_00D635D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D72DC0 pqueue_pop,EVP_CIPHER_CTX_free,EVP_MD_CTX_destroy,CRYPTO_free,CRYPTO_free,CRYPTO_free,WmiEnumerateGuids,pqueue_pop,	11_2_00D72DC0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D78DF0 CRYPTO_malloc,ERR_put_error,memset,	11_2_00D78DF0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D52DF2 ERR_put_error,ERR_put_error,CRYPTO_memcmp,ERR_put_error,	11_2_00D52DF2
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6FD90 pqueue_pop,GetAuditedPermissionsFromAclW,CRYPTO_free,CRYPTO_free,WmiEnumerateGuids,pqueue_pop,pqueue_pop,GetEffectiveRightsFromAclA,CRYPTO_free,CRYPTO_free,WmiEnumerateGuids,pqueue_pop,pqueue_pop,GetEffectiveRightsFromAclW,WmiEnumerateGuids,pqueue_pop,pqueue_pop,WmiEnumerateGuids,pqueue_pop,pqueue_pop,GetInheritanceSourceW,CRYPTO_free,CRYPTO_free,WmiEnumerateGuids,pqueue_pop,	11_2_00D6FD90
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D83590 SSL_shutdown,SSL_free,CRYPTO_free,	11_2_00D83590
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7C5B0 CRYPTO_malloc,ERR_put_error,memset,CRYPTO_free,	11_2_00D7C5B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D76D50 EVP_CIPHER_CTX_cleanup,CRYPTO_free,EVP_CIPHER_CTX_cleanup,CRYPTO_free,COMP_CTX_free,COMP_CTX_free,	11_2_00D76D50
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7AD50 SSL_SESSION_new,SSL_get_default_timeout,SSL_SESSION_free,CRYPTO_lock,CRYPTO_lock,memset,SSL_has_matching_session_id,BUF_strdup,ERR_put_error,SSL_SESSION_free,memcpy,	11_2_00D7AD50
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D84540 SSL_CTX_SRP_CTX_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	11_2_00D84540
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5AD70 ERR_put_error,X509_get_pubkey,EVP_PKEY_free,RAND_bytes,RSA_public_encrypt,ERR_put_error,OPENSSL_cleanse,EVP_PKEY_get1_DH,DHparams_dup,ERR_put_error,DH_generate_key,ERR_put_error,DH_free,DH_compute_key,DH_free,ERR_put_error,DH_free,memset,DH_free,BN_num_bits,BN_bn2bin,DH_free,X509_get_pubkey,X509_TRUST_get_flags,UI_get0_user_data,EC_KEY_new,ERR_put_error,EC_KEY_set_group,ERR_put_error,EC_KEY_generate_key,ERR_put_error,EC_GROUP_get_degree,ERR_put_error,ECDH_compute_key,ERR_put_error,memset,UI_get0_user_data,EC_POINT_point2oct,CRYPTO_malloc,BN_CTX_new,UI_get0_user_data,EC_POINT_point2oct,memcpy,BN_CTX_free,CRYPTO_free,EC_KEY_free,EVP_PKEY_free,ERR_put_error,ERR_put_error,X509_get_pubkey,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,RAND_bytes,EVP_PKEY_CTX_free,EVP_PKEY_derive_set_peer,ERR_clear_error,EVP_MD_CTX_create,OBJ_nid2sn,EVP_get_digestbyname,WmiDevInstToInstanceNameW,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_destroy,EVP_PKEY_CTX_ctrl,ERR_put_error,EVP_PKEY_encrypt,ERR_put_error,memcpy,EVP_PKEY_CTX_ctrl,EVP_PKEY_CTX_free,EVP_PKEY_free,BN_num_bits,BN_bn2bin,CRYPTO_free,BUF_strdup,ERR_put_error,SRP_generate_client_master_secret,ERR_put_error,memset,ERR_put_error,ERR_put_error,memmove,memset,CRYPTO_free,BUF_strdup,ERR_put_error,CRYPTO_free,BUF_strdup,ERR_put_error,memcpy,OPENSSL_cleanse,OPENSSL_cleanse,ERR_put_error,BN_CTX_free,CRYPTO_free,EC_KEY_free,EVP_PKEY_free,	11_2_00D5AD70
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5C570 EVP_MD_CTX_init,ERR_put_error,CRYPTO_free,RSA_free,DH_free,EC_KEY_free,BUF_strndup,ERR_put_error,BN_bin2bn,ERR_put_error,BN_bin2bn,BN_bin2bn,BN_bin2bn,X509_get_pubkey,RSA_new,ERR_put_error,BN_bin2bn,BN_bin2bn,X509_get_pubkey,EVP_PKEY_bits,ERR_put_error,DH_new,ERR_put_error,BN_bin2bn,BN_bin2bn,BN_bin2bn,X509_get_pubkey,EC_KEY_new,ERR_put_error,LsaLookupPrivilegeName,EC_GROUP_new_by_curve_name,ERR_put_error,EC_KEY_set_group,ERR_put_error,EC_GROUP_free,X509_TRUST_get_flags,EC_GROUP_get_degree,EC_POINT_new,BN_CTX_new,EC_POINT_oct2point,X509_get_pubkey,EC_KEY_set_public_key,BN_CTX_free,EC_POINT_free,ERR_put_error,EVP_sha1,EVP_PKEY_size,EVP_MD_CTX_set_flags,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,RSA_verify,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_VerifyFinal,EVP_PKEY_free,EVP_MD_CTX_cleanup,ERR_put_error,EVP_PKEY_free,RSA_free,DH_free,BN_CTX_free,EC_POINT_free,EC_KEY_free,EVP_MD_CTX_cleanup,	11_2_00D5C570
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D79510 SSL_add_dir_cert_subjects_to_stack,CRYPTO_lock,OPENSSL_DIR_read,BIO_snprintf,SSL_add_file_cert_subjects_to_stack,OPENSSL_DIR_read,_errno,GetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,ERR_put_error,OPENSSL_DIR_end,CRYPTO_lock,	11_2_00D79510
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D63D00 AccessCheckByType,CRYPTO_memcmp,ERR_put_error,OpenSSLDie,memcpy,OpenSSLDie,memcpy,	11_2_00D63D00
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7A530 SSL_set_session,ERR_put_error,SSL_set_ssl_method,CRYPTO_add_lock,SSL_SESSION_free,SSL_SESSION_free,SSL_set_ssl_method,	11_2_00D7A530
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D83530 CRYPTO_malloc,ERR_put_error,	11_2_00D83530
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6153A ConvertSidToStringSidA,ERR_put_error,EVP_MD_size,UI_get0_user_data,X509_TRUST_get0_name,CRYPTO_malloc,ERR_put_error,	11_2_00D6153A
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7FD20 SSL_CTX_use_serverinfo,CRYPTO_realloc,ElfOldestRecord,memcpy,ERR_put_error,ERR_put_error,	11_2_00D7FD20
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D84D20 SRP_generate_server_master_secret,SRP_Verify_A_mod_N,SRP_Calc_u,SRP_Calc_server_key,BN_num_bits,CRYPTO_malloc,BN_bn2bin,OPENSSL_cleanse,CRYPTO_free,WmiDevInstToInstanceNameA,WmiDevInstToInstanceNameA,	11_2_00D84D20
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D56ED0 RAND_pseudo_bytes,RSA_private_decrypt,ERR_clear_error,OPENSSL_cleanse,ERR_put_error,X509_get_pubkey,EVP_PKEY_cmp_parameters,EVP_PKEY_get1_DH,EVP_PKEY_free,BN_bin2bn,ERR_put_error,DH_compute_key,ERR_put_error,WmiDevInstToInstanceNameA,DH_free,DH_free,WmiDevInstToInstanceNameA,OPENSSL_cleanse,EC_KEY_new,ERR_put_error,X509_TRUST_get_flags,X509_TRUST_get0_name,EC_KEY_set_group,EC_KEY_set_private_key,EC_POINT_new,X509_get_pubkey,UI_get0_user_data,EC_POINT_copy,ERR_put_error,BN_CTX_new,ERR_put_error,EC_POINT_oct2point,ERR_put_error,EC_GROUP_get_degree,ERR_put_error,ECDH_compute_key,ERR_put_error,EVP_PKEY_free,EC_POINT_free,EC_KEY_free,BN_CTX_free,EC_KEY_free,OPENSSL_cleanse,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,memcpy,memset,OPENSSL_cleanse,ERR_put_error,ERR_put_error,memmove,memset,CRYPTO_free,BUF_strndup,ERR_put_error,CRYPTO_free,BUF_strdup,OPENSSL_cleanse,BN_bin2bn,ERR_put_error,BN_ucmp,CRYPTO_free,BUF_strdup,SRP_generate_server_master_secret,ERR_put_error,EVP_PKEY_CTX_new,EVP_PKEY_decrypt_init,X509_get_pubkey,EVP_PKEY_derive_set_peer,ERR_clear_error,ASN1_get_object,EVP_PKEY_decrypt,OPENSSL_cleanse,EVP_PKEY_CTX_ctrl,ERR_put_error,EVP_PKEY_free,EVP_PKEY_CTX_free,ERR_put_error,EVP_PKEY_free,EC_POINT_free,EC_KEY_free,BN_CTX_free,	11_2_00D56ED0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D646D0 CryptDuplicateHash,	11_2_00D646D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5E6E0 CredpDecodeCredential,CRYPTO_free,DH_free,EC_KEY_free,sk_pop_free,BIO_free,CRYPTO_free,SSL_SRP_CTX_free,OPENSSL_cleanse,CRYPTO_free,	11_2_00D5E6E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6B698 CRYPTO_malloc,memcpy,	11_2_00D6B698
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6A6B0 CRYPTO_malloc,memcpy,RAND_pseudo_bytes,CRYPTO_free,CRYPTO_free,	11_2_00D6A6B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D546A0 CryptGenKey,EVP_Cipher,	11_2_00D546A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D74EA0 SSL_copy_session_id,SSL_get_session,SSL_set_session,RegSetValueA,CRYPTO_add_lock,ERR_put_error,memcpy,	11_2_00D74EA0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D60E50 EVP_MD_CTX_destroy,CRYPTO_free,	11_2_00D60E50
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7FE50 SSL_CTX_use_serverinfo_file,BIO_s_file,BIO_new,BIO_ctrl,PEM_read_bio,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,SSL_CTX_use_serverinfo,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	11_2_00D7FE50
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5E670 CRYPTO_malloc,memset,SSL_SRP_CTX_init,	11_2_00D5E670
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D60E66 EVP_MD_CTX_destroy,CRYPTO_free,	11_2_00D60E66
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D78E60 CRYPTO_add_lock,sk_pop_free,X509_free,RSA_free,DH_free,EC_KEY_free,CRYPTO_free,	11_2_00D78E60
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D71660 CredWriteW,ERR_put_error,SSL_state,GetSecurityInfoExW,pqueue_pop,CRYPTO_free,WmiEnumerateGuids,BuildTrusteeWithNameA,GetSecurityInfoExW,SSL_get_rbio,BIO_clear_flags,BIO_set_flags,SSL_state,SSL_get_rbio,SetNamedSecurityInfoExA,ERR_put_error,ERR_put_error,SSL_state,memcpy,SSL_get_rbio,BIO_clear_flags,SSL_get_rbio,BIO_set_flags,ERR_put_error,SetNamedSecurityInfoExW,ERR_put_error,BIO_snprintf,ERR_add_error_data,SSL_CTX_remove_session,ERR_put_error,ERR_put_error,	11_2_00D71660
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D51E10 ERR_put_error,RSA_private_decrypt,ERR_put_error,ERR_put_error,	11_2_00D51E10
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D69E10 HMAC_CTX_init,EVP_CIPHER_CTX_init,EVP_sha256,HMAC_Init_ex,EVP_aes_128_cbc,EVP_DecryptInit_ex,EVP_MD_size,EVP_CIPHER_CTX_cleanup,HMAC_Update,HMAC_Final,HMAC_CTX_cleanup,CRYPTO_memcmp,EVP_CIPHER_CTX_cleanup,X509_get_issuer_name,X509_get_issuer_name,CRYPTO_malloc,EVP_CIPHER_CTX_cleanup,EVP_DecryptUpdate,EVP_DecryptFinal,EVP_CIPHER_CTX_cleanup,CRYPTO_free,EVP_CIPHER_CTX_cleanup,d2i_SSL_SESSION,CRYPTO_free,memcpy,ERR_clear_error,	11_2_00D69E10
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7F600 X509_get_pubkey,ERR_put_error,CredBackupCredentials,OpenEventLogA,ERR_put_error,EVP_PKEY_free,EVP_PKEY_copy_parameters,ERR_clear_error,RSA_flags,X509_check_private_key,ReadEventLogA,EVP_PKEY_free,ERR_clear_error,EVP_PKEY_free,X509_free,CRYPTO_add_lock,	11_2_00D7F600
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D74E30 SSL_get_peer_certificate,CRYPTO_add_lock,RegSaveKeyW,	11_2_00D74E30
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D72630 pqueue_find,TrusteeAccessToObjectW,OpenSSLDie,CRYPTO_free,pitem_new,pqueue_insert,OpenSSLDie,	11_2_00D72630
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D84E30 SRP_generate_client_master_secret,SRP_Verify_B_mod_N,SRP_Calc_u,SRP_Calc_x,SRP_Calc_client_key,BN_num_bits,CRYPTO_malloc,BN_bn2bin,OPENSSL_cleanse,CRYPTO_free,WmiDevInstToInstanceNameA,WmiDevInstToInstanceNameA,OPENSSL_cleanse,CRYPTO_free,WmiDevInstToInstanceNameA,	11_2_00D84E30
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D84630 SSL_SRP_CTX_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	11_2_00D84630
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D777C0 SSL_free,CRYPTO_add_lock,X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,sk_free,sk_free,SSL_SESSION_free,EVP_MD_CTX_destroy,EVP_MD_CTX_destroy,CRYPTO_free,SSL_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,sk_pop_free,sk_pop_free,CRYPTO_free,CRYPTO_free,sk_pop_free,SSL_CTX_free,CRYPTO_free,sk_free,CRYPTO_free,	11_2_00D777C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5FFF6 CRYPTO_free,BUF_strdup,	11_2_00D5FFF6
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D5E7F0 sk_pop_free,CRYPTO_free,DH_free,EC_KEY_free,BIO_free,CRYPTO_free,memset,CRYPTO_free,	11_2_00D5E7F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D747E0 SSL_CTX_set_generate_session_id,CRYPTO_lock,CRYPTO_lock,	11_2_00D747E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D60790 OpenSSLDie,CRYPTO_malloc,EVP_CIPHER_CTX_init,COMP_CTX_free,COMP_CTX_new,CRYPTO_malloc,CRYPTO_malloc,EVP_CIPHER_CTX_init,COMP_CTX_free,COMP_CTX_new,EVP_CIPHER_CTX_cleanup,EVP_MD_size,UI_get0_user_data,X509_TRUST_get0_name,ERR_put_error,EVP_MD_CTX_init,memcpy,EVP_md5,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_md5,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_CipherInit_ex,OPENSSL_cleanse,OPENSSL_cleanse,EVP_MD_CTX_cleanup,	11_2_00D60790
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6CF90 ERR_put_error,UI_get0_user_data,X509_TRUST_get0_name,CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,	11_2_00D6CF90
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7A780 SSL_set_session_ticket_ext,CRYPTO_free,CRYPTO_malloc,ERR_put_error,memcpy,	11_2_00D7A780
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D75F80 SSL_set_alpn_protos,CRYPTO_free,CRYPTO_malloc,memcpy,	11_2_00D75F80
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D7AFB0 CRYPTO_lock,lh_retrieve,lh_delete,CRYPTO_lock,SSL_SESSION_free,	11_2_00D7AFB0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D53FA0 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,	11_2_00D53FA0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D72FA0 CRYPTO_malloc,memcpy,RAND_pseudo_bytes,CRYPTO_free,CRYPTO_free,	11_2_00D72FA0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D67F50 SSL_get_ciphers,sk_num,sk_value,LsaCreateTrustedDomainEx,sk_num,memcpy,ERR_put_error,LsaEnumerateTrustedDomainsEx,LsaManageSidNameMapping,memcpy,memcpy,LsaQueryDomainInformationPolicy,memcpy,SSL_ctrl,memcpy,CRYPTO_malloc,memcpy,memcpy,sk_num,sk_value,i2d_OCSP_RESPID,sk_num,i2d_X509_EXTENSIONS,sk_num,sk_value,i2d_OCSP_RESPID,sk_num,i2d_X509_EXTENSIONS,memcpy,SSL_get_srtp_profiles,memset,	11_2_00D67F50
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D64740 CryptDuplicateKey,CryptEncrypt,CryptEnumProviderTypesW,CRYPTO_memcmp,X509_PURPOSE_get0_name,CryptGetUserKey,	11_2_00D64740
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D67770 LsaRemovePrivilegesFromAccount,CRYPTO_malloc,LsaRemovePrivilegesFromAccount,CRYPTO_free,CRYPTO_free,	11_2_00D67770
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D78770 SSL_get_ex_data_X509_STORE_CTX_idx,LogonUserA,CRYPTO_lock,X509_STORE_CTX_get_ex_new_index,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,X509_STORE_CTX_get_ex_new_index,CRYPTO_lock,CRYPTO_lock,	11_2_00D78770
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6BF60 CRYPTO_free,ERR_put_error,ERR_put_error,	11_2_00D6BF60
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D78760 ERR_load_crypto_strings,	11_2_00D78760
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6FF10 pqueue_free,pqueue_free,pqueue_free,pqueue_free,pqueue_free,CRYPTO_free,	11_2_00D6FF10
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D58720 i2d_SSL_SESSION,CRYPTO_malloc,EVP_CIPHER_CTX_init,HMAC_CTX_init,i2d_SSL_SESSION,d2i_SSL_SESSION,i2d_SSL_SESSION,i2d_SSL_SESSION,SSL_SESSION_free,BUF_MEM_grow,RAND_bytes,EVP_aes_128_cbc,EVP_EncryptInit_ex,EVP_sha256,HMAC_Init_ex,X509_get_issuer_name,memcpy,X509_get_issuer_name,EVP_EncryptUpdate,EVP_EncryptFinal,HMAC_Update,HMAC_Final,EVP_CIPHER_CTX_cleanup,HMAC_CTX_cleanup,CRYPTO_free,SSL_SESSION_free,CRYPTO_free,EVP_CIPHER_CTX_cleanup,HMAC_CTX_cleanup,	11_2_00D58720
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D60F20 CRYPTO_malloc,BIO_ctrl,ERR_put_error,EVP_MD_CTX_create,EVP_DigestInit_ex,EVP_DigestUpdate,BIO_free,	11_2_00D60F20
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D75F20 SSL_CTX_set_alpn_protos,CRYPTO_free,CRYPTO_malloc,memcpy,	11_2_00D75F20
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D84720 SSL_SRP_CTX_init,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BUF_strdup,ERR_put_error,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	11_2_00D84720
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2560 CRYPTO_free,	11_2_011B2560
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01206120 CRYPTO_malloc,	11_2_01206120
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01210120 idea_ecb_encrypt,	11_2_01210120
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125E120 sk_free,CRYPTO_free,	11_2_0125E120
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01224130 ASN1_template_new,ASN1_primitive_new,CRYPTO_malloc,memset,asn1_set_choice_selector,CRYPTO_malloc,memset,asn1_do_lock,asn1_enc_init,asn1_get_field_ptr,ASN1_template_new,ERR_put_error,ASN1_item_ex_free,ERR_put_error,	11_2_01224130
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01234130 PEM_read_bio_PrivateKey,PEM_bytes_read_bio,d2i_PKCS8_PRIV_KEY_INFO,EVP_PKCS82PKEY,EVP_PKEY_free,PKCS8_PRIV_KEY_INFO_free,d2i_X509_SIG,PEM_def_callback,ERR_put_error,X509_SIG_free,PKCS8_decrypt,X509_SIG_free,EVP_PKCS82PKEY,EVP_PKEY_free,PKCS8_PRIV_KEY_INFO_free,EVP_PKEY_asn1_find_str,d2i_PrivateKey,ERR_put_error,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,	11_2_01234130
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2100 CRYPTO_get_mem_functions,	11_2_011B2100
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CE100 Camellia_decrypt,	11_2_011CE100
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CC130 Camellia_cfb8_encrypt,Camellia_encrypt,CRYPTO_cfb128_8_encrypt,	11_2_011CC130
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124C110 CMS_add1_crl,CMS_add0_RevocationInfoChoice,CRYPTO_add_lock,	11_2_0124C110
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CE120 Camellia_cbc_encrypt,	11_2_011CE120
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E8120 ERR_put_error,EVP_PKEY_CTX_ctrl,ERR_put_error,atoi,EVP_PKEY_CTX_ctrl,atoi,EVP_PKEY_CTX_ctrl,BN_asc2bn,EVP_PKEY_CTX_ctrl,BN_free,EVP_get_digestbyname,EVP_PKEY_CTX_ctrl,EVP_get_digestbyname,ERR_put_error,EVP_PKEY_CTX_ctrl,string_to_hex,EVP_PKEY_CTX_ctrl,CRYPTO_free,	11_2_011E8120
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01206160 CRYPTO_free,	11_2_01206160
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01248160 sk_new_null,ERR_put_error,sk_num,sk_value,ASN1_item_new,sk_push,strchr,v2i_GENERAL_NAME_ex,CRYPTO_malloc,strncpy,OBJ_txt2obj,CRYPTO_free,sk_num,ERR_put_error,ERR_add_error_data,CRYPTO_free,ERR_put_error,ACCESS_DESCRIPTION_free,sk_pop_free,	11_2_01248160
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124C160 CMS_get1_certs,OBJ_obj2nid,ERR_put_error,sk_num,sk_value,sk_new_null,sk_push,CRYPTO_add_lock,sk_num,X509_free,sk_pop_free,	11_2_0124C160
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BC150 HMAC_CTX_cleanup,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	11_2_011BC150
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01210170 idea_cbc_encrypt,idea_cbc_encrypt,	11_2_01210170
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123C170 X509_free,CRYPTO_free,X509_CRL_free,CRYPTO_free,	11_2_0123C170
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01208140 lh_new,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,	11_2_01208140
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CC170 Camellia_ctr128_encrypt,Camellia_encrypt,CRYPTO_ctr128_encrypt,	11_2_011CC170
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E4170 RSA_padding_check_PKCS1_type_2,CRYPTO_malloc,ERR_put_error,memset,memcpy,memcpy,CRYPTO_free,ERR_put_error,	11_2_011E4170
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120C150 OBJ_NAME_do_all_sorted,lh_num_items,CRYPTO_malloc,lh_doall_arg,qsort,CRYPTO_free,	11_2_0120C150
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01252150 X509_get_serialNumber,CRYPTO_malloc,EVP_DecryptUpdate,EVP_DecryptUpdate,EVP_DecryptUpdate,EVP_DecryptInit_ex,EVP_DecryptUpdate,memcpy,OPENSSL_cleanse,CRYPTO_free,	11_2_01252150
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125E150 CRYPTO_lock,lh_doall,lh_free,CRYPTO_lock,	11_2_0125E150
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2160 CRYPTO_get_mem_ex_functions,	11_2_011B2160
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012301B0 PEM_SealUpdate,EVP_DigestUpdate,EVP_EncryptUpdate,EVP_EncodeUpdate,	11_2_012301B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125E1B0 ERR_set_mark,CRYPTO_lock,lh_retrieve,sk_value,sk_value,CRYPTO_lock,ERR_pop_to_mark,	11_2_0125E1B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012661B0 pitem_new,CRYPTO_malloc,	11_2_012661B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F6180 EC_POINT_point2bn,EC_POINT_point2oct,CRYPTO_malloc,EC_POINT_point2oct,CRYPTO_free,BN_bin2bn,CRYPTO_free,	11_2_011F6180
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B21B0 CRYPTO_get_locked_mem_functions,	11_2_011B21B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011FE1B0 CRYPTO_malloc,ERR_put_error,ECDH_OpenSSL,ENGINE_get_default_ECDH,X509_VERIFY_PARAM_get_flags,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,	11_2_011FE1B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0122A190 CRYPTO_free,CRYPTO_free,	11_2_0122A190
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EE1A0 DH_new_method,CRYPTO_malloc,ERR_put_error,DH_OpenSSL,ENGINE_init,ERR_put_error,CRYPTO_free,ENGINE_get_default_DH,X509_PURPOSE_get0_name,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,ENGINE_finish,CRYPTO_free_ex_data,CRYPTO_free,	11_2_011EE1A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012121E9 AES_set_encrypt_key,AES_encrypt,CRYPTO_ccm128_init,memcpy,	11_2_012121E9
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A1F0 ERR_get_implementation,CRYPTO_lock,CRYPTO_lock,	11_2_0120A1F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012101F0 idea_ofb64_encrypt,idea_ofb64_encrypt,	11_2_012101F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012541F0 CRYPTO_free,	11_2_012541F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123C1C0 X509_STORE_free,CRYPTO_add_lock,sk_num,sk_value,CRYPTO_free,sk_num,sk_free,sk_pop_free,CRYPTO_free_ex_data,X509_VERIFY_PARAM_free,CRYPTO_free,	11_2_0123C1C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B21F0 CRYPTO_get_locked_mem_ex_functions,	11_2_011B21F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C6010 idea_cfb64_encrypt,idea_encrypt,idea_encrypt,	11_2_011C6010
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01210030 BF_ofb64_encrypt,BF_ofb64_encrypt,	11_2_01210030
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123E030 X509_TRUST_cleanup,CRYPTO_free,CRYPTO_free,sk_pop_free,	11_2_0123E030
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124803C sk_new_null,sk_value,i2v_GENERAL_NAME,sk_value,i2t_ASN1_OBJECT,CRYPTO_malloc,BUF_strlcpy,BUF_strlcat,BUF_strlcat,CRYPTO_free,sk_num,	11_2_0124803C
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123E000 CRYPTO_free,CRYPTO_free,	11_2_0123E000
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2030 CRYPTO_set_locked_mem_functions,	11_2_011B2030
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01236010 i2b_PVK_bio,BIO_write,CRYPTO_free,ERR_put_error,	11_2_01236010
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125C010 OPENSSL_asc2uni,CRYPTO_malloc,	11_2_0125C010
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BC020 CRYPTO_malloc,memcpy,	11_2_011BC020
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CC020 AES_cbc_encrypt,	11_2_011CC020
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01200060 BIO_set,CRYPTO_new_ex_data,CRYPTO_free_ex_data,	11_2_01200060
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CC050 Camellia_ecb_encrypt,Camellia_encrypt,Camellia_decrypt,	11_2_011CC050
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F8050 EC_KEY_free,CRYPTO_add_lock,EC_GROUP_free,EC_POINT_free,BN_clear_free,OPENSSL_cleanse,CRYPTO_free,	11_2_011F8050
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01250070 ASN1_item_new,CRYPTO_add_lock,CRYPTO_add_lock,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,	11_2_01250070
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2070 CRYPTO_set_locked_mem_ex_functions,	11_2_011B2070
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E2070 BN_CTX_new,BN_CTX_start,BN_CTX_get,BN_CTX_get,BN_num_bits,CRYPTO_malloc,BN_bin2bn,BN_ucmp,BN_CTX_get,BN_MONT_CTX_set_locked,BN_BLINDING_invert_ex,BN_bn2bin,RSA_padding_check_PKCS1_type_2,RSA_padding_check_PKCS1_OAEP,RSA_padding_check_SSLv23,RSA_padding_check_none,ERR_put_error,BN_CTX_end,BN_CTX_free,OPENSSL_cleanse,CRYPTO_free,	11_2_011E2070
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121A050 a2d_ASN1_OBJECT,ERR_put_error,BN_new,BN_set_word,BN_mul_word,BN_add_word,BN_add_word,BN_num_bits,CRYPTO_free,CRYPTO_malloc,BN_div_word,CRYPTO_free,BN_free,ERR_put_error,CRYPTO_free,BN_free,ERR_put_error,	11_2_0121A050
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124A050 CRYPTO_malloc,X509_get_ext_d2i,POLICY_CONSTRAINTS_free,ASN1_INTEGER_free,ASN1_INTEGER_get,X509_get_ext_d2i,X509_get_ext_d2i,X509_get_ext_d2i,	11_2_0124A050
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012060A0 CRYPTO_malloc,	11_2_012060A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B4090 CRYPTO_lock,sk_num,sk_num,CRYPTO_malloc,sk_value,CRYPTO_lock,ERR_put_error,sk_num,sk_value,CRYPTO_set_ex_data,CRYPTO_free,	11_2_011B4090
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BC080 CRYPTO_malloc,HMAC_CTX_init,	11_2_011BC080
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CC080 Camellia_ofb128_encrypt,Camellia_encrypt,CRYPTO_ofb128_encrypt,	11_2_011CC080
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01212080 memcpy,CRYPTO_ccm128_tag,	11_2_01212080
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B20B0 CRYPTO_set_mem_debug_functions,OPENSSL_init,	11_2_011B20B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CC0B0 Camellia_cfb128_encrypt,Camellia_encrypt,CRYPTO_cfb128_encrypt,	11_2_011CC0B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125C090 OPENSSL_uni2asc,CRYPTO_malloc,	11_2_0125C090
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012000E0 BIO_free,CRYPTO_add_lock,CRYPTO_free_ex_data,CRYPTO_free,	11_2_012000E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012560E0 PKCS7_set_type,OBJ_nid2obj,PKCS7_SIGNED_new,ASN1_INTEGER_set,PKCS7_SIGNED_free,ASN1_STRING_type_new,PKCS7_SIGN_ENVELOPE_new,ASN1_INTEGER_set,ASN1_INTEGER_set,OBJ_nid2obj,PKCS7_ENVELOPE_new,ASN1_INTEGER_set,OBJ_nid2obj,PKCS7_ENCRYPT_new,ASN1_INTEGER_set,OBJ_nid2obj,PKCS7_DIGEST_new,ASN1_INTEGER_set,ERR_put_error,	11_2_012560E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C40C0 RC2_ecb_encrypt,RC2_encrypt,RC2_decrypt,	11_2_011C40C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C00C0 DES_cfb_encrypt,DES_encrypt1,memmove,DES_encrypt1,memmove,	11_2_011C00C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EA0C0 CRYPTO_malloc,ERR_put_error,	11_2_011EA0C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CC0F0 Camellia_cfb1_encrypt,Camellia_encrypt,CRYPTO_cfb128_1_encrypt,	11_2_011CC0F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123C0D0 X509_STORE_new,CRYPTO_malloc,sk_new,sk_new_null,X509_VERIFY_PARAM_new,CRYPTO_new_ex_data,sk_free,CRYPTO_free,	11_2_0123C0D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125E0D0 CRYPTO_lock,lh_doall_arg,CRYPTO_lock,	11_2_0125E0D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C20E0 DES_decrypt3,DES_encrypt2,DES_encrypt2,DES_encrypt2,	11_2_011C20E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CE0E0 Camellia_encrypt,	11_2_011CE0E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E00E0 BN_GF2m_mod_solve_quad,BN_num_bits,CRYPTO_malloc,BN_GF2m_poly2arr,BN_GF2m_mod_solve_quad_arr,CRYPTO_free,ERR_put_error,CRYPTO_free,	11_2_011E00E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2310 CRYPTO_free_locked,	11_2_011B2310
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EE310 DH_free,CRYPTO_add_lock,ENGINE_finish,CRYPTO_free_ex_data,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,CRYPTO_free,BN_clear_free,BN_clear_free,BN_clear_free,CRYPTO_free,	11_2_011EE310
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01240330 OBJ_txt2obj,ERR_put_error,ERR_add_error_data,string_to_hex,ERR_put_error,ERR_add_error_data,ASN1_STRING_type_new,ERR_put_error,X509_EXTENSION_create_by_OBJ,ASN1_OBJECT_free,ASN1_STRING_free,CRYPTO_free,	11_2_01240330
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EA300 DSA_verify,DSA_SIG_new,ASN1_item_d2i,ASN1_item_i2d,DSA_do_verify,OPENSSL_cleanse,CRYPTO_free,DSA_SIG_free,	11_2_011EA300
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01206300 CRYPTO_malloc,	11_2_01206300
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01218300 EVP_PKEY_meth_new,CRYPTO_malloc,memset,	11_2_01218300
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BC330 ASN1_OCTET_STRING_set,string_to_hex,CRYPTO_free,ASN1_OCTET_STRING_set,CRYPTO_free,	11_2_011BC330
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D4330 CRYPTO_128_wrap,memcpy,	11_2_011D4330
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01210310 EVP_CIPHER_CTX_flags,EVP_CIPHER_CTX_flags,idea_set_encrypt_key,idea_set_encrypt_key,idea_set_decrypt_key,OPENSSL_cleanse,	11_2_01210310
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01262310 OCSP_sendreq_new,OCSP_REQ_CTX_new,BIO_printf,OCSP_REQUEST_it,OCSP_REQ_CTX_i2d,BIO_free,CRYPTO_free,CRYPTO_free,	11_2_01262310
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CA320 AES_ctr128_encrypt,AES_encrypt,CRYPTO_ctr128_encrypt,	11_2_011CA320
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2350 CRYPTO_malloc,	11_2_011B2350
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121C370 i2d_ASN1_SET,sk_num,sk_value,ASN1_object_size,ASN1_put_object,sk_num,sk_num,CRYPTO_malloc,sk_num,sk_value,sk_num,sk_num,qsort,CRYPTO_malloc,ERR_put_error,sk_num,memcpy,sk_num,memcpy,CRYPTO_free,CRYPTO_free,sk_num,sk_value,sk_num,	11_2_0121C370
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121E370 ASN1_mbstring_ncopy,UTF8_getc,ERR_put_error,BIO_snprintf,ERR_add_error_data,ERR_put_error,BIO_snprintf,ERR_add_error_data,CRYPTO_free,ASN1_STRING_type_new,ASN1_STRING_set,CRYPTO_malloc,ASN1_STRING_free,ERR_put_error,	11_2_0121E370
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011FE340 ECDH_get_ex_new_index,CRYPTO_get_ex_new_index,	11_2_011FE340
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0122E340 ASN1_STRING_new,CRYPTO_malloc,ERR_put_error,	11_2_0122E340
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120C350 OBJ_NAME_init,CRYPTO_mem_ctrl,lh_new,CRYPTO_mem_ctrl,	11_2_0120C350
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A350 CRYPTO_lock,lh_free,CRYPTO_lock,	11_2_0120A350
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123C350 X509_OBJECT_up_ref_count,CRYPTO_add_lock,CRYPTO_add_lock,	11_2_0123C350
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01252350 EVP_CIPHER_CTX_init,ERR_put_error,OBJ_obj2nid,d2i_X509_ALGOR,OBJ_obj2nid,OBJ_nid2sn,EVP_get_cipherbyname,ERR_put_error,EVP_CipherInit_ex,EVP_CIPHER_CTX_set_padding,EVP_CIPHER_asn1_to_param,ERR_put_error,EVP_PBE_CipherInit,ERR_put_error,X509_get_serialNumber,CRYPTO_malloc,CRYPTO_malloc,ERR_put_error,ERR_put_error,EVP_CIPHER_CTX_cleanup,CRYPTO_free,X509_ALGOR_free,ERR_put_error,	11_2_01252350
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B4360 ERR_load_CRYPTO_strings,ERR_func_error_string,ERR_load_strings,ERR_load_strings,	11_2_011B4360
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CA360 AES_ige_encrypt,OpenSSLDie,OpenSSLDie,OpenSSLDie,AES_encrypt,AES_encrypt,AES_decrypt,AES_decrypt,	11_2_011CA360
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A3A1 CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,lh_retrieve,CRYPTO_lock,	11_2_0120A3A1
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012543B5 BIO_gets,BUF_MEM_grow,ERR_put_error,BUF_MEM_free,CRYPTO_free,BIO_snprintf,ERR_add_error_data,CONF_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_012543B5
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012543B7 BIO_gets,BUF_MEM_grow,ERR_put_error,BUF_MEM_free,CRYPTO_free,BIO_snprintf,ERR_add_error_data,CONF_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_012543B7
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012143E0 EVP_PKEY_free,CRYPTO_add_lock,ENGINE_finish,X509_ATTRIBUTE_free,sk_pop_free,CRYPTO_free,	11_2_012143E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012303E0 PEM_X509_INFO_read_bio,sk_new_null,ERR_put_error,X509_INFO_new,PEM_read_bio,sk_push,X509_INFO_new,X509_PKEY_new,X509_PKEY_new,X509_PKEY_new,PEM_get_EVP_CIPHER_INFO,PEM_do_header,d2i_PrivateKey,d2i_X509,ERR_put_error,X509_INFO_free,sk_num,sk_value,X509_INFO_free,sk_num,sk_free,PEM_get_EVP_CIPHER_INFO,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_peek_last_error,ERR_clear_error,sk_push,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_012303E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C43D0 RC2_decrypt,	11_2_011C43D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EC3C0 DSO_free,ERR_put_error,CRYPTO_add_lock,ERR_put_error,ERR_put_error,sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_011EC3C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E23C0 BN_num_bits,ERR_put_error,BN_ucmp,ERR_put_error,BN_num_bits,BN_num_bits,BN_CTX_new,BN_CTX_start,BN_CTX_get,BN_CTX_get,BN_num_bits,CRYPTO_malloc,BN_bin2bn,BN_ucmp,BN_MONT_CTX_set_locked,BN_sub,BN_bn2bin,ERR_put_error,RSA_padding_check_X931,RSA_padding_check_none,RSA_padding_check_PKCS1_type_1,ERR_put_error,ERR_put_error,BN_CTX_end,BN_CTX_free,OPENSSL_cleanse,CRYPTO_free,	11_2_011E23C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012103C0 DES_ecb3_encrypt,	11_2_012103C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012423C0 BUF_strndup,ASN1_STRING_to_UTF8,BUF_strndup,CRYPTO_free,	11_2_012423C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012603C0 DSO_free,CRYPTO_free,CRYPTO_free,ASN1_PCTX_free,sk_pop_free,CRYPTO_free,	11_2_012603C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123A3D0 X509_STORE_CTX_init,X509_VERIFY_PARAM_new,ERR_put_error,X509_VERIFY_PARAM_inherit,X509_VERIFY_PARAM_lookup,X509_VERIFY_PARAM_inherit,CRYPTO_new_ex_data,CRYPTO_free,ERR_put_error,	11_2_0123A3D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124A3D0 CRYPTO_malloc,OBJ_obj2nid,sk_new,sk_push,sk_new_null,sk_push,CRYPTO_free,	11_2_0124A3D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012563D0 PKCS7_add_certificate,OBJ_obj2nid,ERR_put_error,sk_new_null,ERR_put_error,CRYPTO_add_lock,sk_push,X509_free,	11_2_012563D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125E3D0 ENGINE_load_private_key,ERR_put_error,CRYPTO_lock,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,ERR_put_error,	11_2_0125E3D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012623D0 OCSP_sendreq_bio,OCSP_sendreq_new,OCSP_RESPONSE_it,OCSP_REQ_CTX_nbio,BIO_test_flags,BIO_ctrl,ASN1_item_d2i,BIO_free,CRYPTO_free,CRYPTO_free,	11_2_012623D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B23E0 CRYPTO_strdup,CRYPTO_malloc,	11_2_011B23E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B4210 CRYPTO_lock,sk_num,CRYPTO_malloc,sk_value,CRYPTO_lock,ERR_put_error,sk_num,sk_value,CRYPTO_free,sk_free,	11_2_011B4210
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C6210 idea_ofb64_encrypt,idea_encrypt,	11_2_011C6210
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F6210 EC_POINT_bn2point,BN_num_bits,CRYPTO_malloc,BN_bn2bin,CRYPTO_free,EC_POINT_new,EC_POINT_oct2point,EC_POINT_clear_free,CRYPTO_free,CRYPTO_free,	11_2_011F6210
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CA200 AES_ecb_encrypt,AES_encrypt,AES_decrypt,	11_2_011CA200
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C2200 DES_ncbc_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,	11_2_011C2200
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011DE200 BN_MONT_CTX_new,CRYPTO_malloc,BN_init,BN_init,BN_init,	11_2_011DE200
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124A200 CRYPTO_lock,CRYPTO_lock,	11_2_0124A200
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01262200 OCSP_REQ_CTX_new,CRYPTO_malloc,BIO_s_mem,BIO_new,CRYPTO_malloc,BIO_free,CRYPTO_free,CRYPTO_free,	11_2_01262200
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CA230 AES_cfb128_encrypt,AES_encrypt,CRYPTO_cfb128_encrypt,	11_2_011CA230
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01208210 lh_insert,CRYPTO_malloc,	11_2_01208210
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01266210 pqueue_new,CRYPTO_malloc,	11_2_01266210
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2220 CRYPTO_get_mem_debug_functions,	11_2_011B2220
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F8250 EC_KEY_up_ref,CRYPTO_add_lock,	11_2_011F8250
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01210270 idea_cfb64_encrypt,	11_2_01210270
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01250270 ERR_put_error,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,EVP_PKEY_CTX_ctrl,ERR_put_error,EVP_PKEY_encrypt,CRYPTO_malloc,ERR_put_error,EVP_PKEY_encrypt,ASN1_STRING_set0,EVP_PKEY_CTX_free,CRYPTO_free,	11_2_01250270
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A240 ERR_set_implementation,CRYPTO_lock,CRYPTO_lock,	11_2_0120A240
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CA270 AES_cfb1_encrypt,AES_encrypt,CRYPTO_cfb128_1_encrypt,	11_2_011CA270
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120E250 EVP_MD_CTX_create,CRYPTO_malloc,	11_2_0120E250
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01202250 CRYPTO_free,BUF_strdup,BIO_get_host_ip,BIO_get_port,htons,htonl,socket,BIO_clear_flags,connect,BIO_sock_should_retry,BIO_set_flags,ERR_put_error,ERR_put_error,ERR_add_error_data,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,	11_2_01202250
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124C250 CMS_get1_crls,OBJ_obj2nid,ERR_put_error,sk_num,sk_value,sk_new_null,sk_push,CRYPTO_add_lock,sk_num,X509_CRL_free,sk_pop_free,	11_2_0124C250
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011DE260 BN_MONT_CTX_set_locked,CRYPTO_lock,CRYPTO_lock,BN_MONT_CTX_new,BN_MONT_CTX_set,BN_MONT_CTX_free,CRYPTO_lock,BN_MONT_CTX_free,CRYPTO_lock,	11_2_011DE260
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012082A0 lh_delete,CRYPTO_free,	11_2_012082A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012122A0 CRYPTO_ccm128_setiv,CRYPTO_ccm128_aad,CRYPTO_ccm128_setiv,CRYPTO_ccm128_encrypt_ccm64,CRYPTO_ccm128_encrypt,CRYPTO_ccm128_decrypt_ccm64,CRYPTO_ccm128_decrypt,CRYPTO_ccm128_tag,CRYPTO_memcmp,OPENSSL_cleanse,	11_2_012122A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C4290 RC2_encrypt,	11_2_011C4290
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123C2AE sk_value,sk_num,CRYPTO_malloc,sk_push,CRYPTO_free,	11_2_0123C2AE
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011FE290 ENGINE_finish,CRYPTO_free_ex_data,OPENSSL_cleanse,CRYPTO_free,	11_2_011FE290
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2280 CRYPTO_malloc_locked,	11_2_011B2280
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120E280 EVP_DigestInit_ex,EVP_MD_CTX_clear_flags,ENGINE_finish,ENGINE_init,ERR_put_error,ENGINE_get_digest_engine,ENGINE_get_digest,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,	11_2_0120E280
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01252280 X509_get_serialNumber,memcpy,RAND_pseudo_bytes,EVP_EncryptUpdate,EVP_EncryptUpdate,	11_2_01252280
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CA2B0 AES_cfb8_encrypt,AES_encrypt,CRYPTO_cfb128_8_encrypt,	11_2_011CA2B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01230290 PEM_SealFinal,ERR_put_error,RSA_size,CRYPTO_malloc,ERR_put_error,EVP_EncryptFinal_ex,EVP_EncodeUpdate,EVP_EncodeFinal,EVP_SignFinal,EVP_EncodeBlock,EVP_MD_CTX_cleanup,EVP_CIPHER_CTX_cleanup,CRYPTO_free,	11_2_01230290
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123C290 X509_STORE_add_lookup,sk_num,sk_value,sk_num,CRYPTO_malloc,sk_push,	11_2_0123C290
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124E290 CMS_encrypt,CMS_EnvelopedData_create,ERR_put_error,sk_num,sk_value,CMS_add1_recipient_cert,sk_num,CMS_set_detached,CMS_final,CMS_ContentInfo_free,ERR_put_error,CMS_ContentInfo_free,	11_2_0124E290
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F62D0 EC_POINT_point2hex,EC_POINT_point2oct,CRYPTO_malloc,EC_POINT_point2oct,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,	11_2_011F62D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012362F0 X509_issuer_and_serial_hash,EVP_MD_CTX_init,X509_NAME_oneline,EVP_md5,EVP_DigestInit_ex,EVP_DigestUpdate,CRYPTO_free,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_cleanup,	11_2_012362F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012542C0 BUF_MEM_new,ERR_put_error,CRYPTO_malloc,BUF_strlcpy,BUF_MEM_grow,BIO_gets,CRYPTO_malloc,CRYPTO_malloc,BUF_strlcpy,BUF_MEM_grow,BUF_MEM_free,CRYPTO_free,ERR_put_error,BUF_MEM_free,CRYPTO_free,BIO_snprintf,ERR_add_error_data,CONF_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_012542C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125C2C0 OBJ_obj2nid,PKCS8_decrypt,PKCS8_encrypt,X509_SIG_free,	11_2_0125C2C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CA2F0 AES_ofb128_encrypt,AES_encrypt,CRYPTO_ofb128_encrypt,	11_2_011CA2F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EC2F0 DSO_new_method,DSO_METHOD_openssl,CRYPTO_malloc,ERR_put_error,sk_new_null,ERR_put_error,CRYPTO_free,CRYPTO_free,	11_2_011EC2F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A2D0 CRYPTO_lock,CRYPTO_push_info_,lh_new,CRYPTO_pop_info,CRYPTO_lock,	11_2_0120A2D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01220520 BUF_MEM_free,X509_NAME_ENTRY_free,sk_pop_free,CRYPTO_free,CRYPTO_free,	11_2_01220520
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01264520 UI_free,sk_pop_free,CRYPTO_free_ex_data,CRYPTO_free,	11_2_01264520
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01212530 AES_set_encrypt_key,AES_set_decrypt_key,	11_2_01212530
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01256530 PKCS7_SIGNER_INFO_set,ASN1_INTEGER_set,X509_get_issuer_name,X509_NAME_set,ASN1_STRING_free,X509_get_serialNumber,ASN1_STRING_dup,CRYPTO_add_lock,pqueue_peek,OBJ_nid2obj,X509_ALGOR_set0,ERR_put_error,ERR_put_error,	11_2_01256530
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01242500 X509_get_ext_d2i,sk_num,sk_value,sk_num,GENERAL_NAMES_free,X509_get_subject_name,X509_NAME_get_index_by_NID,X509_NAME_get_entry,X509_policy_tree_level_count,ASN1_STRING_to_UTF8,BUF_strndup,CRYPTO_free,X509_NAME_get_index_by_NID,	11_2_01242500
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BC530 CMAC_CTX_free,CMAC_CTX_cleanup,CRYPTO_free,	11_2_011BC530
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C4530 RC2_cbc_encrypt,RC2_encrypt,RC2_encrypt,RC2_decrypt,RC2_decrypt,	11_2_011C4530
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01260540 ENGINE_get_ex_new_index,ERR_put_error,CRYPTO_lock,CRYPTO_lock,ENGINE_get_ex_data,	11_2_01260540
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121A550 ASN1_OBJECT_new,CRYPTO_malloc,ERR_put_error,	11_2_0121A550
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01264550 ERR_put_error,ERR_put_error,CRYPTO_malloc,	11_2_01264550
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A5A0 CRYPTO_lock,CRYPTO_push_info_,lh_new,CRYPTO_pop_info,CRYPTO_lock,	11_2_0120A5A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012105A0 DES_ede3_cfb64_encrypt,DES_ede3_cfb64_encrypt,	11_2_012105A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121A5A0 ASN1_OBJECT_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_0121A5A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125E5A0 ENGINE_load_ssl_client_cert,ERR_put_error,CRYPTO_lock,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,	11_2_0125E5A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012125B0 AES_encrypt,CRYPTO_128_wrap,AES_decrypt,CRYPTO_128_unwrap,	11_2_012125B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012325B0 PEM_bytes_read_bio,PEM_read_bio,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_peek_error,ERR_add_error_data,PEM_get_EVP_CIPHER_INFO,PEM_do_header,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_012325B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B25A0 CRYPTO_remalloc,CRYPTO_malloc,	11_2_011B25A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D25A0 CRYPTO_gcm128_init,memset,	11_2_011D25A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B25F0 CRYPTO_set_mem_debug_options,	11_2_011B25F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BC5F0 CMAC_Init,EVP_EncryptInit_ex,X509_get_serialNumber,memset,EVP_EncryptInit_ex,pqueue_peek,EVP_CIPHER_CTX_set_key_length,EVP_EncryptInit_ex,X509_get_serialNumber,EVP_Cipher,OPENSSL_cleanse,EVP_EncryptInit_ex,memset,	11_2_011BC5F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120E5D0 EVP_MD_CTX_copy_ex,ENGINE_init,ERR_put_error,EVP_MD_CTX_set_flags,EVP_MD_CTX_cleanup,memcpy,EVP_PKEY_CTX_dup,EVP_MD_CTX_cleanup,CRYPTO_malloc,ERR_put_error,ERR_put_error,	11_2_0120E5D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012245D0 ASN1_template_free,ASN1_primitive_free,asn1_get_choice_selector,asn1_get_field_ptr,ASN1_template_free,asn1_do_lock,asn1_enc_free,asn1_do_adb,asn1_get_field_ptr,ASN1_template_free,CRYPTO_free,	11_2_012245D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0122A5D0 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,	11_2_0122A5D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01260420 CRYPTO_malloc,ERR_put_error,memset,sk_new_null,ERR_put_error,CRYPTO_free,CRYPTO_lock,ENGINE_get_ex_data,ENGINE_set_ex_data,CRYPTO_lock,CRYPTO_free,	11_2_01260420
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C6410 idea_ecb_encrypt,idea_encrypt,	11_2_011C6410
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01210430 DES_ede3_ofb64_encrypt,DES_ede3_ofb64_encrypt,	11_2_01210430
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EE400 DH_up_ref,CRYPTO_add_lock,	11_2_011EE400
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011FE400 ERR_put_error,BN_CTX_new,BN_CTX_start,BN_CTX_get,BN_CTX_get,X509_TRUST_get0_name,ERR_put_error,X509_TRUST_get_flags,TS_TST_INFO_get_nonce,EC_GROUP_get_cofactor,BN_mul,EC_POINT_new,ERR_put_error,ERR_put_error,EC_POINT_mul,ERR_put_error,pqueue_peek,X509_TRUST_get_flags,EC_POINT_get_affine_coordinates_GFp,EC_POINT_get_affine_coordinates_GF2m,EC_GROUP_get_degree,BN_num_bits,ERR_put_error,CRYPTO_malloc,memset,BN_bn2bin,ERR_put_error,ERR_put_error,memcpy,EC_POINT_free,BN_CTX_end,BN_CTX_free,CRYPTO_free,	11_2_011FE400
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01250400 ERR_put_error,EVP_PKEY_CTX_new,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_ctrl,ERR_put_error,EVP_PKEY_decrypt,CRYPTO_malloc,ERR_put_error,EVP_PKEY_decrypt,ERR_put_error,OPENSSL_cleanse,CRYPTO_free,EVP_PKEY_CTX_free,CRYPTO_free,	11_2_01250400
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2430 CRYPTO_realloc,CRYPTO_malloc,	11_2_011B2430
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EE430 DH_get_ex_new_index,CRYPTO_get_ex_new_index,	11_2_011EE430
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0122E410 d2i_ASN1_type_bytes,ASN1_get_object,ASN1_tag2bit,d2i_ASN1_BIT_STRING,ASN1_STRING_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,memcpy,CRYPTO_free,	11_2_0122E410
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011FA420 ERR_put_error,i2o_ECPublicKey,CRYPTO_malloc,i2o_ECPublicKey,OBJ_nid2obj,X509_PUBKEY_set0_param,ASN1_OBJECT_free,ASN1_STRING_free,CRYPTO_free,	11_2_011FA420
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01214460 EVP_PKEY_encrypt_old,ERR_put_error,RSA_public_encrypt,	11_2_01214460
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01258470 PKCS7_dataFinal,ERR_put_error,EVP_MD_CTX_init,OBJ_obj2nid,ASN1_STRING_type_new,sk_num,sk_value,OBJ_obj2nid,EVP_MD_CTX_copy_ex,sk_num,ASN1_STRING_type_new,OBJ_obj2nid,ASN1_STRING_free,OBJ_obj2nid,ASN1_STRING_free,EVP_PKEY_size,CRYPTO_malloc,EVP_SignFinal,ASN1_STRING_set0,sk_num,OBJ_obj2nid,EVP_DigestFinal_ex,ASN1_STRING_set,OBJ_obj2nid,PKCS7_ctrl,BIO_find_type,BIO_ctrl,BIO_set_flags,BIO_ctrl,ASN1_STRING_set0,ERR_put_error,EVP_MD_CTX_cleanup,	11_2_01258470
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EA440 DSA_SIG_new,CRYPTO_malloc,	11_2_011EA440
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120C440 OBJ_NAME_add,CRYPTO_mem_ctrl,lh_new,CRYPTO_mem_ctrl,CRYPTO_malloc,lh_insert,sk_num,sk_value,CRYPTO_free,	11_2_0120C440
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A441 CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,lh_insert,CRYPTO_lock,	11_2_0120A441
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121A440 i2a_ASN1_OBJECT,OBJ_obj2txt,CRYPTO_malloc,OBJ_obj2txt,BIO_write,BIO_write,CRYPTO_free,BIO_write,	11_2_0121A440
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0126A440 pqueue_peek,ASN1_INTEGER_get,memset,sk_num,ASN1_BIT_STRING_get_bit,ERR_put_error,ERR_add_error_data,CRYPTO_free,	11_2_0126A440
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D4470 CRYPTO_128_unwrap,memcpy,OPENSSL_cleanse,	11_2_011D4470
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EA470 DSA_SIG_free,BN_free,BN_free,CRYPTO_free,	11_2_011EA470
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124A4A0 ASN1_OBJECT_free,POLICYQUALINFO_free,sk_pop_free,ASN1_OBJECT_free,sk_pop_free,CRYPTO_free,	11_2_0124A4A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BC490 CMAC_CTX_new,CRYPTO_malloc,EVP_CIPHER_CTX_init,	11_2_011BC490
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012144B0 EVP_PKEY_decrypt_old,ERR_put_error,RSA_private_decrypt,	11_2_012144B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012344B0 PEM_read_bio_Parameters,PEM_bytes_read_bio,EVP_PKEY_new,EVP_PKEY_set_type_str,EVP_PKEY_free,EVP_PKEY_free,ERR_put_error,CRYPTO_free,CRYPTO_free,	11_2_012344B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125E4B0 ENGINE_load_public_key,ERR_put_error,CRYPTO_lock,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,ERR_put_error,	11_2_0125E4B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F0480 DH_size,DH_compute_key,DH_size,CRYPTO_malloc,DH_compute_key_padded,DH_KDF_X9_42,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,	11_2_011F0480
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01256480 PKCS7_add_crl,OBJ_obj2nid,ERR_put_error,sk_new_null,ERR_put_error,CRYPTO_add_lock,sk_push,X509_CRL_free,	11_2_01256480
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B24B0 CRYPTO_realloc_clean,CRYPTO_malloc,memcpy,OPENSSL_cleanse,	11_2_011B24B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EC4B0 DSO_up_ref,ERR_put_error,CRYPTO_add_lock,	11_2_011EC4B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01220490 CRYPTO_malloc,sk_new_null,BUF_MEM_new,ERR_put_error,sk_free,CRYPTO_free,	11_2_01220490
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A4E1 CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,lh_delete,CRYPTO_lock,	11_2_0120A4E1
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124A4E0 OBJ_dup,CRYPTO_malloc,sk_new_null,CRYPTO_free,ASN1_OBJECT_free,	11_2_0124A4E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012244F0 ASN1_primitive_free,ASN1_OBJECT_free,ASN1_primitive_free,CRYPTO_free,ASN1_STRING_free,	11_2_012244F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C64C0 idea_set_encrypt_key,	11_2_011C64C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120E4C0 EVP_MD_CTX_cleanup,EVP_MD_CTX_test_flags,EVP_MD_CTX_test_flags,OPENSSL_cleanse,CRYPTO_free,EVP_PKEY_CTX_free,ENGINE_finish,	11_2_0120E4C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012184C0 EVP_PKEY_CTX_free,EVP_PKEY_free,EVP_PKEY_free,ENGINE_finish,CRYPTO_free,	11_2_012184C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012104D0 DES_ede3_cbc_encrypt,DES_ede3_cbc_encrypt,	11_2_012104D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012644D0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_012644D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A730 CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,lh_insert,CRYPTO_lock,	11_2_0120A730
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01234730 PEM_read_bio_DHparams,PEM_bytes_read_bio,d2i_DHxparams,d2i_DHparams,ERR_put_error,CRYPTO_free,CRYPTO_free,	11_2_01234730
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C0700 DES_ede3_ofb64_encrypt,DES_encrypt3,	11_2_011C0700
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EC700 DSO_set_filename,ERR_put_error,CRYPTO_malloc,ERR_put_error,BUF_strlcpy,CRYPTO_free,ERR_put_error,	11_2_011EC700
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C6730 BF_set_key,memcpy,BF_encrypt,BF_encrypt,	11_2_011C6730
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D6730 ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,	11_2_011D6730
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01210710 DES_ede3_cfb_encrypt,DES_ede3_cfb_encrypt,	11_2_01210710
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01262710 OCSP_parse_url,BUF_strdup,strchr,strchr,strchr,BUF_strdup,BUF_strdup,strchr,strchr,BUF_strdup,BUF_strdup,CRYPTO_free,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_01262710
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125C760 PKCS8_decrypt,PKCS8_PRIV_KEY_INFO_it,PKCS12_item_decrypt_d2i,	11_2_0125C760
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0126C760 SRP_Calc_u,BN_ucmp,BN_ucmp,BN_num_bits,CRYPTO_malloc,memset,EVP_MD_CTX_init,EVP_sha1,EVP_DigestInit_ex,BN_bn2bin,EVP_DigestUpdate,BN_bn2bin,EVP_DigestUpdate,CRYPTO_free,EVP_DigestFinal_ex,EVP_MD_CTX_cleanup,BN_bin2bn,BN_free,	11_2_0126C760
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E4773 EVP_MD_size,ERR_put_error,EVP_Digest,memset,memcpy,RAND_bytes,CRYPTO_malloc,PKCS1_MGF1,PKCS1_MGF1,CRYPTO_free,	11_2_011E4773
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012007A0 BIO_get_ex_new_index,CRYPTO_get_ex_new_index,	11_2_012007A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012027A0 shutdown,closesocket,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_012027A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D8790 BN_bn2hex,CRYPTO_malloc,CRYPTO_malloc,ERR_put_error,	11_2_011D8790
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120C7B0 ASN1_OBJECT_free,CRYPTO_free,	11_2_0120C7B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012167B0 CRYPTO_malloc,EVP_MD_CTX_init,	11_2_012167B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123E7B0 CRYPTO_malloc,BUF_MEM_new,CRYPTO_free,	11_2_0123E7B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0126A7B0 TS_RESP_verify_signature,ERR_put_error,OBJ_obj2nid,ERR_put_error,PKCS7_get_signer_info,sk_num,sk_value,PKCS7_ctrl,PKCS7_get0_signers,sk_num,sk_value,PKCS7_dataInit,BIO_read,PKCS7_signatureVerify,CRYPTO_add_lock,ERR_put_error,BIO_free_all,X509_free,sk_pop_free,sk_free,	11_2_0126A7B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011FC780 ECPKParameters_print,BN_CTX_new,EC_GROUP_get_asn1_flag,BIO_indent,ENGINE_get_pkey_asn1_meths,OBJ_nid2sn,BIO_printf,BIO_printf,EC_curve_nid2nist,BIO_indent,BIO_printf,pqueue_peek,X509_TRUST_get_flags,BN_new,BN_new,BN_new,BN_new,BN_new,EC_GROUP_get_curve_GF2m,EC_GROUP_get_curve_GFp,X509_TRUST_get_flags,EC_GROUP_get_order,EC_GROUP_get_cofactor,ENGINE_get_init_function,EC_POINT_point2bn,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,ENGINE_get_finish_function,EVP_MD_block_size,CRYPTO_malloc,BIO_indent,OBJ_nid2sn,BIO_printf,EC_GROUP_get_basis_type,BIO_indent,OBJ_nid2sn,BIO_printf,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ERR_put_error,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_CTX_free,CRYPTO_free,	11_2_011FC780
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125C790 PKCS8_encrypt,X509_SIG_new,PKCS5_pbe2_set,EVP_PBE_find,PKCS5_pbe2_set_iv,ERR_clear_error,PKCS5_pbe_set,X509_ALGOR_free,ASN1_STRING_free,PKCS8_PRIV_KEY_INFO_it,PKCS12_item_i2d_encrypt,ERR_put_error,X509_SIG_free,	11_2_0125C790
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B27A0 CRYPTO_is_mem_check_on,CRYPTO_THREADID_current,CRYPTO_lock,CRYPTO_THREADID_cmp,CRYPTO_lock,	11_2_011B27A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D07A0 SEED_ecb_encrypt,SEED_encrypt,SEED_decrypt,	11_2_011D07A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120E7E0 EVP_MD_CTX_destroy,EVP_MD_CTX_cleanup,CRYPTO_free,	11_2_0120E7E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121C7E0 ASN1_dup,CRYPTO_malloc,ERR_put_error,CRYPTO_free,	11_2_0121C7E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D07D0 SEED_cbc_encrypt,	11_2_011D07D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F07D0 CMS_SharedInfo_encode,CRYPTO_memcmp,	11_2_011F07D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A7F0 CRYPTO_lock,CRYPTO_lock,	11_2_0120A7F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012187F0 EVP_PKEY_meth_set_decrypt,	11_2_012187F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0122E7F0 ASN1_const_check_infinite_end,asn1_const_Finish,CRYPTO_free,ASN1_STRING_free,d2i_ASN1_bytes,BUF_MEM_grow_clean,memcpy,ERR_put_error,ASN1_STRING_free,CRYPTO_free,	11_2_0122E7F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123C7F0 X509_STORE_add_cert,CRYPTO_malloc,ERR_put_error,CRYPTO_lock,X509_OBJECT_up_ref_count,X509_OBJECT_retrieve_match,X509_OBJECT_free_contents,CRYPTO_free,ERR_put_error,sk_push,CRYPTO_lock,	11_2_0123C7F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012287C0 EVP_PKEY_asn1_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	11_2_012287C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012187D0 EVP_PKEY_meth_set_encrypt,	11_2_012187D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2610 CRYPTO_free,	11_2_011B2610
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A630 CRYPTO_add_lock,	11_2_0120A630
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0122E630 d2i_ASN1_bytes,ASN1_STRING_new,ASN1_get_object,CRYPTO_free,CRYPTO_malloc,ASN1_STRING_free,ERR_put_error,memcpy,CRYPTO_free,	11_2_0122E630
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0126C630 BN_num_bits,BN_ucmp,CRYPTO_malloc,BN_bn2bin,EVP_MD_CTX_init,EVP_sha1,EVP_DigestInit_ex,EVP_DigestUpdate,memset,BN_bn2bin,EVP_DigestUpdate,EVP_DigestUpdate,CRYPTO_free,EVP_DigestFinal_ex,EVP_MD_CTX_cleanup,BN_bin2bn,	11_2_0126C630
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2600 CRYPTO_get_mem_debug_options,	11_2_011B2600
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01260602 DSO_load,sk_num,sk_value,DSO_merge,DSO_load,CRYPTO_free,CRYPTO_free,	11_2_01260602
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D6620 BN_clear_free,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,	11_2_011D6620
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121A660 c2i_ASN1_OBJECT,ASN1_OBJECT_new,ERR_put_error,CRYPTO_free,CRYPTO_malloc,ERR_put_error,ASN1_OBJECT_free,memcpy,	11_2_0121A660
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A670 CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,lh_retrieve,CRYPTO_lock,	11_2_0120A670
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2640 CRYPTO_mem_ctrl,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_lock,	11_2_011B2640
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01204640 BIO_vprintf,CRYPTO_push_info_,BIO_write,CRYPTO_free,BIO_write,CRYPTO_pop_info,	11_2_01204640
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01210650 DES_ede3_cfb_encrypt,	11_2_01210650
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C6690 idea_set_decrypt_key,	11_2_011C6690
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D2690 CRYPTO_gcm128_setiv,	11_2_011D2690
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012606B0 DSO_new,DSO_convert_filename,ERR_put_error,DSO_free,DSO_bind_func,DSO_free,DSO_bind_func,DSO_free,ERR_put_error,ENGINE_get_static_state,ERR_get_implementation,CRYPTO_get_ex_data_implementation,CRYPTO_get_mem_functions,CRYPTO_get_locking_callback,CRYPTO_get_add_lock_callback,CRYPTO_get_dynlock_create_callback,CRYPTO_get_dynlock_lock_callback,CRYPTO_get_dynlock_destroy_callback,DSO_free,ERR_put_error,ENGINE_add,ERR_put_error,ERR_clear_error,	11_2_012606B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D6680 BN_free,CRYPTO_free,CRYPTO_free,	11_2_011D6680
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01208680 CRYPTO_THREADID_current,CRYPTO_lock,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,EVP_MD_CTX_init,EVP_sha1,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_cleanup,CRYPTO_lock,CRYPTO_lock,	11_2_01208680
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123C690 X509_STORE_get_by_subject,CRYPTO_lock,sk_value,CRYPTO_lock,sk_num,sk_value,sk_num,CRYPTO_add_lock,	11_2_0123C690
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F86A0 EC_KEY_get_key_method_data,CRYPTO_lock,CRYPTO_lock,	11_2_011F86A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012026E0 CRYPTO_malloc,	11_2_012026E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E86D0 RSA_private_encrypt,	11_2_011E86D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E86C0 RSA_public_encrypt,	11_2_011E86C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E86F0 RSA_public_decrypt,	11_2_011E86F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F86F0 EC_KEY_insert_key_method_data,CRYPTO_lock,CRYPTO_lock,	11_2_011F86F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012066D0 CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,ERR_put_error,ERR_put_error,	11_2_012066D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C26E0 DES_ede3_cbc_encrypt,DES_encrypt3,DES_encrypt3,DES_decrypt3,DES_decrypt3,	11_2_011C26E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D66E0 BN_new,CRYPTO_malloc,ERR_put_error,	11_2_011D66E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E86E0 RSA_private_decrypt,	11_2_011E86E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0122A920 CRYPTO_free,CRYPTO_free,	11_2_0122A920
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BC910 CMAC_resume,EVP_EncryptInit_ex,	11_2_011BC910
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E4910 RSA_padding_check_PKCS1_OAEP_mgf1,EVP_sha1,EVP_MD_size,CRYPTO_malloc,CRYPTO_malloc,memset,memcpy,PKCS1_MGF1,PKCS1_MGF1,EVP_Digest,CRYPTO_memcmp,ERR_put_error,ERR_put_error,CRYPTO_free,CRYPTO_free,memcpy,	11_2_011E4910
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011FA910 ERR_put_error,X509_PURPOSE_get0_name,X509_STORE_CTX_set0_crls,i2d_ECPrivateKey,X509_STORE_CTX_set0_crls,CRYPTO_malloc,X509_STORE_CTX_set0_crls,ERR_put_error,i2d_ECPrivateKey,X509_STORE_CTX_set0_crls,CRYPTO_free,ERR_put_error,X509_STORE_CTX_set0_crls,OBJ_nid2obj,PKCS8_pkey_set0,	11_2_011FA910
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A930 CRYPTO_free,	11_2_0120A930
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121A930 c2i_ASN1_BIT_STRING,ASN1_STRING_type_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,memcpy,CRYPTO_free,	11_2_0121A930
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01252930 CMS_RecipientEncryptedKey_cert_cmp,	11_2_01252930
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125C900 COMP_CTX_free,CRYPTO_free,	11_2_0125C900
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C0930 DES_enc_read,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,memcpy,memcpy,_read,_errno,_read,_errno,DES_pcbc_encrypt,DES_cbc_encrypt,memcpy,DES_pcbc_encrypt,DES_cbc_encrypt,memcpy,DES_pcbc_encrypt,DES_cbc_encrypt,	11_2_011C0930
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01202910 CRYPTO_free,BUF_strdup,CRYPTO_free,BUF_strdup,BIO_snprintf,CRYPTO_free,BUF_strdup,BIO_snprintf,CRYPTO_free,BUF_strdup,BIO_ctrl,BIO_ctrl,BIO_ctrl,BIO_callback_ctrl,	11_2_01202910
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01214910 CRYPTO_free,	11_2_01214910
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124E910 CMS_set1_signers_certs,OBJ_obj2nid,ERR_put_error,sk_num,sk_value,sk_num,sk_value,sk_num,CRYPTO_add_lock,EVP_PKEY_free,X509_get_pubkey,X509_free,sk_num,sk_value,sk_num,CRYPTO_add_lock,EVP_PKEY_free,X509_get_pubkey,X509_free,sk_num,	11_2_0124E910
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01212960 SEED_cfb128_encrypt,	11_2_01212960
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2940 CRYPTO_push_info_,CRYPTO_is_mem_check_on,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_malloc,lh_new,CRYPTO_free,CRYPTO_THREADID_current,lh_insert,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,	11_2_011B2940
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D2940 CRYPTO_gcm128_encrypt,	11_2_011D2940
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01254940 sk_new_null,CRYPTO_malloc,BUF_strdup,sk_push,CRYPTO_free,	11_2_01254940
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01250940 ERR_put_error,AES_set_encrypt_key,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,OPENSSL_cleanse,AES_wrap_key,ASN1_STRING_set0,	11_2_01250940
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EE970 ASN1_STRING_new,ERR_put_error,CRYPTO_free,ASN1_STRING_free,i2d_DHxparams,i2d_DHparams,BN_to_ASN1_INTEGER,i2d_ASN1_INTEGER,ASN1_INTEGER_free,OBJ_nid2obj,X509_PUBKEY_set0_param,	11_2_011EE970
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F4970 CRYPTO_malloc,ERR_put_error,	11_2_011F4970
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01210950 memmove,BUF_reverse,BUF_reverse,BUF_reverse,SHA1,CRYPTO_memcmp,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,	11_2_01210950
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123C9A0 X509_STORE_get1_certs,sk_new_null,CRYPTO_lock,CRYPTO_lock,X509_STORE_get_by_subject,sk_free,X509_CRL_free,X509_free,CRYPTO_lock,CRYPTO_lock,sk_free,sk_value,CRYPTO_add_lock,sk_push,CRYPTO_lock,X509_free,X509_free,sk_pop_free,CRYPTO_lock,	11_2_0123C9A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C6980 BF_encrypt,	11_2_011C6980
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01222980 X509_ocspid_print,BIO_printf,i2d_X509_NAME,CRYPTO_malloc,i2d_X509_NAME,EVP_sha1,EVP_Digest,BIO_printf,CRYPTO_free,BIO_printf,EVP_sha1,EVP_Digest,BIO_printf,BIO_printf,CRYPTO_free,	11_2_01222980
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01228980 EVP_PKEY_asn1_add_alias,CRYPTO_malloc,memset,EVP_PKEY_asn1_add0,EVP_PKEY_asn1_free,	11_2_01228980
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0122A980 ASN1_item_ndef_i2d,CRYPTO_malloc,ASN1_item_ndef_i2d,	11_2_0122A980
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011FE9B0 CRYPTO_malloc,ERR_put_error,ECDSA_OpenSSL,ENGINE_get_default_ECDSA,EVP_PKEY_CTX_get_app_data,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,	11_2_011FE9B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01218990 EVP_PKEY_CTX_new,ENGINE_init,ERR_put_error,ENGINE_get_pkey_meth_engine,ENGINE_get_pkey_meth,EVP_PKEY_meth_find,CRYPTO_malloc,ENGINE_finish,ERR_put_error,CRYPTO_add_lock,EVP_PKEY_CTX_free,	11_2_01218990
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012689E0 TS_RESP_CTX_free,X509_free,EVP_PKEY_free,X509_free,sk_pop_free,ASN1_OBJECT_free,sk_pop_free,ASN1_OBJECT_free,sk_free,ASN1_INTEGER_free,ASN1_INTEGER_free,ASN1_INTEGER_free,CRYPTO_free,	11_2_012689E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0126A9E0 X509_VERIFY_PARAM_get_depth,TS_RESP_verify_signature,TS_TST_INFO_get_version,ERR_put_error,ERR_put_error,ERR_put_error,X509_free,X509_ALGOR_free,CRYPTO_free,	11_2_0126A9E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A9F0 ERR_free_strings,CRYPTO_lock,CRYPTO_lock,	11_2_0120A9F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012529F0 X509_STORE_CTX_get0_policy_tree,EVP_PKEY_derive,EVP_CipherInit_ex,EVP_CipherUpdate,CRYPTO_malloc,EVP_CipherUpdate,OPENSSL_cleanse,CRYPTO_free,EVP_CIPHER_CTX_cleanup,EVP_PKEY_CTX_free,	11_2_012529F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012129C0 SEED_ecb_encrypt,	11_2_012129C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012649C0 UI_add_info_string,ERR_put_error,CRYPTO_malloc,sk_new_null,sk_push,	11_2_012649C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012409D0 CRYPTO_malloc,ERR_put_error,memcpy,	11_2_012409D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D69E0 BN_set_word,CRYPTO_free,	11_2_011D69E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F49E0 CRYPTO_add_lock,	11_2_011F49E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01216820 EVP_MD_CTX_cleanup,OPENSSL_cleanse,CRYPTO_free,	11_2_01216820
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120A830 CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,strncpy,strerror,strncpy,CRYPTO_lock,	11_2_0120A830
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123E830 CRYPTO_free,ASN1_PCTX_free,sk_pop_free,CRYPTO_free,	11_2_0123E830
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0124E830 CMS_SignerInfo_set1_signer_cert,CRYPTO_add_lock,EVP_PKEY_free,X509_get_pubkey,X509_free,	11_2_0124E830
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CA800 AES_bi_ige_encrypt,OpenSSLDie,OpenSSLDie,OpenSSLDie,AES_encrypt,AES_encrypt,AES_decrypt,AES_decrypt,	11_2_011CA800
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D0800 SEED_cfb128_encrypt,SEED_encrypt,CRYPTO_cfb128_encrypt,	11_2_011D0800
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2830 CRYPTO_dbg_get_options,	11_2_011B2830
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D6830 bn_expand2,CRYPTO_free,	11_2_011D6830
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01200810 BIO_new,CRYPTO_malloc,ERR_put_error,BIO_set,CRYPTO_free,	11_2_01200810
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B2820 CRYPTO_dbg_set_options,	11_2_011B2820
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E8820 RSA_setup_blinding,BN_CTX_new,BN_CTX_start,BN_CTX_get,ERR_put_error,ERR_put_error,RAND_status,RAND_add,BN_BLINDING_create_param,ERR_put_error,BN_BLINDING_thread_id,CRYPTO_THREADID_current,BN_CTX_end,BN_CTX_free,BN_free,	11_2_011E8820
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0122A867 ASN1_item_ndef_i2d,CRYPTO_malloc,ASN1_item_ndef_i2d,	11_2_0122A867
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EC850 DSO_convert_filename,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,BUF_strlcpy,	11_2_011EC850
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120E870 EVP_EncryptUpdate,OpenSSLDie,memcpy,memcpy,memcpy,	11_2_0120E870
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121C870 ASN1_item_dup,ASN1_item_i2d,ERR_put_error,ASN1_item_d2i,CRYPTO_free,	11_2_0121C870
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123E870 sk_pop_free,BUF_MEM_free,CRYPTO_free,	11_2_0123E870
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D0840 SEED_ofb128_encrypt,SEED_encrypt,CRYPTO_ofb128_encrypt,	11_2_011D0840
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120E840 EVP_CIPHER_CTX_new,CRYPTO_malloc,memset,	11_2_0120E840
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01244840 hex_to_string,X509V3_add_value,CRYPTO_free,i2v_GENERAL_NAMES,hex_to_string,X509V3_add_value,CRYPTO_free,	11_2_01244840
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D2870 CRYPTO_gcm128_aad,	11_2_011D2870
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D0870 CRYPTO_cbc128_encrypt,	11_2_011D0870
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01218850 ENGINE_init,ERR_put_error,ENGINE_get_pkey_meth_engine,ENGINE_get_pkey_meth,EVP_PKEY_meth_find,CRYPTO_malloc,ENGINE_finish,ERR_put_error,CRYPTO_add_lock,EVP_PKEY_CTX_free,	11_2_01218850
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012568A0 PKCS7_RECIP_INFO_set,ASN1_INTEGER_set,X509_get_issuer_name,X509_NAME_set,ASN1_STRING_free,X509_get_serialNumber,ASN1_STRING_dup,X509_get_pubkey,EVP_PKEY_free,CRYPTO_add_lock,ERR_put_error,EVP_PKEY_free,	11_2_012568A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0125C8A0 COMP_CTX_new,CRYPTO_malloc,CRYPTO_free,	11_2_0125C8A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012148B0 CRYPTO_malloc,	11_2_012148B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012288B0 EVP_PKEY_asn1_new,CRYPTO_malloc,memset,BUF_strdup,BUF_strdup,EVP_PKEY_asn1_free,	11_2_012288B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0123E8B0 sk_num,sk_value,strncmp,sk_num,sk_num,sk_new_null,CRYPTO_malloc,sk_new,CRYPTO_malloc,strncpy,sk_push,ERR_put_error,CRYPTO_free,ASN1_PCTX_free,sk_pop_free,CRYPTO_free,ERR_put_error,	11_2_0123E8B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D8880 BN_bn2dec,BN_num_bits,CRYPTO_malloc,CRYPTO_malloc,BN_dup,BN_div_word,BIO_snprintf,BIO_snprintf,ERR_put_error,CRYPTO_free,BN_free,CRYPTO_free,	11_2_011D8880
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01252880 CMS_RecipientEncryptedKey_get0_id,	11_2_01252880
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C68B0 BF_ecb_encrypt,BF_encrypt,BF_decrypt,	11_2_011C68B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0120C890 OBJ_add_object,lh_new,OBJ_dup,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,lh_insert,CRYPTO_free,	11_2_0120C890
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012008E0 BIO_dup_chain,CRYPTO_malloc,BIO_set,BIO_ctrl,CRYPTO_dup_ex_data,BIO_push,CRYPTO_free,ERR_put_error,BIO_free,BIO_free,	11_2_012008E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012128E0 SEED_cbc_encrypt,SEED_cbc_encrypt,	11_2_012128E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0122A8E7 CRYPTO_free,	11_2_0122A8E7
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011F68D0 BN_new,BN_new,pqueue_peek,X509_TRUST_get_flags,EC_GROUP_get_curve_GFp,ERR_put_error,EC_GROUP_get_curve_GF2m,BN_num_bits,BN_num_bits,CRYPTO_malloc,BN_bn2bin,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,ASN1_STRING_set,ASN1_STRING_set,ASN1_BIT_STRING_new,CRYPTO_malloc,BN_bn2bin,ASN1_OCTET_STRING_set,ASN1_BIT_STRING_free,ERR_put_error,	11_2_011F68D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012208F0 CRYPTO_free,sk_num,sk_new_null,sk_num,sk_value,sk_new_null,sk_push,ASN1_item_new,OBJ_dup,sk_push,sk_num,CRYPTO_malloc,ASN1_item_free,sk_pop_free,	11_2_012208F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012608F0 CRYPTO_free,BUF_strdup,CRYPTO_free,BUF_strdup,BUF_strdup,sk_insert,ERR_put_error,	11_2_012608F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B28C0 CRYPTO_THREADID_current,lh_delete,lh_insert,CRYPTO_free,	11_2_011B28C0

Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_5db7fa7c-7

Source: EzvizStudioSetups.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: EzvizStudioSetups.exe

Static PE information: certificate valid

Source: C:\Program Files (x86)\hicloud\update_server\ModProperties.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49747 version: TLS 1.2

Source:	Binary string: msvcr90.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003526000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \AudioRender\trunk\WindowsAudioRender\bin\win32\Private_PDB32\AudioRender.pdb source: EzvizStudio.exe, 0000000C.00000002.3017328966.000000006A0FD000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: D:\jenkins\workspace\client_libcasclient\libcasclient\bin\win32\Release\libCASClient.pdb source: EzvizStudio.exe, 0000000C.00000002.3024681516.000000006CE07000.00000002.00000001.01000000.00000046.sdmp
Source:	Binary string: MFCM90.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: f:\code\studio_overseas_2.3.0\target_release\EzvizStudio.pdb source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: E:\code\open_source_code\openssl-1.0.2d\out32dll\ssleay32.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2992572241.0000000000D87000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_SDK_SADP_Win32\Win32\Lib\Sadp.pdby source: EzvizStudio.exe, 0000000C.00000002.3009856039.00000000679C9000.00000002.00000001.01000000.00000054.sdmp
Source:	Binary string: mfc90u.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003769000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: f:\code\studio_overseas_2.3.0\src\EzvizDeviceDiscover\temp\release\EzvizDeviceDiscover.pdb source: EzvizStudio.exe, 0000000C.00000002.3026382549.000000006CF91000.00000002.00000001.01000000.00000053.sdmp
Source:	Binary string: mfc90.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000364A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\work\client\updateserver\trunk\SPUpDateServer\target\startUp.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, startUp.exe, 0000000A.00000000.2094683422.0000000000212000.00000002.00000001.01000000.0000000F.sdmp, startUp.exe, 0000000A.00000002.2991946440.0000000000212000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: d:\Common\TTS\bin\TTSClient.pdb source: EzvizStudio.exe, 0000000C.00000002.3014360987.0000000069675000.00000002.00000001.01000000.00000048.sdmp
Source:	Binary string: D:\jenkins\workspace\m_opensslwrap\label\Civil\libopensslwrap\bin\win32\Release\opensslwrap.pdb source: EzvizStudio.exe, 0000000C.00000002.3019371484.000000006AAA7000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: \SADP\SADP\NpfDetectApp\lib\NpfDetectApp.pdb source: NpfDetectApp.exe, 00000005.00000000.2037807035.00000000009B8000.00000002.00000001.01000000.00000008.sdmp, NpfDetectApp.exe, 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: msvcm90.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \lib\vc60\hpr.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Workplace\svn\components\hlog\trunk\hlog\bin\x86\vs2008_release\hlog.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: \SADP\SADP\NpfDetectApp\lib\NpfDetectApp.pdb@/ source: NpfDetectApp.exe, 00000005.00000000.2037807035.00000000009B8000.00000002.00000001.01000000.00000008.sdmp, NpfDetectApp.exe, 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_SDK_SADP_Win32\Win32\Lib\Sadp.pdb source: EzvizStudio.exe, 0000000C.00000002.3009856039.00000000679C9000.00000002.00000001.01000000.00000054.sdmp
Source:	Binary string: MFCM90U.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\new_svn\hlog\hlog\bin\x86\vs2008_release\hlog.pdb source: EzvizStudio.exe, 0000000C.00000002.3024220244.000000006C60C000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: E:\work\client\updateserver\trunk\SPUpDateServer\target\startUp.pdbe source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, startUp.exe, 0000000A.00000000.2094683422.0000000000212000.00000002.00000001.01000000.0000000F.sdmp, startUp.exe, 0000000A.00000002.2991946440.0000000000212000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: \streamclientunique\trunk\lib\win32\release\streamclient_lib.pdb source: EzvizStudio.exe, 0000000C.00000002.3025144520.000000006CE6B000.00000002.00000001.01000000.00000044.sdmp
Source:	Binary string: O:\work\SdkSource\SADP\InstallNpfApp\Release\NpfDetect.pdb source: NpfDetectApp.exe, 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\code\open_source_code\openssl-1.0.2d\out32dll\libeay32.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2993634458.000000000126F000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: c:\Users\zhoupeipei\Desktop\source\curl\build\Win32\VC9\DLL Release - DLL OpenSSL\libcurl.pdb source: EzvizStudio.exe, 0000000C.00000002.3009397458.000000001003A000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: E:\work\client\updateserver\trunk\SPUpDateServer\target\SPUpDateServer.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2992327628.0000000000C53000.00000002.00000001.01000000.00000010.sdmp, SPUpDateServer.exe, 0000000B.00000000.2102369796.0000000000C53000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: d:\jenkins\workspace\huarr_ShowRemConfig_2.2\code\win32\lib\ShowRemConfig.pdb source: EzvizStudio.exe, 0000000C.00000002.3011740879.0000000069068000.00000002.00000001.01000000.0000004E.sdmp
Source:	Binary string: h:\code\SystemTrans\trunk\SystemTrans\Bin\win32\vc60_Release\SystemTransform.pdb4 source: EzvizStudio.exe, 0000000C.00000002.3001863621.0000000006DCB000.00000002.00000001.01000000.0000004A.sdmp
Source:	Binary string: \ExceptionHandler\Release\ExceptionHandler.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996792577.000000006C897000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \lib\vc60\hpr.pdb# source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\openssl-1.0.1g\out32dll\libeay32.pdb source: EzvizStudio.exe, 0000000C.00000002.2994139762.000000000176F000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: D:\Qt\qwt-6.1.0\lib\qwt.pdb source: EzvizStudio.exe, 0000000C.00000002.3010479320.0000000067E86000.00000002.00000001.01000000.0000004F.sdmp
Source:	Binary string: MFCM90.i386.pdb0 source: update_server.tmp, 00000008.00000003.2095015184.0000000003885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\hplug\bin\x86\vs2008_release\hplug.pdb source: EzvizStudio.exe, 0000000C.00000002.3018522155.000000006AA29000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: \shipin7\Client\update_new\ModProperties\Release\ModProperties.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, ModProperties.exe, 00000009.00000000.2094458716.0000000000AE3000.00000002.00000001.01000000.0000000E.sdmp, ModProperties.exe, 00000009.00000002.2095209397.0000000000AE3000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: d:\jenkins\workspace\m_udt\label\Civil\libudt\lib\Release\udt.pdb source: EzvizStudio.exe, 0000000C.00000002.3000741813.0000000006823000.00000002.00000001.01000000.00000047.sdmp
Source:	Binary string: \shipin7_client_QT\src\CrashReporter\CrashReporter\Release\CrashReporter.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \SVN\Analyse\trunk\New_AnalyzeData\project\windows\Bin\VC60\Release\AnalyzeData.pdb source: EzvizStudio.exe, 0000000C.00000002.2998762504.0000000004DA3000.00000002.00000001.01000000.00000034.sdmp, EzvizStudio.exe, 0000000C.00000002.3001514263.0000000006D13000.00000002.00000001.01000000.00000049.sdmp
Source:	Binary string: E:\work\client\updateserver\trunk\SPUpDateServer\target\SPUpDate.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2997042386.000000006C8C4000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: f:\code\studio_overseas_2.3.0\src\Skin\temp\release\DefaultSkin.pdb source: EzvizStudioSetups.tmp, 00000001.00000003.2117946314.00000000037E5000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\openssl-1.0.1g\out32dll\libeay32.pdb source: EzvizStudio.exe, 0000000C.00000002.2994139762.000000000176F000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: msvcp90.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003526000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mfc90.i386.pdbpmxt source: update_server.tmp, 00000008.00000003.2095015184.000000000364A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: h:\code\SystemTrans\trunk\SystemTrans\Bin\win32\vc60_Release\SystemTransform.pdb source: EzvizStudio.exe, 0000000C.00000002.3001863621.0000000006DCB000.00000002.00000001.01000000.0000004A.sdmp
Source:	Binary string: \ExceptionHandler\Release\ExceptionHandler.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996792577.000000006C897000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: f:\code\studio_overseas_2.3.0\src\LocalConfig\Release\LocalDB.pdb source: EzvizStudio.exe, 0000000C.00000002.3019024311.000000006AA67000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: MFCM90U.i386.pdb0 source: update_server.tmp, 00000008.00000003.2095015184.0000000003885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\work\client\updateserver\trunk\SPUpDateClientLib\Release\SPUpDateClientLib.pdb source: EzvizStudio.exe, 0000000C.00000002.3023584224.000000006C413000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: \streamclientunique\trunk\lib\win32\release\streamclient_lib.pdb source: EzvizStudio.exe, 0000000C.00000002.3025144520.000000006CE6B000.00000002.00000001.01000000.00000044.sdmp
Source:	Binary string: e:\code_svn\common\SafeStumClient\branches\v1.0.2\bin\Release\StunClientLib.pdb source: EzvizStudio.exe, 0000000C.00000002.3026823584.000000006F7C8000.00000002.00000001.01000000.00000045.sdmp
Source:	Binary string: D:\jenkins\workspace\client_pushclient\client_pushclient\bin\PushClient\Release\PushClient.pdb source: EzvizStudio.exe, 0000000C.00000002.3025983857.000000006CF30000.00000002.00000001.01000000.00000040.sdmp
Source:	Binary string: d:\delivery\projects\PJ03D201782869\source_project\hpr\lib\VS2008\32\hpr.pdb source: EzvizStudio.exe, 0000000C.00000002.3023931930.000000006C454000.00000002.00000001.01000000.00000019.sdmp

Spreading

Yara detected PrivateLoader

Source: Yara match

File source: C:\Program Files (x86)\Ezviz Studio\is-22416.tmp, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0047A964 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_0047A964
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00470C84 FindFirstFileA,FindNextFileA,FindClose,	1_2_00470C84
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00451668 FindFirstFileA,GetLastError,	1_2_00451668
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00460594 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00460594
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00492760 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00492760
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0047884C FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_0047884C
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00460A10 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00460A10
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0045F008 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045F008
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0047A964 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	8_2_0047A964
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00470C84 FindFirstFileA,FindNextFileA,FindClose,	8_2_00470C84
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00451668 FindFirstFileA,GetLastError,	8_2_00451668
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00460594 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	8_2_00460594
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00492760 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	8_2_00492760
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0047884C FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	8_2_0047884C
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00460A10 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	8_2_00460A10
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0045F008 FindFirstFileA,FindNextFileA,FindClose,	8_2_0045F008
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Code function: 10_2_00211000 FindFirstFileA,FindClose,	10_2_00211000
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B47A0 OPENSSL_DIR_read,_errno,_errno,_errno,malloc,malloc,memset,malloc,free,_errno,FindFirstFileA,free,free,free,_errno,FindNextFileA,strncpy,_errno,	11_2_011B47A0

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

Yara detected PrivateLoader

Source: Yara match

File source: C:\Program Files (x86)\Ezviz Studio\is-22416.tmp, type: DROPPED

Source: global traffic	HTTP traffic detected: POST /api/other/version/check HTTP/1.1Host: api.ezvizlife.comAccept: /Content-Length: 32Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: POST /api/other/version/check HTTP/1.1Host: api.ezvizlife.comAccept: /Content-Length: 31Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: POST /api/other/version/check HTTP/1.1Host: api.ezvizlife.comAccept: /Content-Length: 32Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: POST /api/other/version/check HTTP/1.1Host: api.ezvizlife.comAccept: /Content-Length: 31Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: POST /api/other/version/check HTTP/1.1Host: api.ezvizlife.comAccept: /Content-Length: 32Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View	JA3 fingerprint: 0bfd7fc4b72e174811c409f13a8b6fed
Source: Joe Sandbox View	JA3 fingerprint: 535aca3d99fc247509cd50933cd71d37

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe

Code function: 11_2_01202140 WSASetLastError,recv,BIO_clear_flags,WSAGetLastError,BIO_set_flags,

11_2_01202140

Source: EzvizStudio.exe, 0000000C.00000002.3021614841.000000006BA05000.00000002.00000001.01000000.00000020.sdmp

String found in binary or memory: kQLocalSocketPrivate::completeAsyncReadQLocalSocketPrivate::startAsyncReadQLocalSocket::waitForReadyRead WaitForSingleObject failed with error code %d.\\.\pipe\QLocalSocket::connectToServer%1: %2QLocalServerPrivate::addListener1_q_onNewConnection()QLocalServerPrivate::_q_onNewConnectione-islem.kktcmerkezbankasi.org2148*.EGO.GOV.TR2087MD5 Collisions Inc. (http://www.phreedom.org/md5)41UTN-USERFirst-Hardware72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0Digisign Server ID - (Enrich)1276011370Digisign Server ID (Enrich)12000170511846442971184640175DigiNotar Public CA 20251e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Extended Validation CAd6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar PKIoverheid CA Organisatie - G220001983DigiNotar PKIoverheid CA Overheid en Bedrijven20015536120000515120000505DigiNotar Cyber CA1200005251184640176DigiNotar Qualified CA5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41CertiID Enterprise Certificate Authoritya4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21DigiNotar Root CA G20a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Services 1024 CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Root CA0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4c*.google.com05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56global trusteed8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0login.live.comb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0addons.mozilla.org92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43login.skype.come9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:473e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:7139:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29login.yahoo.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3www.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06mail.google.com04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1eSTOULCNOStateOrProvinceNameOrganizationalUnitNameLocalityNameCountryNameCommonNameOrganizationQMap(-----END CERTIFICATE----- equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: api.ezvizlife.com

Source: unknown

HTTP traffic detected: POST /api/other/version/check HTTP/1.1Host: api.ezvizlife.comAccept: */*Content-Length: 32Content-Type: application/x-www-form-urlencoded

Source: update_server.tmp, 00000008.00000003.2095015184.0000000003769000.00000004.00001000.00020000.00000000.sdmp, update_server.tmp, 00000008.00000003.2095015184.000000000364A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ftp://http://HTTP/1.0
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://%1/image/%2/1_mobile.jpeg
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://%1/image/%2/1_mobile.jpeg_/image/DVR/1/image/IPC/1http://%1%2_0_1d
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://%s/statistics.do
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://%s/statistics.doDataUploadTaskThread::run
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://%s/statistics.doOperatorTaskThread::run
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http:///assets/imgs/public/companyDevice_web.jpegx
Source: SPUpDateServer.exe	String found in binary or memory: http://Dump.ys7.com:10086/uploadDump
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2992327628.0000000000C53000.00000002.00000001.01000000.00000010.sdmp, SPUpDateServer.exe, 0000000B.00000000.2102369796.0000000000C53000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://Dump.ys7.com:10086/uploadDumpSPUpDateServer_%sSetUnhandledExceptionFilter
Source: SPUpDateServer.exe, 0000000B.00000002.2995375098.0000000002F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Dump.ys7.com:10086/uploadDumpoleSy
Source: EzvizStudio.exe, 0000000C.00000002.3021614841.000000006BA05000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: http://bugreports.qt-project.org/
Source: EzvizStudio.exe, 0000000C.00000002.3021614841.000000006BA05000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: http://bugreports.qt-project.org/QHttpNetworkConnectionChannel::_q_receiveReply()
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996264641.0000000010045000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://curl.haxx.se/V
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996264641.0000000010045000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://curl.haxx.se/docs/copyright.htmlD
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996177230.0000000010039000.00000002.00000001.01000000.00000013.sdmp, EzvizStudio.exe, 0000000C.00000002.3009397458.000000001003A000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://https://.jpg4
Source: update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp, EzvizStudio.exe, 0000000C.00000002.3024220244.000000006C60C000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: http://logging.apache.org/log4j/codes.html#tbr_fnp_not_setThe
Source: EzvizStudio.exe, 0000000C.00000002.3004270035.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: EzvizStudio.exe, 0000000C.00000002.3024681516.000000006CE07000.00000002.00000001.01000000.00000046.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: EzvizStudio.exe, 0000000C.00000002.3024681516.000000006CE07000.00000002.00000001.01000000.00000046.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcd.com0&
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: EzvizStudio.exe, 0000000C.00000002.3003903135.0000000008758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trolltech.com/xml/features/report-whitespace-only-CharData
Source: EzvizStudio.exe, 0000000C.00000002.3003903135.0000000008758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trolltech.com/xml/features/report-whitespace-only-CharDataC
Source: EzvizStudio.exe, 0000000C.00000002.3003903135.0000000008758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trolltech.com/xml/features/report-whitespace-only-CharDataw
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.ezviz7.com/help/device/connect.html
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.ezviz7.com/help/device/connect.htmlNo
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp, EzvizStudio.exe, 0000000C.00000002.3003903135.0000000008758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ezvizlife.com
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.ezvizlife.com/
Source: update_server.tmp, update_server.tmp, 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: EzvizStudio.exe, 0000000C.00000002.3017636861.000000006A2A4000.00000002.00000001.01000000.0000002F.sdmp	String found in binary or memory: http://www.isapi.org/ver20/XMLSchema
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2992669626.0000000000D98000.00000002.00000001.01000000.00000016.sdmp, SPUpDateServer.exe, 0000000B.00000002.2993749226.00000000012D0000.00000002.00000001.01000000.00000015.sdmp, EzvizStudio.exe, 0000000C.00000002.2994318343.00000000017C8000.00000002.00000001.01000000.0000002C.sdmp, EzvizStudio.exe, 0000000C.00000002.2994616263.0000000001822000.00000002.00000001.01000000.0000002D.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, SPUpDateServer.exe, 0000000B.00000002.2993634458.000000000126F000.00000002.00000001.01000000.00000015.sdmp, EzvizStudio.exe, 0000000C.00000002.2994139762.000000000176F000.00000002.00000001.01000000.0000002C.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2993634458.000000000126F000.00000002.00000001.01000000.00000015.sdmp, EzvizStudio.exe, 0000000C.00000002.2994139762.000000000176F000.00000002.00000001.01000000.0000002C.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
Source: EzvizStudio.exe, 0000000C.00000002.3021614841.000000006BA05000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: http://www.phreedom.org/md5)
Source: EzvizStudio.exe, 0000000C.00000002.3021614841.000000006BA05000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: http://www.phreedom.org/md5)41UTN-USERFirst-Hardware72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0D
Source: EzvizStudioSetups.exe, 00000000.00000003.1745799672.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, EzvizStudioSetups.exe, 00000000.00000003.1746078055.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, EzvizStudioSetups.tmp, EzvizStudioSetups.tmp, 00000001.00000000.1746672020.0000000000401000.00000020.00000001.01000000.00000004.sdmp, update_server.exe, 00000007.00000003.2058441897.0000000002360000.00000004.00001000.00020000.00000000.sdmp, update_server.exe, 00000007.00000003.2058625890.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, update_server.tmp, update_server.tmp, 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: EzvizStudioSetups.exe, 00000000.00000003.1745799672.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, EzvizStudioSetups.exe, 00000000.00000003.1746078055.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, EzvizStudioSetups.tmp, 00000001.00000000.1746672020.0000000000401000.00000020.00000001.01000000.00000004.sdmp, update_server.exe, 00000007.00000003.2058441897.0000000002360000.00000004.00001000.00020000.00000000.sdmp, update_server.exe, 00000007.00000003.2058625890.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, update_server.tmp, 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: EzvizStudio.exe, 0000000C.00000002.3011740879.0000000069068000.00000002.00000001.01000000.0000004E.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: EzvizStudio.exe, 0000000C.00000002.3011740879.0000000069068000.00000002.00000001.01000000.0000004E.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll1.2.6-rbfile
Source: EzvizStudio.exe, 0000000C.00000002.3011740879.0000000069068000.00000002.00000001.01000000.0000004E.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllr
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://%1%2_mobile.jpeg
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://%1%2_mobile.jpeg/image/DVR/1/image/IPC/1
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://%1%2_mobile.jpeg/image/DVR/1/image/IPC/11slotAddSearchDevice(const
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://%1%2_mobile.jpeg/image/DVR/1/image/IPC/1Please
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://%1%2_mobile.jpeg1slotDeviceAdd(const
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://%1/friend/list.htm
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://%1/friend/list.htmEv_MainFrameWidget::appOpenFriendList
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://%2_mobile.jpeghttps://http://:/ToolKit/image/default/Failed.png:/ToolKit/image/default/Faile
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2994571027.0000000002E15000.00000004.00000020.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2997042386.000000006C8C4000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://api.ezviz7.com
Source: SPUpDateServer.exe, 0000000B.00000002.2994571027.0000000002E15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezviz7.comet
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2997042386.000000006C8C4000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://api.ezviz7.comversionRespnewestVersionoption2updateUrloption1limitVersionsUpdateUrlsMd5inter
Source: SPUpDateServer.exe, 0000000B.00000003.2842003555.0000000002E76000.00000004.00000020.00020000.00000000.sdmp, EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://api.ezvizlife.com
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp, EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/check
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/check)
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/check.Et.
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/check9
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checkI
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checka
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checkeAppender
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checkegion=
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checkegion=J
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checkenderd
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checkle
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checknder
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checkoutMcz
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checkpend
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checkppend.F
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checkq
Source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checksessionId=&clientType=9sessionId=&clientType=9https
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checktternLayoutp
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.com/api/other/version/checky
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ezvizlife.comtrue
Source: EzvizStudio.exe, 0000000C.00000002.3025983857.000000006CF30000.00000002.00000001.01000000.00000040.sdmp	String found in binary or memory: https://bpush.ys7.com
Source: EzvizStudio.exe, 0000000C.00000002.3025983857.000000006CF30000.00000002.00000001.01000000.00000040.sdmp	String found in binary or memory: https://bpush.ys7.comhttps://push.ys7.comPushClient_register
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mfs.ezvizlife.com/EzvizStudio_Small.exe
Source: EzvizStudio.exe, 0000000C.00000002.3025983857.000000006CF30000.00000002.00000001.01000000.00000040.sdmp	String found in binary or memory: https://push.ys7.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.158.49.118:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0042EEF4 NtdllDefWindowProc_A,	1_2_0042EEF4
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00423AF4 NtdllDefWindowProc_A,	1_2_00423AF4
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00412548 NtdllDefWindowProc_A,	1_2_00412548
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00455800 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00455800
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00473F28 NtdllDefWindowProc_A,	1_2_00473F28
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F8523F0 NpfDetectEntry,GetModuleHandleA,GetProcAddress,NtQuerySystemInformation,_malloc,NtQuerySystemInformation,_wprintf,_wprintf,_wprintf,_wprintf,CreateEventA,_malloc,NtQuerySystemInformation,	5_2_6F8523F0
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F852558 _wprintf,_wprintf,_wprintf,_wprintf,CreateEventA,_malloc,NtQuerySystemInformation,	5_2_6F852558
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F851C10 NtQueryObject,GetModuleHandleA,GetProcAddress,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,_wprintf,SetEvent,	5_2_6F851C10
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0042EEF4 NtdllDefWindowProc_A,	8_2_0042EEF4
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00423AF4 NtdllDefWindowProc_A,	8_2_00423AF4
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00412548 NtdllDefWindowProc_A,	8_2_00412548
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00455800 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	8_2_00455800
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00473F28 NtdllDefWindowProc_A,	8_2_00473F28

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Code function: 1_2_0042E6DC: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042E6DC

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe

Code function: 5_2_009B15A0 OpenSCManagerA,CloseServiceHandle,OpenServiceA,DeleteService,CloseServiceHandle,CloseServiceHandle,NpfSetSuccess,OpenSCManagerA,OpenServiceA,DeleteService,CloseServiceHandle,CloseServiceHandle,NpfSetSuccess,NpfDetectEntry,

5_2_009B15A0

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe

Code function: 11_2_00D63F50 AuditLookupCategoryNameW,AuditQueryGlobalSaclW,AuditSetGlobalSaclW,AuditSetSystemPolicy,ChangeServiceConfigA,ERR_put_error,ControlServiceExA,BUF_MEM_grow_clean,ControlService,ERR_put_error,CreatePrivateObjectSecurityEx,CreatePrivateObjectSecurityWithMultipleInheritance,CreateProcessAsUserA,CreateServiceW,

11_2_00D63F50

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_0040936C
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00453FD0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	1_2_00453FD0
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Code function: 7_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	7_2_0040936C
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00453FD0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	8_2_00453FD0

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_00408330	0_2_00408330
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00488444	1_2_00488444
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0046C5C4	1_2_0046C5C4
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00434CFC	1_2_00434CFC
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0047B5CE	1_2_0047B5CE
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00463B8C	1_2_00463B8C
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004822A0	1_2_004822A0
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004444A4	1_2_004444A4
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0045C87C	1_2_0045C87C
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004308A0	1_2_004308A0
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00444B9C	1_2_00444B9C
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00444FA8	1_2_00444FA8
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004813C8	1_2_004813C8
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0043D784	1_2_0043D784
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00459850	1_2_00459850
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00465BDC	1_2_00465BDC
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0042FD30	1_2_0042FD30
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00443EFC	1_2_00443EFC
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00433FF8	1_2_00433FF8
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_009B5348	5_2_009B5348
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F8648E4	5_2_6F8648E4
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F867EB7	5_2_6F867EB7
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F865E0C	5_2_6F865E0C
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F85EBED	5_2_6F85EBED
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F86637E	5_2_6F86637E
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F858AF0	5_2_6F858AF0
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F85C262	5_2_6F85C262
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F8611A2	5_2_6F8611A2
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F8668F0	5_2_6F8668F0
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Code function: 7_2_00408330	7_2_00408330
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00488444	8_2_00488444
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0046C5C4	8_2_0046C5C4
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00434CFC	8_2_00434CFC
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0047B5CE	8_2_0047B5CE
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00463B8C	8_2_00463B8C
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_004822A0	8_2_004822A0
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_004444A4	8_2_004444A4
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0045C87C	8_2_0045C87C
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_004308A0	8_2_004308A0
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00444B9C	8_2_00444B9C
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00444FA8	8_2_00444FA8
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_004813C8	8_2_004813C8
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0043D784	8_2_0043D784
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00459850	8_2_00459850
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00465BDC	8_2_00465BDC
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0042FD30	8_2_0042FD30
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00443EFC	8_2_00443EFC
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00433FF8	8_2_00433FF8
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D648D0	11_2_00D648D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D66070	11_2_00D66070
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D649EB	11_2_00D649EB
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D62950	11_2_00D62950
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D6528B	11_2_00D6528B
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D64D80	11_2_00D64D80
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D56ED0	11_2_00D56ED0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D51EB0	11_2_00D51EB0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D71660	11_2_00D71660
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D67F50	11_2_00D67F50
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D64740	11_2_00D64740
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CE150	11_2_011CE150
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E4170	11_2_011E4170
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CC1C0	11_2_011CC1C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C6010	11_2_011C6010
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_0121A050	11_2_0121A050
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C00C0	11_2_011C00C0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C20E0	11_2_011C20E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BA310	11_2_011BA310
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D4330	11_2_011D4330
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CA360	11_2_011CA360
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D23D0	11_2_011D23D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C6210	11_2_011C6210
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C2200	11_2_011C2200
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D2250	11_2_011D2250
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C4530	11_2_011C4530
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01266440	11_2_01266440
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D4470	11_2_011D4470
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C0700	11_2_011C0700
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011DC760	11_2_011DC760
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BE620	11_2_011BE620
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D2690	11_2_011D2690
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01208680	11_2_01208680
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C26E0	11_2_011C26E0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E4910	11_2_011E4910
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01202910	11_2_01202910
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D2940	11_2_011D2940
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C6980	11_2_011C6980
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D29E8	11_2_011D29E8
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D29E6	11_2_011D29E6
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CA800	11_2_011CA800
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BA8B0	11_2_011BA8B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BE8F0	11_2_011BE8F0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012668D0	11_2_012668D0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CAB19	11_2_011CAB19
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01208B5B	11_2_01208B5B
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C2BE0	11_2_011C2BE0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01208A20	11_2_01208A20
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C4A10	11_2_011C4A10
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D0A10	11_2_011D0A10
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011E8A20	11_2_011E8A20
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D2A56	11_2_011D2A56
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011DEAB0	11_2_011DEAB0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B4AD0	11_2_011B4AD0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CAD40	11_2_011CAD40
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C6DB0	11_2_011C6DB0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C4DF0	11_2_011C4DF0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D2C10	11_2_011D2C10
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BAC08	11_2_011BAC08
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C2C07	11_2_011C2C07
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C4C00	11_2_011C4C00
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011CEC20	11_2_011CEC20
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D2CB8	11_2_011D2CB8
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D2CB6	11_2_011D2CB6
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011DECE0	11_2_011DECE0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C8F50	11_2_011C8F50
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011BAF40	11_2_011BAF40
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011D6F60	11_2_011D6F60
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011DCF80	11_2_011DCF80
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C2FF0	11_2_011C2FF0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C2E00	11_2_011C2E00
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011C0E20	11_2_011C0E20

Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00405964 appears 103 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00406A2C appears 38 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 0045618C appears 68 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00403400 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00455F80 appears 95 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00451F4C appears 88 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 0040785C appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00408B74 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00403494 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00445808 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00445AD8 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00403684 appears 211 times
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: String function: 00433F10 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00405964 appears 103 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00406A2C appears 38 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 0045618C appears 68 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00403400 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00455F80 appears 95 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00451F4C appears 88 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 0040785C appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00408B74 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00403494 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00445808 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00445AD8 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00403684 appears 211 times
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: String function: 00433F10 appears 32 times
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: String function: 00D85B70 appears 166 times
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: String function: 011B2350 appears 178 times
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: String function: 00D85396 appears 47 times
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: String function: 011B1C80 appears 163 times
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: String function: 012244B0 appears 40 times
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: String function: 0126DE90 appears 427 times
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: String function: 00D85306 appears 78 times
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: String function: 01204770 appears 93 times
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: String function: 011B1C10 appears 39 times
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: String function: 01224860 appears 37 times
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: String function: 6F85D2D0 appears 38 times

Source: EzvizStudioSetups.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: EzvizStudioSetups.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: EzvizStudioSetups.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: EzvizStudioSetups.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: EzvizStudioSetups.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: EzvizStudioSetups.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-NGVJB.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: is-ED0L2.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-ED0L2.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-ED0L2.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-ED0L2.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-ED0L2.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-3N6JU.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: VAX COFF executable, sections 52, created Sat Mar 7 05:34:56 1970, not stripped, version 79
Source: is-8CTED.tmp.1.dr	Static PE information: Resource name: MFILES type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: is-8CTED.tmp.1.dr	Static PE information: Resource name: MFILESDRV type: PE32 executable (native) Intel 80386, for MS Windows
Source: is-8CTED.tmp.1.dr	Static PE information: Resource name: X64 type: PE32+ executable (console) x86-64, for MS Windows

Source: EzvizStudioSetups.exe, 00000000.00000003.1745799672.00000000024E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs EzvizStudioSetups.exe
Source: EzvizStudioSetups.exe, 00000000.00000003.1746078055.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs EzvizStudioSetups.exe

Source: EzvizStudioSetups.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: is-2SHJB.tmp.1.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: _RegDLL.tmp.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: sus32.troj.evad.winEXE@18/459@2/1

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_0040936C
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00453FD0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	1_2_00453FD0
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Code function: 7_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	7_2_0040936C
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00453FD0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	8_2_00453FD0

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Code function: 1_2_004547F8 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,

1_2_004547F8

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: OpenSCManagerA,GetModuleFileNameA,_strrchr,_strncpy,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,CreateServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,		5_2_009B1000
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: AuditLookupCategoryNameW,AuditQueryGlobalSaclW,AuditSetGlobalSaclW,AuditSetSystemPolicy,ChangeServiceConfigA,ERR_put_error,ControlServiceExA,BUF_MEM_grow_clean,ControlService,ERR_put_error,CreatePrivateObjectSecurityEx,CreatePrivateObjectSecurityWithMultipleInheritance,CreateProcessAsUserA,CreateServiceW,		11_2_00D63F50

Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe

Code function: 10_2_00211080 CreateMutexA,GetLastError,OutputDebugStringA,memset,GetModuleFileNameA,strrchr,GetTickCount,GetTickCount,OutputDebugStringA,Sleep,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,memset,sprintf,OutputDebugStringA,Sleep,Sleep,OutputDebugStringA,memset,GetTickCount,memset,sprintf,OutputDebugStringA,ShellExecuteExA,WaitForSingleObject,Sleep,

10_2_00211080

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe

Code function: 0_2_00409AD0 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409AD0

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe

Code function: 5_2_009B1200 OpenSCManagerA,OpenServiceA,CloseServiceHandle,QueryServiceStatus,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceA,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetTickCount,GetTickCount,Sleep,QueryServiceStatus,GetTickCount,GetTickCount,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

5_2_009B1200

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

File created: C:\Program Files (x86)\Ezviz Studio

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

File created: C:\Users\Public\Desktop\Ezviz Studio.lnk

Jump to behavior

Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Mutant created: NULL
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Mutant created: \Sessions\1\BaseNamedObjects\SPUpDateServer_StartUp_Mutex
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Mutant created: \Sessions\1\BaseNamedObjects\SPUpDateServer_Mutex
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Mutant created: \Sessions\1\BaseNamedObjects\ys_update_server

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe

File created: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp

Jump to behavior

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Command line argument: SADP_NPF	5_2_009B15A0
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Command line argument: SADP_NPF	5_2_009B15A0
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Command line argument: NPF	5_2_009B15A0
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Command line argument: NPF	5_2_009B15A0

Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: EzvizStudio.exe, 0000000C.00000002.3019024311.000000006AA67000.00000002.00000001.01000000.00000027.sdmp	Binary or memory string: CREATE TABLE "LocalDeviceDB" ("Series" TEXT(12) NOT NULL,"SerialNO" TEXT(48) NOT NULL,"MAC" TEXT(20),"IPv4Address" TEXT(16),"IPv4SubnetMask" TEXT(16),"DeviceType" INTEGER,"Port" INTEGER,"NumberOfEncoders" INTEGER,"NumberOfHardDisk" INTEGER,"DeviceSoftwareVersion" TEXT(48),"DSPVersion" TEXT(48),"BootTime" TEXT(48),"Result" INTEGER,"DevDesc" TEXT(24),"OEMinfo" TEXT(24),"IPv4Gateway" TEXT(16),"IPv6Address" TEXT(46),"IPv6Gateway" TEXT(46),"IPv6MaskLen" INTEGER,"Support" INTEGER,"DhcpEnabled" INTEGER, "DeviceAbility" INTEGER, "HttpPort" INTEGER,"DigitalChannelNum" INTEGER,"CmsIPv4" TEXT(16),"PassWord" TEXT(32),"UserName" TEXT(32),"CmsPort" INTEGER,"DeviceName" TEXT(64),PRIMARY KEY ("SerialNO" ASC));
Source: update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe

File read: C:\Users\user\Desktop\EzvizStudioSetups.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\EzvizStudioSetups.exe "C:\Users\user\Desktop\EzvizStudioSetups.exe"
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp "C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp" /SL5="$2047E,46096349,63488,C:\Users\user\Desktop\EzvizStudioSetups.exe"
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process created: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe "C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe" /q
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process created: C:\Program Files (x86)\Ezviz Studio\update_server.exe "C:\Program Files (x86)\Ezviz Studio\update_server.exe" /VERYSILENT
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Process created: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp "C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp" /SL5="$104C2,2352971,53760,C:\Program Files (x86)\Ezviz Studio\update_server.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Process created: C:\Program Files (x86)\hicloud\update_server\ModProperties.exe "C:\Program Files (x86)\hicloud\update_server\ModProperties.exe" update_server
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Process created: C:\Program Files (x86)\hicloud\update_server\startUp.exe "C:\Program Files (x86)\hicloud\update_server\startUp.exe"
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Process created: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe "C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe"
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process created: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe "C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe"
Source: unknown	Process created: C:\Program Files (x86)\hicloud\update_server\startUp.exe "C:\Program Files (x86)\hicloud\update_server\startUp.exe"
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp "C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp" /SL5="$2047E,46096349,63488,C:\Users\user\Desktop\EzvizStudioSetups.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process created: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe "C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe" /q	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process created: C:\Program Files (x86)\Ezviz Studio\update_server.exe "C:\Program Files (x86)\Ezviz Studio\update_server.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process created: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe "C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe"	Jump to behavior
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Process created: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp "C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp" /SL5="$104C2,2352971,53760,C:\Program Files (x86)\Ezviz Studio\update_server.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Process created: C:\Program Files (x86)\hicloud\update_server\ModProperties.exe "C:\Program Files (x86)\hicloud\update_server\ModProperties.exe" update_server	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Process created: C:\Program Files (x86)\hicloud\update_server\startUp.exe "C:\Program Files (x86)\hicloud\update_server\startUp.exe"	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Process created: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe "C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Section loaded: npfdetect.dll	Jump to behavior
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\ModProperties.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: spupdate.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: exceptionhandler.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: libcurl.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: hlog.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: ssleay32.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: hpr.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: odbc32.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: dpapi.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: netbios.dll
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: hpr.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: hlog.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: msgcenterqt.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: spupdateclientlib.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: vshowtoolkit.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtpluginmanager.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtxml4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtgui4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtnetwork4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtcore4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtwebkit4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: opensslwrap.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: libcurl.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: ezvizcfgmanager.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: localdb.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: networkapi.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: libgethdsign.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: odbc32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtcore4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtgui4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtxml4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtcore4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: hplug.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtcore4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtcore4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: ssleay32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: ssleay32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: libgethdsign.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: sqlite3.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: dpapi.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: wintab32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: hccore.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: audiorender.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: openal32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtsvg4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: wintab32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: pushclient.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: libppvclient2.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: paho-mqtt3c.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: pthreadvc2.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: quserex.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: udt.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: libdataaccess.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: serialsdk.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qwt.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: qtopengl4.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: opengl32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: glu32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: tcapi.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Section loaded: twinapi.appcore.dll

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: EzvizStudioSetups.exe

Static PE information: certificate valid

Source: EzvizStudioSetups.exe

Static file information: File size 46356824 > 1048576

Source: C:\Program Files (x86)\hicloud\update_server\ModProperties.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source:	Binary string: msvcr90.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003526000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \AudioRender\trunk\WindowsAudioRender\bin\win32\Private_PDB32\AudioRender.pdb source: EzvizStudio.exe, 0000000C.00000002.3017328966.000000006A0FD000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: D:\jenkins\workspace\client_libcasclient\libcasclient\bin\win32\Release\libCASClient.pdb source: EzvizStudio.exe, 0000000C.00000002.3024681516.000000006CE07000.00000002.00000001.01000000.00000046.sdmp
Source:	Binary string: MFCM90.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: f:\code\studio_overseas_2.3.0\target_release\EzvizStudio.pdb source: EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: E:\code\open_source_code\openssl-1.0.2d\out32dll\ssleay32.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2992572241.0000000000D87000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_SDK_SADP_Win32\Win32\Lib\Sadp.pdby source: EzvizStudio.exe, 0000000C.00000002.3009856039.00000000679C9000.00000002.00000001.01000000.00000054.sdmp
Source:	Binary string: mfc90u.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003769000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: f:\code\studio_overseas_2.3.0\src\EzvizDeviceDiscover\temp\release\EzvizDeviceDiscover.pdb source: EzvizStudio.exe, 0000000C.00000002.3026382549.000000006CF91000.00000002.00000001.01000000.00000053.sdmp
Source:	Binary string: mfc90.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000364A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\work\client\updateserver\trunk\SPUpDateServer\target\startUp.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, startUp.exe, 0000000A.00000000.2094683422.0000000000212000.00000002.00000001.01000000.0000000F.sdmp, startUp.exe, 0000000A.00000002.2991946440.0000000000212000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: d:\Common\TTS\bin\TTSClient.pdb source: EzvizStudio.exe, 0000000C.00000002.3014360987.0000000069675000.00000002.00000001.01000000.00000048.sdmp
Source:	Binary string: D:\jenkins\workspace\m_opensslwrap\label\Civil\libopensslwrap\bin\win32\Release\opensslwrap.pdb source: EzvizStudio.exe, 0000000C.00000002.3019371484.000000006AAA7000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: \SADP\SADP\NpfDetectApp\lib\NpfDetectApp.pdb source: NpfDetectApp.exe, 00000005.00000000.2037807035.00000000009B8000.00000002.00000001.01000000.00000008.sdmp, NpfDetectApp.exe, 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: msvcm90.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \lib\vc60\hpr.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Workplace\svn\components\hlog\trunk\hlog\bin\x86\vs2008_release\hlog.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: \SADP\SADP\NpfDetectApp\lib\NpfDetectApp.pdb@/ source: NpfDetectApp.exe, 00000005.00000000.2037807035.00000000009B8000.00000002.00000001.01000000.00000008.sdmp, NpfDetectApp.exe, 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\jenkins\workspace\APP_Package_SDK_SADP_Win32\Win32\Lib\Sadp.pdb source: EzvizStudio.exe, 0000000C.00000002.3009856039.00000000679C9000.00000002.00000001.01000000.00000054.sdmp
Source:	Binary string: MFCM90U.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\new_svn\hlog\hlog\bin\x86\vs2008_release\hlog.pdb source: EzvizStudio.exe, 0000000C.00000002.3024220244.000000006C60C000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: E:\work\client\updateserver\trunk\SPUpDateServer\target\startUp.pdbe source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, startUp.exe, 0000000A.00000000.2094683422.0000000000212000.00000002.00000001.01000000.0000000F.sdmp, startUp.exe, 0000000A.00000002.2991946440.0000000000212000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: \streamclientunique\trunk\lib\win32\release\streamclient_lib.pdb source: EzvizStudio.exe, 0000000C.00000002.3025144520.000000006CE6B000.00000002.00000001.01000000.00000044.sdmp
Source:	Binary string: O:\work\SdkSource\SADP\InstallNpfApp\Release\NpfDetect.pdb source: NpfDetectApp.exe, 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\code\open_source_code\openssl-1.0.2d\out32dll\libeay32.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2993634458.000000000126F000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: c:\Users\zhoupeipei\Desktop\source\curl\build\Win32\VC9\DLL Release - DLL OpenSSL\libcurl.pdb source: EzvizStudio.exe, 0000000C.00000002.3009397458.000000001003A000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: E:\work\client\updateserver\trunk\SPUpDateServer\target\SPUpDateServer.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2992327628.0000000000C53000.00000002.00000001.01000000.00000010.sdmp, SPUpDateServer.exe, 0000000B.00000000.2102369796.0000000000C53000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: d:\jenkins\workspace\huarr_ShowRemConfig_2.2\code\win32\lib\ShowRemConfig.pdb source: EzvizStudio.exe, 0000000C.00000002.3011740879.0000000069068000.00000002.00000001.01000000.0000004E.sdmp
Source:	Binary string: h:\code\SystemTrans\trunk\SystemTrans\Bin\win32\vc60_Release\SystemTransform.pdb4 source: EzvizStudio.exe, 0000000C.00000002.3001863621.0000000006DCB000.00000002.00000001.01000000.0000004A.sdmp
Source:	Binary string: \ExceptionHandler\Release\ExceptionHandler.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996792577.000000006C897000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \lib\vc60\hpr.pdb# source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\openssl-1.0.1g\out32dll\libeay32.pdb source: EzvizStudio.exe, 0000000C.00000002.2994139762.000000000176F000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: D:\Qt\qwt-6.1.0\lib\qwt.pdb source: EzvizStudio.exe, 0000000C.00000002.3010479320.0000000067E86000.00000002.00000001.01000000.0000004F.sdmp
Source:	Binary string: MFCM90.i386.pdb0 source: update_server.tmp, 00000008.00000003.2095015184.0000000003885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\hplug\bin\x86\vs2008_release\hplug.pdb source: EzvizStudio.exe, 0000000C.00000002.3018522155.000000006AA29000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: \shipin7\Client\update_new\ModProperties\Release\ModProperties.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, ModProperties.exe, 00000009.00000000.2094458716.0000000000AE3000.00000002.00000001.01000000.0000000E.sdmp, ModProperties.exe, 00000009.00000002.2095209397.0000000000AE3000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: d:\jenkins\workspace\m_udt\label\Civil\libudt\lib\Release\udt.pdb source: EzvizStudio.exe, 0000000C.00000002.3000741813.0000000006823000.00000002.00000001.01000000.00000047.sdmp
Source:	Binary string: \shipin7_client_QT\src\CrashReporter\CrashReporter\Release\CrashReporter.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \SVN\Analyse\trunk\New_AnalyzeData\project\windows\Bin\VC60\Release\AnalyzeData.pdb source: EzvizStudio.exe, 0000000C.00000002.2998762504.0000000004DA3000.00000002.00000001.01000000.00000034.sdmp, EzvizStudio.exe, 0000000C.00000002.3001514263.0000000006D13000.00000002.00000001.01000000.00000049.sdmp
Source:	Binary string: E:\work\client\updateserver\trunk\SPUpDateServer\target\SPUpDate.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2997042386.000000006C8C4000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: f:\code\studio_overseas_2.3.0\src\Skin\temp\release\DefaultSkin.pdb source: EzvizStudioSetups.tmp, 00000001.00000003.2117946314.00000000037E5000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\openssl-1.0.1g\out32dll\libeay32.pdb source: EzvizStudio.exe, 0000000C.00000002.2994139762.000000000176F000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: msvcp90.i386.pdb source: update_server.tmp, 00000008.00000003.2095015184.0000000003526000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mfc90.i386.pdbpmxt source: update_server.tmp, 00000008.00000003.2095015184.000000000364A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: h:\code\SystemTrans\trunk\SystemTrans\Bin\win32\vc60_Release\SystemTransform.pdb source: EzvizStudio.exe, 0000000C.00000002.3001863621.0000000006DCB000.00000002.00000001.01000000.0000004A.sdmp
Source:	Binary string: \ExceptionHandler\Release\ExceptionHandler.pdb source: update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996792577.000000006C897000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: f:\code\studio_overseas_2.3.0\src\LocalConfig\Release\LocalDB.pdb source: EzvizStudio.exe, 0000000C.00000002.3019024311.000000006AA67000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: MFCM90U.i386.pdb0 source: update_server.tmp, 00000008.00000003.2095015184.0000000003885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\work\client\updateserver\trunk\SPUpDateClientLib\Release\SPUpDateClientLib.pdb source: EzvizStudio.exe, 0000000C.00000002.3023584224.000000006C413000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: \streamclientunique\trunk\lib\win32\release\streamclient_lib.pdb source: EzvizStudio.exe, 0000000C.00000002.3025144520.000000006CE6B000.00000002.00000001.01000000.00000044.sdmp
Source:	Binary string: e:\code_svn\common\SafeStumClient\branches\v1.0.2\bin\Release\StunClientLib.pdb source: EzvizStudio.exe, 0000000C.00000002.3026823584.000000006F7C8000.00000002.00000001.01000000.00000045.sdmp
Source:	Binary string: D:\jenkins\workspace\client_pushclient\client_pushclient\bin\PushClient\Release\PushClient.pdb source: EzvizStudio.exe, 0000000C.00000002.3025983857.000000006CF30000.00000002.00000001.01000000.00000040.sdmp
Source:	Binary string: d:\delivery\projects\PJ03D201782869\source_project\hpr\lib\VS2008\32\hpr.pdb source: EzvizStudio.exe, 0000000C.00000002.3023931930.000000006C454000.00000002.00000001.01000000.00000019.sdmp

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Code function: 1_2_0044C210 LoadLibraryA,GetProcAddress,GetProcAddress,

1_2_0044C210

Source: is-B6PJK.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0xd2c6e
Source: is-8CTED.tmp.1.dr	Static PE information: real checksum: 0xf0b9e should be: 0xef355
Source: _RegDLL.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0xc2b7
Source: is-244RQ.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x22735
Source: is-ED0L2.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0xb2133
Source: _setup64.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: is-2UBBQ.tmp.1.dr	Static PE information: real checksum: 0xf414 should be: 0x11e7d
Source: is-AM4D0.tmp.1.dr	Static PE information: real checksum: 0x671f5 should be: 0x6bf0b
Source: is-LF1B9.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x167d9
Source: is-JRCF8.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x21f45a
Source: is-2SHJB.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x80cfc
Source: is-CD1R1.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x1d9e3
Source: is-TVHVS.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0xa9bb4
Source: is-AN0JV.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0xe4e5e
Source: ISTask.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x1d9e3
Source: EzvizStudioSetups.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0xbc30c
Source: is-B06VR.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x24cff5

Source: is-VUI8I.tmp.1.dr	Static PE information: section name: .rodata
Source: is-VUI8I.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-288KO.tmp.1.dr	Static PE information: section name: .rodata
Source: is-M11TJ.tmp.1.dr	Static PE information: section name: .rodata
Source: is-M11TJ.tmp.1.dr	Static PE information: section name: .data1
Source: is-M11TJ.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-HTMT8.tmp.1.dr	Static PE information: section name: .unwante
Source: is-2SHJB.tmp.1.dr	Static PE information: section name: .stab
Source: is-2SHJB.tmp.1.dr	Static PE information: section name: .stabstr
Source: is-AJQ1H.tmp.1.dr	Static PE information: section name: .rodata
Source: is-K3809.tmp.1.dr	Static PE information: section name: Shared
Source: is-VOK38.tmp.1.dr	Static PE information: section name: SharedDa

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_00406518 push 00406555h; ret	0_2_0040654D
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_00408028 push ecx; mov dword ptr [esp], eax	0_2_0040802D
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: 0_2_00408E5C push 00408E8Fh; ret	0_2_00408E87
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004098B4 push 004098F1h; ret	1_2_004098E9
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00456228 push 00456260h; ret	1_2_00456258
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004062CC push ecx; mov dword ptr [esp], eax	1_2_004062CD
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0045C574 push ecx; mov dword ptr [esp], eax	1_2_0045C579
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00410640 push ecx; mov dword ptr [esp], edx	1_2_00410645
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0040A6C8 push esp; retf	1_2_0040A6D1
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0047E6EC push 0047E7CAh; ret	1_2_0047E7C2
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00412898 push 004128FBh; ret	1_2_004128F3
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004308A0 push ecx; mov dword ptr [esp], eax	1_2_004308A5
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00442E74 push ecx; mov dword ptr [esp], ecx	1_2_00442E78
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00450F04 push 00450F37h; ret	1_2_00450F2F
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0040CF98 push ecx; mov dword ptr [esp], edx	1_2_0040CF9A
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0047323C push ecx; mov dword ptr [esp], edx	1_2_0047323D
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0040F4F8 push ecx; mov dword ptr [esp], edx	1_2_0040F4FA
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00457A94 push 00457AD8h; ret	1_2_00457AD0
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00419B98 push ecx; mov dword ptr [esp], ecx	1_2_00419B9D
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0047FD40 push ecx; mov dword ptr [esp], ecx	1_2_0047FD45

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-JNSH8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCDisplay.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-QEANV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-6999P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-TVHVS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-GJ4VR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-VQDR6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\msvcp90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qtwcodecs4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\libPPVClient2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\EzvizDeviceDiscover.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\RTPRTCP.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\D3DX9_43.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-HTMT8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-AN0JV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\hpr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\npf.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-AO5VR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplug.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\SuperRender.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\IssProc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-NLQUS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\PushClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfc90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-EIJEC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-0O0CK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\MapNetHDD.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\QtGui4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-M6FVE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\ExceptionHandler.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-LF1B9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-8T0ER.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\sadp\Sadp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-9841E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\libCASClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-J9FD8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-244RQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-3V2DB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCPlayBack.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qmng4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-7VSP1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-DE2KP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\dbghelp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-2Q8UL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-NGVJB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qjpcodecs4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfc90u.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\sadp\is-TEKSC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\RemConfig\SerialSDK.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-HI3IC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\StreamClient_V30.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-NFHD7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qtiff4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCPreview.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\is-2CHDE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\mingwm10.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\QtNetwork4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\PlayCtrl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-5ONIC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-A2HSD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-NKU9P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qjpeg4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-FBVS3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-GDFO4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\MP_Render.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-KHS6O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\AudioIntercom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\update_server.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hlog.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qtga4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\LocalDB.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\SystemTransform.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-JB66K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-ST8MO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-LSKSS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\EagleEyeRender.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\RemConfig\is-9MGNB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\QtSvg4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\LibDataAccess.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-URJG1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-8CTED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-0R3RH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-7TQ67.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-E83DF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-HQ624.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-EM24B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\libiconv2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\StunClientLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-AJQ1H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\StreamTransClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-EPFIS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\SystemTransform.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-MPN8E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\MsgCenterQt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-NAN0P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-92IS9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\QtXml4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-LD25M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\udt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-KL4HM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-R6CG1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-41TD8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\CrashReporter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-PNOA2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HXVA.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\paho-mqtt3c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\QtWebKit4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-K3809.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-22416.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-VROPE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\RemConfig\ShowRemConfig.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-C56CN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-109A2.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	File created: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\npf64.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-1PVTV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-RUF54.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\skins\DefaultSkin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\pthreadVC2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-CTPA5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfcm90u.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\RemConfig\qwt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\CrashAPI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-LBT3O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-HLPPD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\SPUpDate.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-M11TJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-FK4IR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-FM8S1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-PCNT3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-ED0L2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AudioRender.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-CD1R1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\RemConfig\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\ISTask.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\hlog.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HmMerge.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-905AF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-VEV33.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\NetworkApi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-Q1919.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\StreamTransClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-SVNSK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-OKI5B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\OpenAL32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qkrcodecs4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-2H5PH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\ISTask.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-VOK38.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-A8VS5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-PJMGV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\NetStream.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-3N6JU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-I4HHJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\QtPlugInManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\TTSClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-G4ERQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDK.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-0DP5N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-RMC60.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-NITAN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\AnalyzeData.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-OO7KH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\msvcr90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-2G5F5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\msvcm90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\RTSPClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-CPBPM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-T09PE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-SN6FQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\SPUpDateClientLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\QtCore4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\startUp.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-B2SL2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\ISTask.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-0AS8F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\QtCore4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-2UBBQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCAlarm.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\SystemTransform.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\is-F48ST.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\is-6LTAQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-HAJ0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-602QN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCCore.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qico4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\RemConfig\is-BUDS6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\VShowToolKit.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\Client_DataCenter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\YUVProcess.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-VUI8I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\AudioRender.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\LibDataAccess.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hpr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\libsasl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-1LITI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-O00C7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfcm90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-AM4D0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-59MEK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-H7EA0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\libgcc_s_dw2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCCoreDevCfg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\CrashReporter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\ISTask.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\is-DKCBU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-P08M4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\NpfDetect.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\msvcr90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-C6R41.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\OpenAL32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-RFGC0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\RemConfig\is-5G1G7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCVoiceTalk.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-I91V5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\AnalyzeData.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-7FLPA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCGeneralCfgMgr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-SSUFV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\libGetHDSign.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\libcrypto-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\libGetHDSign.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-IO7BE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-TDFSL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-FIAFN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\RemConfig\is-VKSQL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-NN73K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\opensslwrap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\MP_VIE.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-F9P72.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-IDLFR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-DP620.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCIndustry.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Program Files (x86)\hicloud\update_server\ModProperties.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-H6BF4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\QtOpenGL4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\NPQos.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qsvg4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\DsSdk.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-B06VR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\streamclient_lib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-PO33G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HWDecode.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-288KO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\gdiplus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-RM1K1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AnalyzeData.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-B6PJK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-JD9GS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AudioIntercom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qcncodecs4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-5JFPD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\DeleteSADPNpf.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qgif4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-JRCF8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-9GRVS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-3HBPA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-2SHJB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-6NO15.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	File created: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\plugins\skins\is-MCISE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-RAF6L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\EzvizCfgManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-BS81F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-TJCPJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-M9R81.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-PU62R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\D3DCompiler_43.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-42497.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\Program Files (x86)\Ezviz Studio\is-6E68T.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hicloud	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hicloud\Ezviz Studio	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hicloud\Ezviz Studio\Ezviz Studio.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hicloud\Ezviz Studio\Uninstall Uninstall Ezviz Studio.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hicloud\update_server	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hicloud\update_server\Uninstall update_server.lnk	Jump to behavior

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe

5_2_009B1200

Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run SPUpDateServerrun			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run SPUpDateServerrun			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004227CC SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_004227CC
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0047E0A8 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_0047E0A8
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0042414C IsIconic,SetActiveWindow,SetFocus,	1_2_0042414C
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00424104 IsIconic,SetActiveWindow,	1_2_00424104
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_004182F4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_004182F4
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00417508 IsIconic,GetCapture,	1_2_00417508
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00417C40 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417C40
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00417C3E IsIconic,SetWindowPos,	1_2_00417C3E
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	8_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	8_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0047E0A8 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	8_2_0047E0A8
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0042414C IsIconic,SetActiveWindow,SetFocus,	8_2_0042414C
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00424104 IsIconic,SetActiveWindow,	8_2_00424104
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_004182F4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	8_2_004182F4
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_004227CC SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	8_2_004227CC
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00417508 IsIconic,GetCapture,	8_2_00417508
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00417C40 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	8_2_00417C40
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00417C3E IsIconic,SetWindowPos,	8_2_00417C3E

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe

Code function: 11_2_00D7F290 X509_check_private_key,ClearEventLogA,X509_check_private_key,ERR_clear_error,CredBackupCredentials,ERR_put_error,X509_get_pubkey,EVP_PKEY_copy_parameters,EVP_PKEY_free,ERR_clear_error,RSA_flags,X509_check_private_key,X509_free,EVP_PKEY_free,CRYPTO_add_lock,

11_2_00D7F290

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Code function: 1_2_0044B08C LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_0044B08C

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\ModProperties.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe

Section loaded: OutputDebugStringW count: 111

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: NpfDetectApp.exe, 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: PACKET.DLLPACKET.DLLNPFAPPSUCCESSNTQUERYSYSTEMINFORMATIONWIRESHARK.EXESERVICEMANAGER.EXESADPTOOL.EXEIVMS-4200.EXESTRING TOO LONGINVALID STRING POSITION
Source: NpfDetectApp.exe, NpfDetectApp.exe, 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: WIRESHARK.EXE

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: ERR_put_error,RegCreateKeyTransactedW,X509_TRUST_get0_name,ERR_put_error,RAND_pseudo_bytes,UI_get0_user_data,EnumServicesStatusExW,RAND_bytes,memcpy,memcpy,	11_2_00D538A0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: ERR_put_error,DTLSv1_2_client_method,ERR_put_error,DTLSv1_client_method,ERR_put_error,ERR_put_error,memcpy,ERR_put_error,EnumServicesStatusA,sk_find,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,	11_2_00D59D40
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: EnumServicesStatusA,	11_2_00D757F0

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Window / User API: threadDelayed 679
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Window / User API: threadDelayed 8803
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Window / User API: threadDelayed 1276
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Window / User API: threadDelayed 1191
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Window / User API: threadDelayed 3716

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCDisplay.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-JNSH8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-6999P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-QEANV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-GJ4VR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-TVHVS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\is-VQDR6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\msvcp90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qtwcodecs4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\EzvizDeviceDiscover.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\RTPRTCP.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\D3DX9_43.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-HTMT8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-AN0JV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\npf.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\SuperRender.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-AO5VR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\IssProc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-NLQUS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfc90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-0O0CK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-EIJEC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\MapNetHDD.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-M6FVE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-LF1B9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-8T0ER.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-9841E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\sadp\Sadp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\is-J9FD8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\libCASClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-244RQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-3V2DB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCPlayBack.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qmng4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-7VSP1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-DE2KP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\is-2Q8UL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qjpcodecs4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfc90u.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\sadp\is-TEKSC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-HI3IC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\StreamClient_V30.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-NFHD7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qtiff4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCPreview.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\is-2CHDE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\mingwm10.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\PlayCtrl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-5ONIC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-A2HSD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qjpeg4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-NKU9P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-FBVS3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\MP_Render.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-GDFO4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\AudioIntercom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-KHS6O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qtga4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\SystemTransform.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-JB66K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-ST8MO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\is-LSKSS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\EagleEyeRender.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\RemConfig\is-9MGNB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-8CTED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-URJG1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-0R3RH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-7TQ67.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-E83DF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\is-HQ624.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-EM24B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\libiconv2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\StunClientLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-AJQ1H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\StreamTransClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\SystemTransform.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-EPFIS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-MPN8E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\is-NAN0P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-92IS9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-LD25M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-KL4HM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-41TD8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\CrashReporter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-PNOA2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HXVA.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-K3809.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-22416.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-VROPE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\RemConfig\ShowRemConfig.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-C56CN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\is-109A2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\npf64.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-1PVTV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\skins\DefaultSkin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-RUF54.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\is-CTPA5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfcm90u.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\CrashAPI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-HLPPD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-M11TJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-FK4IR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-FM8S1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-PCNT3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-ED0L2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-CD1R1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\RemConfig\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\ISTask.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HmMerge.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-905AF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\is-VEV33.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-Q1919.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\StreamTransClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-SVNSK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qkrcodecs4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-OKI5B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-2H5PH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\ISTask.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-VOK38.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-A8VS5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-PJMGV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\NetStream.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-3N6JU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\TTSClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-G4ERQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDK.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-RMC60.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\is-NITAN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\AnalyzeData.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-OO7KH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\msvcr90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-2G5F5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\msvcm90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\RTSPClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-CPBPM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-T09PE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-SN6FQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-B2SL2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\ISTask.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-0AS8F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCAlarm.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-2UBBQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\SystemTransform.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\is-F48ST.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-HAJ0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-602QN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qico4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\Client_DataCenter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\RemConfig\is-BUDS6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\YUVProcess.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-VUI8I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\libsasl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-1LITI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-O00C7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfcm90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-AM4D0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-59MEK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-H7EA0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\libgcc_s_dw2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCCoreDevCfg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\CrashReporter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\is-DKCBU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\ISTask.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-P08M4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\msvcr90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-C6R41.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-RFGC0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\RemConfig\is-5G1G7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCVoiceTalk.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-I91V5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\AnalyzeData.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-7FLPA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCGeneralCfgMgr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-SSUFV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\libcrypto-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-IO7BE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-TDFSL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-FIAFN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\RemConfig\is-VKSQL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-NN73K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\MP_VIE.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-F9P72.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-IDLFR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-DP620.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCIndustry.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-H6BF4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\NPQos.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qsvg4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\DsSdk.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-B06VR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\streamclient_lib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-PO33G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HWDecode.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-288KO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\gdiplus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AnalyzeData.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-RM1K1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AudioIntercom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-B6PJK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-JD9GS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qcncodecs4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-5JFPD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\DeleteSADPNpf.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qgif4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-JRCF8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-9GRVS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-3HBPA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-2SHJB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-6NO15.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\plugins\skins\is-MCISE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-RAF6L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-BS81F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-TJCPJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-M9R81.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-PU62R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\D3DCompiler_43.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-42497.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Ezviz Studio\is-6E68T.tmp	Jump to dropped file

Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Evasive API call chain: GetSystemTime,DecisionNodes			graph_7-6439
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Evasive API call chain: GetSystemTime,DecisionNodes			graph_0-6438

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_5-16610
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_5-15162

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe

API coverage: 0.6 %

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe TID: 7872	Thread sleep count: 679 > 30
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe TID: 7872	Thread sleep time: -679000s >= -30000s
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe TID: 7896	Thread sleep count: 53 > 30
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe TID: 7896	Thread sleep time: -53000s >= -30000s
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe TID: 7872	Thread sleep count: 8803 > 30
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe TID: 7872	Thread sleep time: -8803000s >= -30000s
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe TID: 8068	Thread sleep time: -371600s >= -30000s

Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe

File opened: PhysicalDrive0

Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Thread sleep count: Count: 1276 delay: -10
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Thread sleep count: Count: 1191 delay: -10

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0047A964 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_0047A964
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00470C84 FindFirstFileA,FindNextFileA,FindClose,	1_2_00470C84
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00451668 FindFirstFileA,GetLastError,	1_2_00451668
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00460594 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00460594
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00492760 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00492760
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0047884C FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_0047884C
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_00460A10 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00460A10
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: 1_2_0045F008 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045F008
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0047A964 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	8_2_0047A964
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00470C84 FindFirstFileA,FindNextFileA,FindClose,	8_2_00470C84
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00451668 FindFirstFileA,GetLastError,	8_2_00451668
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00460594 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	8_2_00460594
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00492760 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	8_2_00492760
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0047884C FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	8_2_0047884C
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_00460A10 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	8_2_00460A10
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: 8_2_0045F008 FindFirstFileA,FindNextFileA,FindClose,	8_2_0045F008
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Code function: 10_2_00211000 FindFirstFileA,FindClose,	10_2_00211000
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011B47A0 OPENSSL_DIR_read,_errno,_errno,_errno,malloc,malloc,memset,malloc,free,_errno,FindFirstFileA,free,free,free,_errno,FindNextFileA,strncpy,_errno,	11_2_011B47A0

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe

Code function: 0_2_00409A14 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409A14

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: SPUpDateServer.exe, 0000000B.00000002.2993047021.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllI
Source: startUp.exe, 0000000A.00000002.2992485623.0000000000E32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\6
Source: EzvizStudioSetups.tmp, 00000001.00000003.2123818235.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}1

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe

API call chain: ExitProcess graph end node

graph_5-15164

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe

Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe

Code function: 5_2_009B16BA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

5_2_009B16BA

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe

Code function: 5_2_6F864348 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

5_2_6F864348

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Code function: 1_2_0044C210 LoadLibraryA,GetProcAddress,GetProcAddress,

1_2_0044C210

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe

Code function: 5_2_6F868D03 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

5_2_6F868D03

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_009B16BA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_009B16BA
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_009B5A63 __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_009B5A63
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_009B3372 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_009B3372
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: 5_2_6F85C510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6F85C510
Source: C:\Program Files (x86)\hicloud\update_server\ModProperties.exe	Code function: 9_2_00AE1B84 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	9_2_00AE1B84
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Code function: 10_2_0021163D IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	10_2_0021163D
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00C512B0 MultiByteToWideChar,wcsncpy_s,LoadLibraryW,GetProcAddress,SetUnhandledExceptionFilter,OutputDebugStringA,FreeLibrary,	11_2_00C512B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00C51AFC SetUnhandledExceptionFilter,	11_2_00C51AFC
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00C51EBE IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	11_2_00C51EBE
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_00D85BA2 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	11_2_00D85BA2

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe

Code function: 11_2_00D788C0 LogonUserExA,CRYPTO_malloc,ERR_put_error,memset,EVP_sha1,EVP_sha1,EVP_sha1,EVP_sha1,

11_2_00D788C0

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Code function: 1_2_004739C4 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_004739C4

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Process created: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe "C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe"			Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\startUp.exe	Process created: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe "C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Code function: 1_2_0045B29C GetVersion,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,AllocateAndInitializeSid,GetLastError,LocalFree,

1_2_0045B29C

Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe

Code function: 5_2_6F85CA12 cpuid

5_2_6F85CA12

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: GetLocaleInfoA,	0_2_0040515C
Source: C:\Users\user\Desktop\EzvizStudioSetups.exe	Code function: GetLocaleInfoA,	0_2_004051A8
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: GetLocaleInfoA,	1_2_004084D0
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Code function: GetLocaleInfoA,	1_2_0040851C
Source: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe	Code function: GetLocaleInfoA,	5_2_009B731C
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Code function: GetLocaleInfoA,	7_2_0040515C
Source: C:\Program Files (x86)\Ezviz Studio\update_server.exe	Code function: GetLocaleInfoA,	7_2_004051A8
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: GetLocaleInfoA,	8_2_004084D0
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Code function: GetLocaleInfoA,	8_2_0040851C

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\ProgramData\hik\log\update_server\default.log VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\ProgramData\hik\log\update_server\HPP.log VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\ProgramData\hik\log\update_server\SPUPDATE.log VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Queries volume information: C:\Program Files (x86)\hicloud\update_server\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation
Source: C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe	Queries volume information: C:\Program Files (x86)\Ezviz Studio\log4cxx.properties VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Code function: 1_2_00456D8C GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_00456D8C

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Code function: 1_2_00453F88 GetUserNameA,

1_2_00453F88

Source: C:\Users\user\Desktop\EzvizStudioSetups.exe

Code function: 0_2_00405C44 GetVersionExA,

0_2_00405C44

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: NpfDetectApp.exe, NpfDetectApp.exe, 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmp

Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected PrivateLoader

Source: Yara match

File source: C:\Program Files (x86)\Ezviz Studio\is-22416.tmp, type: DROPPED

Remote Access Functionality

Yara detected PrivateLoader

Source: Yara match

File source: C:\Program Files (x86)\Ezviz Studio\is-22416.tmp, type: DROPPED

Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EC500 DSO_bind_var,ERR_put_error,ERR_put_error,ERR_put_error,	11_2_011EC500
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_011EC580 DSO_bind_func,ERR_put_error,ERR_put_error,ERR_put_error,	11_2_011EC580
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_012606B0 DSO_new,DSO_convert_filename,ERR_put_error,DSO_free,DSO_bind_func,DSO_free,DSO_bind_func,DSO_free,ERR_put_error,ENGINE_get_static_state,ERR_get_implementation,CRYPTO_get_ex_data_implementation,CRYPTO_get_mem_functions,CRYPTO_get_locking_callback,CRYPTO_get_add_lock_callback,CRYPTO_get_dynlock_create_callback,CRYPTO_get_dynlock_lock_callback,CRYPTO_get_dynlock_destroy_callback,DSO_free,ERR_put_error,ENGINE_add,ERR_put_error,ERR_clear_error,	11_2_012606B0
Source: C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe	Code function: 11_2_01254D00 NCONF_get_string,ERR_clear_error,DSO_load,DSO_bind_func,DSO_bind_func,DSO_free,ERR_put_error,ERR_add_error_data,	11_2_01254D00

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	13 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Service Execution	12 Windows Service	2 Valid Accounts	1 Software Packing	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Windows Service	2 Masquerading	LSA Secrets	47 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	2 Valid Accounts	Cached Domain Credentials	251 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	23 Virtualization/Sandbox Evasion	DCSync	23 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Indicator Removal	Network Sniffing	3 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EzvizStudioSetups.exe	0%	ReversingLabs
EzvizStudioSetups.exe	2%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\Ezviz Studio\AnalyzeData.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\AnalyzeData.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\AudioIntercom.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\AudioIntercom.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\AudioRender.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\AudioRender.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\CrashAPI.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\CrashAPI.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\CrashReporter.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\CrashReporter.exe (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\D3DCompiler_43.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\D3DCompiler_43.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\D3DX9_43.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\D3DX9_43.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\DeleteSADPNpf.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\DeleteSADPNpf.exe (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\EagleEyeRender.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\EagleEyeRender.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\EzvizCfgManager.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\EzvizCfgManager.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\EzvizDeviceDiscover.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\EzvizDeviceDiscover.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Ezviz Studio\HCCore.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDK.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AnalyzeData.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AudioIntercom.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AudioRender.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\DsSdk.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCAlarm.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCCoreDevCfg.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCDisplay.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCGeneralCfgMgr.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCIndustry.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCPlayBack.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCPreview.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCVoiceTalk.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\OpenAL32.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\StreamTransClient.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\SystemTransform.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-0AS8F.tmp	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-0O0CK.tmp	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-1LITI.tmp	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-3HBPA.tmp	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-3V2DB.tmp	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-5ONIC.tmp	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-6999P.tmp	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-92IS9.tmp	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-AN0JV.tmp	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-AO5VR.tmp	0%	ReversingLabs
C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-DE2KP.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.remobjects.com/psU	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
https://api.ezviz7.com	0%	Virustotal		Browse
http://www.isapi.org/ver20/XMLSchema	0%	Virustotal		Browse
http://www.phreedom.org/md5)41UTN-USERFirst-Hardware72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0D	1%	Virustotal		Browse
http://www.ezviz7.com/help/device/connect.html	0%	Virustotal		Browse
http://www.phreedom.org/md5)	1%	Virustotal		Browse
http://www.innosetup.com/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ezvizlife-portal-1078988341.us-east-1.elb.amazonaws.com	54.158.49.118	true	false		high
api.ezvizlife.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ezvizlife.com/api/other/version/check	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2993634458.000000000126F000.00000002.00000001.01000000.00000015.sdmp, EzvizStudio.exe, 0000000C.00000002.2994139762.000000000176F000.00000002.00000001.01000000.0000002C.sdmp	false		high
https://api.ezvizlife.com/api/other/version/checksessionId=&clientType=9sessionId=&clientType=9https	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		high
http://trolltech.com/xml/features/report-whitespace-only-CharDataw	EzvizStudio.exe, 0000000C.00000002.3003903135.0000000008758000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%1/friend/list.htmEv_MainFrameWidget::appOpenFriendList	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
http://www.openssl.org/V	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2992669626.0000000000D98000.00000002.00000001.01000000.00000016.sdmp, SPUpDateServer.exe, 0000000B.00000002.2993749226.00000000012D0000.00000002.00000001.01000000.00000015.sdmp, EzvizStudio.exe, 0000000C.00000002.2994318343.00000000017C8000.00000002.00000001.01000000.0000002C.sdmp, EzvizStudio.exe, 0000000C.00000002.2994616263.0000000001822000.00000002.00000001.01000000.0000002D.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	EzvizStudio.exe, 0000000C.00000002.3024681516.000000006CE07000.00000002.00000001.01000000.00000046.sdmp	false		high
http://%s/statistics.do	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
https://api.ezvizlife.com/api/other/version/checkeAppender	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Dump.ys7.com:10086/uploadDumpoleSy	SPUpDateServer.exe, 0000000B.00000002.2995375098.0000000002F20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ezvizlife.com/api/other/version/check)	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%1%2_mobile.jpeg/image/DVR/1/image/IPC/11slotAddSearchDevice(const	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
https://api.ezvizlife.com/api/other/version/checkenderd	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%1%2_mobile.jpeg	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
http://Dump.ys7.com:10086/uploadDump	SPUpDateServer.exe	false		high
http://%1/image/%2/1_mobile.jpeg_/image/DVR/1/image/IPC/1http://%1%2_0_1d	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
https://api.ezviz7.comet	SPUpDateServer.exe, 0000000B.00000002.2994571027.0000000002E15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.openssl.org/support/faq.html	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, SPUpDateServer.exe, 0000000B.00000002.2993634458.000000000126F000.00000002.00000001.01000000.00000015.sdmp, EzvizStudio.exe, 0000000C.00000002.2994139762.000000000176F000.00000002.00000001.01000000.0000002C.sdmp	false		high
https://api.ezviz7.com	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2994571027.0000000002E15000.00000004.00000020.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2997042386.000000006C8C4000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse	unknown
https://bpush.ys7.comhttps://push.ys7.comPushClient_register	EzvizStudio.exe, 0000000C.00000002.3025983857.000000006CF30000.00000002.00000001.01000000.00000040.sdmp	false		unknown
https://mfs.ezvizlife.com/EzvizStudio_Small.exe	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bpush.ys7.com	EzvizStudio.exe, 0000000C.00000002.3025983857.000000006CF30000.00000002.00000001.01000000.00000040.sdmp	false		high
http://%s/statistics.doOperatorTaskThread::run	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
http://www.isapi.org/ver20/XMLSchema	EzvizStudio.exe, 0000000C.00000002.3017636861.000000006A2A4000.00000002.00000001.01000000.0000002F.sdmp	false	0%, Virustotal, Browse	unknown
https://api.ezvizlife.com/api/other/version/checknder	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ezvizlife.com/api/other/version/checkppend.F	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%1%2_mobile.jpeg/image/DVR/1/image/IPC/1	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
https://api.ezvizlife.com/api/other/version/checky	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ezvizlife.com/	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		high
http://www.phreedom.org/md5)41UTN-USERFirst-Hardware72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0D	EzvizStudio.exe, 0000000C.00000002.3021614841.000000006BA05000.00000002.00000001.01000000.00000020.sdmp	false	1%, Virustotal, Browse	unknown
https://api.ezvizlife.com/api/other/version/checkq	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://%s/statistics.doDataUploadTaskThread::run	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
http://curl.haxx.se/V	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996264641.0000000010045000.00000002.00000001.01000000.00000013.sdmp	false		high
https://%2_mobile.jpeghttps://http://:/ToolKit/image/default/Failed.png:/ToolKit/image/default/Faile	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
https://api.ezvizlife.com/api/other/version/checkle	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/docs/copyright.htmlD	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996264641.0000000010045000.00000002.00000001.01000000.00000013.sdmp	false		high
https://api.ezvizlife.com/api/other/version/checkpend	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
http:///assets/imgs/public/companyDevice_web.jpegx	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
http://bugreports.qt-project.org/	EzvizStudio.exe, 0000000C.00000002.3021614841.000000006BA05000.00000002.00000001.01000000.00000020.sdmp	false		high
http://https://.jpg4	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
http://www.innosetup.com/	update_server.tmp, update_server.tmp, 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false	1%, Virustotal, Browse	unknown
http://www.phreedom.org/md5)	EzvizStudio.exe, 0000000C.00000002.3021614841.000000006BA05000.00000002.00000001.01000000.00000020.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/soap/encoding/	EzvizStudio.exe, 0000000C.00000002.3024681516.000000006CE07000.00000002.00000001.01000000.00000046.sdmp	false		high
http://ns.adobe.c	EzvizStudio.exe, 0000000C.00000002.3004270035.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://trolltech.com/xml/features/report-whitespace-only-CharDataC	EzvizStudio.exe, 0000000C.00000002.3003903135.0000000008758000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ezviz7.com/help/device/connect.htmlNo	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		unknown
http://www.winimage.com/zLibDll1.2.6-rbfile	EzvizStudio.exe, 0000000C.00000002.3011740879.0000000069068000.00000002.00000001.01000000.0000004E.sdmp	false		high
https://%1%2_mobile.jpeg/image/DVR/1/image/IPC/1Please	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
https://%1/friend/list.htm	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
http://www.symauth.com/cps0(	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.ezvizlife.com/api/other/version/checktternLayoutp	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Dump.ys7.com:10086/uploadDumpSPUpDateServer_%sSetUnhandledExceptionFilter	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2992327628.0000000000C53000.00000002.00000001.01000000.00000010.sdmp, SPUpDateServer.exe, 0000000B.00000000.2102369796.0000000000C53000.00000002.00000001.01000000.00000010.sdmp	false		high
https://api.ezvizlife.com/api/other/version/checka	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/docs/http-cookies.html	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996177230.0000000010039000.00000002.00000001.01000000.00000013.sdmp, EzvizStudio.exe, 0000000C.00000002.3009397458.000000001003A000.00000002.00000001.01000000.00000025.sdmp	false		high
https://%1%2_mobile.jpeg1slotDeviceAdd(const	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
http://www.winimage.com/zLibDllr	EzvizStudio.exe, 0000000C.00000002.3011740879.0000000069068000.00000002.00000001.01000000.0000004E.sdmp	false		high
http://www.ezvizlife.com	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp, EzvizStudio.exe, 0000000C.00000002.3003903135.0000000008758000.00000004.00000020.00020000.00000000.sdmp	false		high
http://logging.apache.org/log4j/codes.html#tbr_fnp_not_setThe	update_server.tmp, 00000008.00000003.2095015184.0000000003110000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2996560641.000000006C814000.00000002.00000001.01000000.00000014.sdmp, EzvizStudio.exe, 0000000C.00000002.3024220244.000000006C60C000.00000002.00000001.01000000.0000001A.sdmp	false		high
http://www.remobjects.com/psU	EzvizStudioSetups.exe, 00000000.00000003.1745799672.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, EzvizStudioSetups.exe, 00000000.00000003.1746078055.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, EzvizStudioSetups.tmp, 00000001.00000000.1746672020.0000000000401000.00000020.00000001.01000000.00000004.sdmp, update_server.exe, 00000007.00000003.2058441897.0000000002360000.00000004.00001000.00020000.00000000.sdmp, update_server.exe, 00000007.00000003.2058625890.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, update_server.tmp, 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false	URL Reputation: safe	unknown
https://api.ezvizlife.com/api/other/version/check9	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	false		high
https://push.ys7.com	EzvizStudio.exe, 0000000C.00000002.3025983857.000000006CF30000.00000002.00000001.01000000.00000040.sdmp	false		high
ftp://http://HTTP/1.0	update_server.tmp, 00000008.00000003.2095015184.0000000003769000.00000004.00001000.00020000.00000000.sdmp, update_server.tmp, 00000008.00000003.2095015184.000000000364A000.00000004.00001000.00020000.00000000.sdmp	false		low
http://www.symauth.com/rpa00	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.ezviz7.com/help/device/connect.html	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false	0%, Virustotal, Browse	unknown
https://api.ezvizlife.com/api/other/version/check.Et.	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://%1/image/%2/1_mobile.jpeg	EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		low
https://api.ezvizlife.comtrue	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.winimage.com/zLibDll	EzvizStudio.exe, 0000000C.00000002.3011740879.0000000069068000.00000002.00000001.01000000.0000004E.sdmp	false		high
http://www.remobjects.com/ps	EzvizStudioSetups.exe, 00000000.00000003.1745799672.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, EzvizStudioSetups.exe, 00000000.00000003.1746078055.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, EzvizStudioSetups.tmp, EzvizStudioSetups.tmp, 00000001.00000000.1746672020.0000000000401000.00000020.00000001.01000000.00000004.sdmp, update_server.exe, 00000007.00000003.2058441897.0000000002360000.00000004.00001000.00020000.00000000.sdmp, update_server.exe, 00000007.00000003.2058625890.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, update_server.tmp, update_server.tmp, 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false	URL Reputation: safe	unknown
https://api.ezvizlife.com/api/other/version/checkI	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bugreports.qt-project.org/QHttpNetworkConnectionChannel::_q_receiveReply()	EzvizStudio.exe, 0000000C.00000002.3021614841.000000006BA05000.00000002.00000001.01000000.00000020.sdmp	false		high
https://api.ezvizlife.com	SPUpDateServer.exe, 0000000B.00000003.2842003555.0000000002E76000.00000004.00000020.00020000.00000000.sdmp, EzvizStudio.exe, 0000000C.00000000.2117649200.00000000011F2000.00000002.00000001.01000000.00000018.sdmp	false		high
http://trolltech.com/xml/features/report-whitespace-only-CharData	EzvizStudio.exe, 0000000C.00000002.3003903135.0000000008758000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ezvizlife.com/api/other/version/checkegion=J	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ezvizlife.com/api/other/version/checkoutMcz	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ezvizlife.com/api/other/version/checkegion=	SPUpDateServer.exe, 0000000B.00000002.2994707308.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ezviz7.comversionRespnewestVersionoption2updateUrloption1limitVersionsUpdateUrlsMd5inter	update_server.tmp, 00000008.00000003.2095015184.000000000327B000.00000004.00001000.00020000.00000000.sdmp, SPUpDateServer.exe, 0000000B.00000002.2997042386.000000006C8C4000.00000002.00000001.01000000.00000011.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.158.49.118	ezvizlife-portal-1078988341.us-east-1.elb.amazonaws.com	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428616
Start date and time:	2024-04-19 10:14:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EzvizStudioSetups.exe
Detection:	SUS
Classification:	sus32.troj.evad.winEXE@18/459@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 314 Number of non-executed functions: 200
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:16:11	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run SPUpDateServerrun C:\Program Files (x86)\hicloud\update_server\startUp.exe
10:16:12	API Interceptor	1047666x Sleep call for process: EzvizStudio.exe modified
10:16:43	API Interceptor	1287677x Sleep call for process: SPUpDateServer.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse	3.222.159.6
	https://librospy.com/	Get hash	malicious	Unknown	Browse	44.212.109.197
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	18.205.93.1
	https://18apmic18.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	54.82.240.251
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5	Get hash	malicious	Remcos	Browse	3.233.142.19
	9IseFevRH6.elf	Get hash	malicious	Mirai	Browse	54.137.39.213
	6VXQ3TUNZo.elf	Get hash	malicious	Mirai	Browse	44.200.240.84
	KSRRrEMt1w.elf	Get hash	malicious	Mirai	Browse	44.218.34.240
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FBigge/aDRmd79087aDRmd79087aDRmd/ZHN3ZWF6YUBiaWdnZS5jb20=	Get hash	malicious	HTMLPhisher	Browse	34.205.254.71

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
0bfd7fc4b72e174811c409f13a8b6fed	connect_901059.exe	Get hash	malicious	Unknown	Browse	54.158.49.118
535aca3d99fc247509cd50933cd71d37	Windows InstantView 2.exe	Get hash	malicious	PrivateLoader	Browse	54.158.49.118
535aca3d99fc247509cd50933cd71d37	CMI_Business_Banking_1.2.6.exe	Get hash	malicious	Unknown	Browse	54.158.49.118

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Ezviz Studio\D3DCompiler_43.dll (copy)	SecuriteInfo.com.Heuristic.HEUR.AGEN.1343277.7061.14046.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Heuristic.HEUR.AGEN.1343277.7061.14046.exe	Get hash	malicious	Unknown	Browse
	SenOg8gPgc.exe	Get hash	malicious	Unknown	Browse
	SenOg8gPgc.exe	Get hash	malicious	Unknown	Browse
	8ubQTzsAqG.exe	Get hash	malicious	Unknown	Browse
	8ubQTzsAqG.exe	Get hash	malicious	Unknown	Browse
	steelhomedata.msi	Get hash	malicious	Unknown	Browse
	Dlabel_PC.exe	Get hash	malicious	Unknown	Browse
	Dlabel_PC.exe	Get hash	malicious	Unknown	Browse
	https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\Ezviz Studio\D3DX9_43.dll (copy)	hd2018 v1.0.35.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Win32.Agent.2721.19195.exe	Get hash	malicious	Petite Virus	Browse
	SecuriteInfo.com.Trojan.Win32.Agent.3214.8517.exe	Get hash	malicious	Petite Virus	Browse
	RemotePC.exe	Get hash	malicious	Unknown	Browse
	RemotePC.exe	Get hash	malicious	Unknown	Browse
	Thunderstore Mod Manager - Installer.exe	Get hash	malicious	Unknown	Browse
	media.player.codec.pack.v4.5.9.setup.exe	Get hash	malicious	Unknown	Browse
	media.player.codec.pack.v4.5.9.setup.exe	Get hash	malicious	Unknown	Browse
	bino.exe	Get hash	malicious	Unknown	Browse
	UserBenchmarkSetup.exe.zip	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Ezviz Studio\AlarmSounds\alarm.wav (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 11025 Hz
Category:	dropped
Size (bytes):	14636
Entropy (8bit):	5.788526265675291
Encrypted:	false
SSDEEP:	384:ecRq7Z0q4Kc5SrWoe89+4cufs4SbtKT7IXYgYir0G:eYq7ZVG56X9+4zitKT0I/ir0G
MD5:	3CBFB301FC5BA55BB8613BAC43F670E4
SHA1:	878CF504D9E967E0FB2A2FDABF2B7E324E56F04B
SHA-256:	E34986B6CA28ED88A3E4A78A0673040D976BD547DA3858D5DC907E381B7D871A
SHA-512:	9C010C1129CDEAE8A900A617BB743406FDB8629DD2604EDC985A7EEDCD9C4EE8AB8F4DEC722123945A24DF3BD41C020F8F47C4558BD057B12FC4B446E793EFA1
Malicious:	false
Reputation:	low
Preview:	RIFF$9..WAVEfmt .........+...+......data.9..sw~......tqommnpqrtx......~uponnopqrv~......wqopppqrstv{......ytrrqqqrtuwz......{wvutsstvwwz~.....}{yxwuuvyzyz}.......~\|{yyz{{zy{}.........\|{{zzyyz\|.........~\|{xwwxy{..........}{yvvwyzz~........~zxvuvxz{\|.........\|yxwwwyz{\|~........~\|yyyyyyz{}.........~{yzzyxyz}..........\|zzzywxy\|..........{{{{zywx{~..........}~~}{yxy{}..........}}}\|\|zyy{\|}~~........~}\|zyzzz{\|~..........\|}}\|\|{yyz\|~.........~\|\|}\|\|{z{\|\|~.}~.......~}~\|\|{z{\|}}~}}.........~}\|\|\|{zyy{~.........}{\|\|~~{yyz\|..{zz}.......~}{xuwy\|~}\|~......~\|}{ywvvxz~........}xvuvwwwvy......}wwvttssux}......ysqpqrstvz.....zqooooqrtw~....yqnnoppqsx....{spoooqsux}...vpoooqsw\|....wssrqqsv\|....\|ussrrsv}....zvutttvx}...zvuvwyz}....rnpstvz......tooqsux.....\|qqstuw\|....soprsux....}pnoqsux....uklprtx....}qoopqt{....yrrstuy....xtstuw}....wtuwwy.....vtvwwy.....vuwyy{....rptxz\|.....qotwy\|....uprvy\|....yjlrvy~....wflrux.....khosw}....ogkosx.....kjnps{....qnpqsz....tqssu{....truuw~...~ttvwy....}rswy{....xqswz~....xps

C:\Program Files (x86)\Ezviz Studio\AlarmSounds\is-EA4KH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 11025 Hz
Category:	dropped
Size (bytes):	14636
Entropy (8bit):	5.788526265675291
Encrypted:	false
SSDEEP:	384:ecRq7Z0q4Kc5SrWoe89+4cufs4SbtKT7IXYgYir0G:eYq7ZVG56X9+4zitKT0I/ir0G
MD5:	3CBFB301FC5BA55BB8613BAC43F670E4
SHA1:	878CF504D9E967E0FB2A2FDABF2B7E324E56F04B
SHA-256:	E34986B6CA28ED88A3E4A78A0673040D976BD547DA3858D5DC907E381B7D871A
SHA-512:	9C010C1129CDEAE8A900A617BB743406FDB8629DD2604EDC985A7EEDCD9C4EE8AB8F4DEC722123945A24DF3BD41C020F8F47C4558BD057B12FC4B446E793EFA1
Malicious:	false
Reputation:	low
Preview:	RIFF$9..WAVEfmt .........+...+......data.9..sw~......tqommnpqrtx......~uponnopqrv~......wqopppqrstv{......ytrrqqqrtuwz......{wvutsstvwwz~.....}{yxwuuvyzyz}.......~\|{yyz{{zy{}.........\|{{zzyyz\|.........~\|{xwwxy{..........}{yvvwyzz~........~zxvuvxz{\|.........\|yxwwwyz{\|~........~\|yyyyyyz{}.........~{yzzyxyz}..........\|zzzywxy\|..........{{{{zywx{~..........}~~}{yxy{}..........}}}\|\|zyy{\|}~~........~}\|zyzzz{\|~..........\|}}\|\|{yyz\|~.........~\|\|}\|\|{z{\|\|~.}~.......~}~\|\|{z{\|}}~}}.........~}\|\|\|{zyy{~.........}{\|\|~~{yyz\|..{zz}.......~}{xuwy\|~}\|~......~\|}{ywvvxz~........}xvuvwwwvy......}wwvttssux}......ysqpqrstvz.....zqooooqrtw~....yqnnoppqsx....{spoooqsux}...vpoooqsw\|....wssrqqsv\|....\|ussrrsv}....zvutttvx}...zvuvwyz}....rnpstvz......tooqsux.....\|qqstuw\|....soprsux....}pnoqsux....uklprtx....}qoopqt{....yrrstuy....xtstuw}....wtuwwy.....vtvwwy.....vuwyy{....rptxz\|.....qotwy\|....uprvy\|....yjlrvy~....wflrux.....khosw}....ogkosx.....kjnps{....qnpqsz....tqssu{....truuw~...~ttvwy....}rswy{....xqswz~....xps

C:\Program Files (x86)\Ezviz Studio\AnalyzeData.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	428544
Entropy (8bit):	6.705383344139919
Encrypted:	false
SSDEEP:	6144:WWkN5tPYsRA318Y+vMwER19P7nQA7NubZIgxdqtAOje/:zkvtPYxSo7nQSWZ7Pqt0/
MD5:	9029D85F9533C62560A4792B07EDD821
SHA1:	DADBB7130A1173F6EB0A07745FAEF7C19203AEE1
SHA-256:	C33EE2A3AC83C69584F7559F6C0A4D28E621A116A4ABA97C8945E103DAEC2302
SHA-512:	1139512F3C5BB3B5AA548285ACBAD2D65A4B7828F53E48321521AEAA1156385290CCA6383765096276CF510B4782D72517DA66B335664B6F3F383A6A62CE1AAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.?...?...?...!.X......D..<...?...]...!.N...!.I.f...!._.>...!.Y.>...!.\.>...Rich?...........................PE..L...2..Y...........!.........l......W........0...............................P..................................................(............................ ..<&...1.................................@............0...............................text............................... ..`.rdata..f....0......................@..@.data....:..........................@....rsrc................\..............@..@.reloc..<'... ...(...b..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\AudioIntercom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	6.708726906598856
Encrypted:	false
SSDEEP:	6144:8uzPKWItJHu6UBhRb37ejmPsR95DHdSyz7pDWiitPLh0FiGAn4gutSglVrTS:8uzPKWAtehdeyPsR95Rxz7pDW7PLox
MD5:	38C31E508FCC7AE2615CC11D053022BB
SHA1:	EF9DCFAA4A54C0C660FFBFB7C18FF8792D88E443
SHA-256:	906CFDCC7E2D55EF96C32718549961227B041083855AD12434572A14D6F0BB37
SHA-512:	D8674D40FF456DE5A8E6F90102A6F04D676D81604E945B9FF1621909D6A896EC8E53AA51FD1C9C94511AC2B459A57EB5B3E5A3F96E74D6931EC1322F26297C88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.....Y...Y...Y.YuY...Y.YcY...Y..Y...Y...Y...Yh+.Y...Y...Y...Y.YdY...Y.YrY...Y.YtY...Y.YqY...YRich...Y................PE..L.....U...........!.....<...................P......................................b_...............................O.......C..<................................"..@R...............................................P...............................text....:.......<.................. ..`.rdata.......P.......@..............@..@.data...`....`.......D..............@....rsrc...............................@..@.reloc...$.......&..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\AudioRender.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	158784
Entropy (8bit):	6.65480912912977
Encrypted:	false
SSDEEP:	1536:YtPFvOFJvapyoa3UeceWACYThGcI2m+J//Oe2DcBpkgZFPBG64R9P0TUP7d13h72:cmSwTUrAnMcb6gZFPArR9P04pX2
MD5:	CF7F9F76F1F093B84A70ECA6E1355EB7
SHA1:	9C84D723DF60132E921AE40C35E50606F9901525
SHA-256:	C6587FABA5A8CC6318AE371345611F8002C67D1475625A4A1453F426CAE9B1A8
SHA-512:	E47623935C8B7CB59181A69C68C310FE48ECBBDA1BA82F638699432ABC4EDD74FDAB35405A723A2B9E6584CFC16679C68BBF0BE054727E117585DA8E5E34F9EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........F...........C.......U.e.....}......_......E.....M..............R.......D......B......G....Rich...........................PE..L...\|'.a...........!......................................................................@.........................p...........x....................L..@ ..............................................@............................................text............................... ..`.rdata...O.......P..................@..@.data....z... ......................@....rsrc................&..............@..@.reloc..f........ ...,..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\CrashAPI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.84519716457685
Encrypted:	false
SSDEEP:	384:J1qv3eHhfdzoNcrOHmYL2N5ek5KvEIF5uOtuWi46GZOX:JgPKdzoNyTYaNIoKvBmOtG46GZO
MD5:	C3C8CBB7532D3462A782D72A15117025
SHA1:	3D4256BA4300F6333CB1B71F62788920A8F2B174
SHA-256:	4389E98E0E7E87CA5478194A770A1979D6A0D326294EE1701B87AECCBEC244BC
SHA-512:	9CBA6367C534CF0939F069248E0EA39A92CA6FEC1EED3E53A3820B73DFCF4C2FECF34E4B7DA3E14BB0D20C8DE3D3E676E1EF1E9684592C94AAAB3FD87875229A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b?...Q..Q..Q..L...Q.{...Q.{...Q.{...Q.{...Q....Q..P...Q.{...Q.{...Q.Q...Q.{...Q.Rich..Q.................PE..L....TRQ...........!.....2..........6.......P......................................a.....@..........................f.......Z..P.......<............................Q.............................. T..@............P..\|............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data...`....p.......N..............@....rsrc...<............P..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\CrashReportConfig.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.863618031832429
Encrypted:	false
SSDEEP:	6:qv4uVKY9CvMJlCP8W4FV6RAYi+MvLTa8B4+RAYi+C/LThNhCUBMtn:UKY9CvATW42Wa8B4+k/h/6tn
MD5:	8F145A60FB401270BF9C4FF119D7A3A0
SHA1:	EE6703F306DDC9F107268DF653E5BCE7F760F0A1
SHA-256:	A915EE89D509CFE47A581EFC11D518423F255C9C98A851230738155D9E692A94
SHA-512:	288AF0D437C930652DEEB7E200DE3ACDAC5F5153A33241EC38E557410DED78C1031D79FC5E4AA4A64BC3ACA96F12C9F30FD91479B69041D7992D3C913471B96C
Malicious:	false
Reputation:	low
Preview:	[CrashReporter]..BeAutoRestart=0..RestartCount=2..LastRestartTime=0..BeTestPlatform=0..TestServerAddr=dump.shipin7.com..TestServerSite=/uploadDump..TestServerPort=10086..ServerAddr=www.shipin7.com..ServerSite=/uploadDump..ServerPort=10086..ClientName=EzvizStudio.exe..

C:\Program Files (x86)\Ezviz Studio\CrashReporter.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	345928
Entropy (8bit):	6.525618147005305
Encrypted:	false
SSDEEP:	6144:N6Hj3OKSA6+R8Z5BFeG0yJzgxLMs4PqHNokLPHjXcgzQD3:wj+E8Z51RgxLB4GokLPHj3kL
MD5:	F925FE2CCAF62128B355BB3B76500E71
SHA1:	90B1C4FBD5A8E2546935E97B60F29C0A6AD5B90F
SHA-256:	C747DEE70B08CC51363721B6363233FF01977F191AE23A5148E5F96263EBDAB7
SHA-512:	6C7ECA7FDF8A30E5B8B97AFCA1EA12B77ED20B700CCCA410D1954D101023620C4DA9F96F346747CE531D016B8DDB5CAC13DA24425077267DDE2EE82C31EC32F1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^.............T.......T................m.......{.9.....\|.......\|.......l.......i.....Rich............PE..L.....!W.................`...........7.......p....@..........................@...............................................1...........{..............H]..........Pv..................................@............p.......1..@....................text...>_.......`.................. ..`.rdata.......p.......d..............@..@.data....e...P...*...D..............@....rsrc....{.......\|...n..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\D3DCompiler_43.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2106216
Entropy (8bit):	6.4563314852745375
Encrypted:	false
SSDEEP:	49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
MD5:	1C9B45E87528B8BB8CFA884EA0099A85
SHA1:	98BE17E1D324790A5B206E1EA1CC4E64FBE21240
SHA-256:	2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
SHA-512:	B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: SecuriteInfo.com.Heuristic.HEUR.AGEN.1343277.7061.14046.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Heuristic.HEUR.AGEN.1343277.7061.14046.exe, Detection: malicious, Browse Filename: SenOg8gPgc.exe, Detection: malicious, Browse Filename: SenOg8gPgc.exe, Detection: malicious, Browse Filename: 8ubQTzsAqG.exe, Detection: malicious, Browse Filename: 8ubQTzsAqG.exe, Detection: malicious, Browse Filename: steelhomedata.msi, Detection: malicious, Browse Filename: Dlabel_PC.exe, Detection: malicious, Browse Filename: Dlabel_PC.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\D3DX9_43.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1998168
Entropy (8bit):	6.7631254131269465
Encrypted:	false
SSDEEP:	24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
MD5:	86E39E9161C3D930D93822F1563C280D
SHA1:	F5944DF4142983714A6D9955E6E393D9876C1E11
SHA-256:	0B28546BE22C71834501F7D7185EDE5D79742457331C7EE09EFC14490DD64F5F
SHA-512:	0A3E311C4FD5C2194A8807469E47156AF35502E10AEB8A3F64A01FF802CD8669C7E668CC87B593B182FD830A126D002B5D5D7B6C77991158BFFDB0B5B997F6B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: hd2018 v1.0.35.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Win32.Agent.2721.19195.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Win32.Agent.3214.8517.exe, Detection: malicious, Browse Filename: RemotePC.exe, Detection: malicious, Browse Filename: RemotePC.exe, Detection: malicious, Browse Filename: Thunderstore Mod Manager - Installer.exe, Detection: malicious, Browse Filename: media.player.codec.pack.v4.5.9.setup.exe, Detection: malicious, Browse Filename: media.player.codec.pack.v4.5.9.setup.exe, Detection: malicious, Browse Filename: bino.exe, Detection: malicious, Browse Filename: UserBenchmarkSetup.exe.zip, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..=.a.n.a.n.a.n.a.n.a.n.3hn.a.n.3jn.a.n.3^nZa.n.3on.a.n.3_n.a.n-..n.a.n.3nn.a.n.3in.a.nRich.a.n........................PE..L....1.K...........!.........4......................................................m.....@..........................i..&,...Z..d....................f..X.......x.......................................@............................................text............................... ..`.data....P..........................@....rsrc...............................@..@.reloc..>...........................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\DeleteSADPNpf.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48968
Entropy (8bit):	7.037914834013295
Encrypted:	false
SSDEEP:	768:gJ+Ff1A+Qek4kY0AvB51UROMSNSj5B6UOyYida3hc92+T3hmj:P1FQek44AvBHmOV4jL7da3hcUM3hmj
MD5:	F98A08CF8AF1C62FB89FCB7BE8D15E7E
SHA1:	870297453CF97A0983788EB289993EE180CEA645
SHA-256:	99E8D275552BCC891D44D2E4168ABC92AC38AE39BBC2E21F623EDE6D8E8DB1B9
SHA-512:	081B06B085DA4973FF2360D7C6A587381139C151454CAC4BA1E58AB6DC1518F6E06D86C5A98BD8ED4A41C1352BEBE1A3640C7E1DAE1D6E5CABE69889A8C5323A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..............D.......G.......Q...............A.........\|.....V.......C.....Rich............................PE..L......S................. ...>.......%.......0....@.................................wo....@.................................4?..x....p...............b..H]...........................................9..@............0..(............................text............ .................. ..`.rdata..p....0...0...$..............@..@.data........`.......T..............@....rsrc........p.......V..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\EagleEyeRender.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410624
Entropy (8bit):	6.7118202846586135
Encrypted:	false
SSDEEP:	6144:OuebAFajYaBmNVfDF+JtXGLDE3OERNVZ0GG9NQJUG2nJF3clY:O397IDF+JtXGHE3OUNYGG9+JUn
MD5:	44B73A0305018E29CC8AD8462BB7A872
SHA1:	51E6D713536D31B5843ACB6CFD751FE095AB938E
SHA-256:	938AAFE5965797CC67280842C8015F6904D1D349EFA3BC259CCFB16654E4FB8F
SHA-512:	3B82AA9B8BF56713FA7ACBC3CCAF9ED8A0D141247F86F7AB28798ABD985DF75AA6357BD928174078F2BA3D45799398944C6432B68CA817287EB9AAF9C1DCBE97
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..+..+..+...+..+...+.+...+C..+.@.+..+...+..+...+..+../+..+0..+..+..+[..+..+..+...+..+...+...+...+..+...+..+...+..+Rich..+........PE..L...G..Z...........!.........F......nX....... ...............................0............@.........................P...&.......................................h4..P$............................................... ..\............................text...O........................... ..`.rodata............................. ..`.rdata..v.... ......................@..@.data............2..................@....rsrc...............................@..@.reloc..\|5.......6..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\EzvizCfgManager.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	169984
Entropy (8bit):	6.462529050201304
Encrypted:	false
SSDEEP:	3072:O1SEBXHnoai9fx3f9Tfx+VBiFoEIerKgsVQKJOKgmLerjr:O1z4tFTx+SKgUQKJOKgmk
MD5:	3345EDA88B472342D66878CFC142F7DD
SHA1:	A99F916BDE3A6BFE450CA9A8E7C41A757EDFEFB6
SHA-256:	7BA56AD7E3F05C4BD0F4E88FE94BCE26BD02FE54FD960D87E04188469394A61E
SHA-512:	170F69C8FE1A3B908D83AFFD7157B765CDA7200CD1752DE0DD4E524FE48A19841B3F3489E35A0BDFBDF5F6589360121E6F7C54BD82775FB02B83F16BAD6E33E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.B.n.,\n.,\n.,\..\o.,\g..\j.,\g..\`.,\g..\h.,\I.W\l.,\g..\c.,\n.-\E.,\g..\c.,\g..\o.,\g..\o.,\Richn.,\........................PE..L.....e...........!......................................................................@.........................P`..A...\|:..................................d%......................................@............................................text............................... ..`.rdata...~..........................@..@.data........p.......`..............@....rsrc................d..............@..@.reloc..r/.......0...h..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\EzvizDeviceDiscover.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88576
Entropy (8bit):	5.027908034200073
Encrypted:	false
SSDEEP:	1536:nAilT4tC7zYqy9x6KF8QFaN3g1uGba9GOt5NV:9l8o7zYqUx6KF/R1uGbbOt5D
MD5:	AED35991FF47E0FD28ABAF6090F11DC6
SHA1:	064DAED7D2DD845B9CCCDB966742826292D3B20C
SHA-256:	8DBDF5CC792B19C0F88CFF5F4014D174716F48F0A7BEC34820DEC422C15A08E0
SHA-512:	3B1946A996431715864FA9EC16B46B32D4A73BD41F332EDB43F293084589F8EFE43A0F3E9EDEA4E4F6AC6F69BC33D0238662953C4C6D3173C87CD1C1B72A61C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`O.$...$...$...a>.&...-V=.&...-V+.*.......&...-V;.-...$...U...-V,.(...-V:.%...-V9.%...Rich$...................PE..L.....e...........!.........`............................................................@.........................P>.......`..x................................... ................................"..@...........lc...............................text...K........................... ..`.rdata..W1.......2..................@..@.data........P.......,..............@....idata.......`.......0..............@....rsrc................J..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4524608
Entropy (8bit):	6.391046322715047
Encrypted:	false
SSDEEP:	98304:GeH5hmovFJk87VUxQmsU1WP0USjMRInmg4MCDhj2:hPmovFJk87VQQmsU1WP32
MD5:	FD309D34FEDEE887AE36EC54730C89CB
SHA1:	24834A27902C7692EE53A14C4E5E2B12B0ABB872
SHA-256:	C45C3E871B8D56881AD9A0F1B2A555F5C686EF9CD215C64BD9B249B2EBD4F39B
SHA-512:	C67D87D36E4EFC639D27536C4AA23CF44D4F6CD06AAADD4FC281E8B685D56298F4FCC98927C72F6007B28155C13FEC171632AF8E70CCF07AF605533E8CC2DC81
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$j..J9..J9..J9...9..J9...9..J9...9..J9.i19..J9...9..J9..K9..J9...9..J9...9..J9...9..J9...9..J9Rich..J9........................PE..L.....e..................,.........z.'...... ,...@..........................0E.......E...@..........................x@.....le>.......@..>............D.@ ... A.(...`K,...............................9.@............ ,..(...........................text.....,.......,................. ..`.rdata...Z... ,..\....,.............@..@.data....T....@..6...n@.............@....rsrc....>....@..@....@.............@..@.reloc....... A.......@.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCCore.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2180096
Entropy (8bit):	6.715858746553116
Encrypted:	false
SSDEEP:	49152:cgOnLzp2WX3D+mjfpz+MeHLbdI4iGUd0wmz/EO4GjF:+DvjhzMHLbdI4iGg0wmzSG
MD5:	82A0338F91996B9046D4B75058413674
SHA1:	877641B022F73F12F71DAD50113999E966A5BFFA
SHA-256:	1EE58997256093F4C3D077A1EB695FB0532FAEFD8B884A124688CA443670CCC4
SHA-512:	2D2495186EBE07889DE0E724AE2B134AC6583EEDE931F15DC0428CD1FCE4C6D2157DA720C0E7D426839049777F472AC2B35CBE0209AD84D4AECF7A5EFD99896F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m..>..>..>.eD>..>.b>..>.\>..>.c>s.>J:H>..>..>8.>..f>..>..c>..>..b>..>.._>..>..X>..>...>..>..]>..>Rich..>................PE..L.....mc...........!.....&....V..............@................................p...........@.................................`.........n.......................n.8(...C..8...........................p...@............@...............................text...f%.......&.................. ..`.rdata...y...@...z.................@..@.data.....N......r..................@....rsrc.........n....... .............@..@.reloc..8(....n...... .............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDK.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.690648483945704
Encrypted:	false
SSDEEP:	12288:IWnOqCV69MtyroKyYr8lRPm4bHuG2gwQWiGUeRxVb/Gowgaj9sraw:IWOqCVMMcroKyYAnmaui9eRxVyoBd
MD5:	D54A58B52F548275AEB9ED1822D0DDB7
SHA1:	E3180202B8852BB975F262B7CCD85D71C1E12A2D
SHA-256:	18C50E20AAA5F85A8BC70BC297DCAF48A1DF355E7A6D611013941446EDE13B23
SHA-512:	CB0C36629CE6F06AC657D72A13C008752B5C1404AF47951BEDE3D077D014E5FCDEDD666BC110900B00B9A1CB4944A9DFE55D72BF84AA280C21F41450E4F2B442
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ S..A=L.A=L.A=LI..L.A=L...L.A=L...L.A=L...L.A=L...L.A=L...L.A=L.A<L.@=L...L.A=L...L.A=L...L.A=L...L.A=L.A.L.A=L...L.A=LRich.A=L........................PE..L...;.mc...........!.........T......]........................................ ............@..............................v..(,...................................... ...8...........................0>..@............................................text............................... ..`.rdata..............................@..@.data...l ...P...,...>..............@....rsrc................j..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AnalyzeData.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.6647075682204004
Encrypted:	false
SSDEEP:	12288:AcEl0P8Ux5PMDn3yu02XCq1cVPO8dyAiPYKJGdM:fElyEniun1cVPOGyAip
MD5:	CBE7D35ED18C0C4AC30D674D24B8FEA6
SHA1:	C7D285D8E305C7589ABA1DF065B99E1708CD03CB
SHA-256:	663C9028A32767B8D3E824073B32335519380FB5D5BFB7D0E39E20F624AE8713
SHA-512:	90F45275650896C150E1D0C42706B1C5CAC6803A9DF3643E7C7C74656AC041C742043D83D1521A2E2F44447E880539F900440B419488A3F3BC901D9F6EB8B8D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).{.m...m...m...d..O...d.....Jen.n...m.......s..n...s..x...d..&...d..l...s..l...d..l...Richm...........................PE..L...:..`...........!.................y.......0.......................................=..........................................(....`.......................p...+...1.................................@............0...............................text............................... ..`.rdata......0....... ..............@..@.data....~..........................@....rsrc........`.......l..............@..@.reloc...-...p.......r..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AudioIntercom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2054144
Entropy (8bit):	6.98550283512543
Encrypted:	false
SSDEEP:	24576:BuaXBmg6NbeeHX3k2BXnRq9ySOtwMMN7R9umPYsBgj5StJqI36KRtK8kn:EaXUkAXnRqsw97cs85y1tE
MD5:	57F215C6207266B4D6F49EB2F3143E4C
SHA1:	25555991792C8E423ED2A9E990D32BE9249407FF
SHA-256:	C4989F004CE6986ED9F8B1C49E219B985CD05D04A15FB4E1C5F681844D498358
SHA-512:	CE713A39681C03BC478894B5D4FE2408ECC5FBCDCE0B0233DE5431C72EAD478D04BBA7AA1339646E31572F5308D218D9F5060E0F8AA7CFDF0771B5898E8FF20B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......................y......M.......d.......c.......t..............I.......c.......).....u.........d......L......\|......=.......z.....Rich............................PE..L.....a...........!.........L............... ................................ .....s...............................@.......0~..P...............................\|G...!............................................... ...............................text............................... ..`.rdata..,p... ...r..................@..@.data................~..............@....rsrc...............................@..@.reloc...Q.......R..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\AudioRender.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	6.55092063463221
Encrypted:	false
SSDEEP:	1536:etPFvOFJvapyoa3UeceWACYThGcI2m+J//Oe2DcBpkgZFPBG64R9P0TU:imSwTUrAnMcb6gZFPArR9P0
MD5:	7C6B77E54F4050F91B438310E063C239
SHA1:	113DC3A534A140B578813B45FE49B55E5F3E3DD2
SHA-256:	4D8F58368EC36F8FFBE2A3E2F2E0651DC2DA20F4761592AEDA947A555C56FA67
SHA-512:	AA2BB8F99156E631CE06BB3B7F89C93F0289547BA0C047A795E153175F4750D313C5F54F0F8E90EA9A191F0814BDA111552AF1026251F910BF7D897BB3DB07D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........F...........C.......U.e.....}......_......E.....M..............R.......D......B......G....Rich...........................PE..L...\|'.a...........!................................................................^.....@.........................p...........x.......................................................................@............................................text............................... ..`.rdata...O.......P..................@..@.data....z... ......................@....rsrc................&..............@..@.reloc..f........ ...,..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\DsSdk.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5288608
Entropy (8bit):	7.908635958052514
Encrypted:	false
SSDEEP:	98304:YxqNFK4d/9WlgaVnTQOZZMZ9WIuuJ2t1fRlgoG0/pPK1Y29Q/a1D54+ne6fcY:YxdCW1LZa9WIuuJ+4iKm2l14+ne6
MD5:	59DD2E8A15777C35E991885436C277EC
SHA1:	70C6695E9C155B6A4EA97154B3564BD6226D0E07
SHA-256:	EACA00F9F2B6C19A90298CA01E33656CD92AD7153517596DD9A1157A5B19A68D
SHA-512:	6E3120F36CD509A34EDDF1B244D538B31E90BF991DA27EC83649333752F89F8144ABD1734F465D32BBAB0EB355723A1202A52BA362C1276D81BEA448FECEE538
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3..wi..wi..wi...a..ti..P...ui...u..li..AO...i...J..vi...J..ui..#J..}i...v..ri..#J..ui...K..si..wi...h...a..di..AO../i...o..vi...I..vi..Richwi..................PE..L...^.{N...........!..........k...............................................p.......Q..............................S..H...(9........o...............P..2....o. L...................................................................................text...>........................... ..`.rdata..............................@..@.data...@-j......0J.................@....rsrc.........o.. ....O.............@..@.reloc..^.....o.......O.............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCAlarm.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	876544
Entropy (8bit):	6.683799077092424
Encrypted:	false
SSDEEP:	24576:bPM+ZfsZZG/AsxF578NBJ8HhYG2UQtqnzAu:bPM+Zic/HbEJ8m3kH
MD5:	3DE8E85F33A979B479F6CF82312EAAE3
SHA1:	B74E6A3D40AC3F8F6090FB1D8BD2F071C7D1865E
SHA-256:	16BF975287FAD23D7860F6E23DF957A80E06D04B43D672E4057ACF7BDFE16C83
SHA-512:	A6190BFCB8447F1D1421FE4EFECDCC6D7AC8376072E664AD0F001A7677952AA2B86965EE5D61FBFC3FA10CF68B840E8CBF7409B219D5F9E1EC980E5D336C6375
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i..:....i...86..i...8...i...8..mi..y."..i...;4..i...i...h...;...i...;...i...;5..i...;2..i...i~..i...;7..i..Rich.i..................PE..L.....mc...........!......................................................................@............................4...$...................................Dp.. ...8............................!..@............................................text.............................. ..`.rdata..............................@..@.data............*..................@....rsrc...............................@..@.reloc..Dp.......r..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCCoreDevCfg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905728
Entropy (8bit):	6.695011112510979
Encrypted:	false
SSDEEP:	24576:OjVMGTPdY0wK32gSiCif9NmwgoS7VHmPXDJTquH:OjVMGxLwKei5NfgrSXDJTdH
MD5:	58FF1A109A828A340E429BDC6A38D688
SHA1:	A95F3C7F71C99432FF7ED4A3AE1443E568E04EB8
SHA-256:	D92D2A648C559C64587AC4DE58574E6F47087F855C92A00BAF32F10E497D94A2
SHA-512:	70283D76B30B503B47B17992B8B95D5319C2924242FA6BE06F7ED45203A82C49869B48BED1FA92D0905B36023D4D72B49DB6AEFD6CD74F3785799AA5B258CCDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R^[..?5..?5..?5....?5.Pn..4?5.Pn..X?5.Pn...?5......?5..m...?5..?4.P>5..m...?5..m...?5..m...?5..m...?5..?...?5..m...?5.Rich.?5.........PE..L.....mc...........!................y........0............................................@..............................)..T........`.......................p.......5..8............................Q..@............0..4............................text............................... ..`.rdata.......0......."..............@..@.data....#...0...,..."..............@....rsrc........`.......N..............@..@.reloc.......p.......R..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCDisplay.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	855552
Entropy (8bit):	6.691412442831537
Encrypted:	false
SSDEEP:	24576:/dC++I0ETngTcKoMhdU0eH9XYMS8eFaTX:/dC++4bgTTTd1urQ0TX
MD5:	9A5970AA663B7E2FBDA7DB9EE8CF724C
SHA1:	CA42F49B974856DF3F96AE2E8429B50FFA79041E
SHA-256:	31D9A1295C3EEEA0177FA2CBF4592C9114784DF259370016FBC562119F2EC671
SHA-512:	6477DB39D239FC465B0E91A719D73C063C0676DDDBDCAF1C328E600E39C9E0D0649EDCC1CA9CC1B990743A26FA6D0E473D928C1A9E2DD6BB5BD31C33B5E6F449
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%.g.%...%..%...%.=%...%.<%[..%O8.%...%...%...%...%...%..9%...%..=%...%...%...%...%...%..K%...%...%...%Rich...%................PE..L.....mc...........!.........4...............................................0............@..........................9.......V...................................r..p...8...............................@............................................text...v........................... ..`.rdata..L...........................@..@.data...l........,...j..............@....rsrc...............................@..@.reloc...r.......t..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCGeneralCfgMgr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1361408
Entropy (8bit):	6.733125598553717
Encrypted:	false
SSDEEP:	24576:RtERzMFVtn1f1mg7pvyRI7o5IClBW0X0EYnX+t1DXRJ1FRKbShFmzPJ9ylSoJMUQ:RGRzMh1f1mg7p4z5ICmE71DX/1FRKbSE
MD5:	57C49243EF2331AED4EF011D28D32786
SHA1:	F41EC94D91F898C1231184579302371D6A2A06E3
SHA-256:	D6CBD8B7FDE5EF39AFEE871ED27E92CD0990D3F677B53BEF1F8A20B168AD15FC
SHA-512:	227FCECD9994F409581057F0C8A84F0FB68E949D338209290088DEEF5B9062025DF3F0396422F8D151AC48DA688A28DFE55601B5D9E19A37A6A1E9DF8FA0B3D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_C^.>-..>-..>-.^....>-..o...>-..o...>-..o...>-......>-..l...>-..>,..?-..l...>-..l...>-..l...>-..l...>-..>...>-..l...>-.Rich.>-.........PE..L.....mc...........!.........................................................&...........@.........................p...8.............%...................... %.h.......8..............................@...............T............................text.............................. ..`.rdata..............................@..@.data...."..........................@....rsrc.........%.....................@..@.reloc..h.... %.....................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCIndustry.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1057792
Entropy (8bit):	6.705189942336038
Encrypted:	false
SSDEEP:	24576:X1mSi2ToaGE1RaFaXR77xtXVIBGSyvP5S60Vcm:X1mSi2IsasXBttXVIBLwUVcm
MD5:	8B746412385B23F9B6D1EB83AE1B9B69
SHA1:	3A53E8F82D972EAFD7D7326D75DBBA387438B8CB
SHA-256:	479D43C35F63E6BD88C0E24A8C2A22D31997632762FB51F30AD2276870052ED8
SHA-512:	728AD3F08A4668A24E66622BCA2A956E06D3572F75D67BB72646D17E15B62C4B3AB2DC76346BD8F8303BD4BD0D708920C1C0B5ADDF2FCDF4E2500D94FC919F61
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4u..U.Z.U.Z.U.ZB..Z.U.Z...Z.U.Z...Z.U.Z...Z.U.Z...Z.U.Z...Z.U.Z.U.Z.T.Z...Z.U.Z...Z.U.Z...Z.U.Z...Z.U.Z.U.Z.U.Z...Z.U.ZRich.U.Z........................PE..L.....mc...........!.........t...............................................P!...........@..........................F......dd........ ....................... ........8...............................@............................................text............................... ..`.rdata..............................@..@.data...,........*...r..............@....rsrc......... .....................@..@.reloc....... .....................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCPlayBack.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	747520
Entropy (8bit):	6.68713993447613
Encrypted:	false
SSDEEP:	12288:omcOzStOF/Jj89bLkGl2FwlxwwSTeFqMbErbrISc9dG09c8YhY2VeZlXTKkwmlv:2OzStOFxj89bLk9FwbwwxFR9FQ+UebXJ
MD5:	A0F939BD22AC019BC26343EB570AF45C
SHA1:	E606452ABFCD9F76F55CC056E45040A6BB58B281
SHA-256:	361C3E7ABAF36AD962F43F8ADDDDE3969CADCDE294A0ABC36251792F137B7C75
SHA-512:	ED20F19A0AB4C47E6B79AFEDB1CEF14963EAAAAACC1B24EE58DEED43A084EECEE9149DEEE519251E7D498FC26F98AB6CB14C1686BD13B4ABBDBFDF3C5B4CA338
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lI.Z((..((..((....].+(..nyE..(..ny{.`(..nyz..(....Q.$(..%zG.-(..((..C)..%z..2(..%z{.>(..%zF.)(..%zA.)(..((..)(..%zD.)(..Rich((..........................PE..L.....mc...........!................r.....................................................@.................................X........P.......................`...g..P...8...........................P(..@............................................text............................... ..`.rdata..............................@..@.data...L_.......,..................@....rsrc........P......................@..@.reloc...g...`...h..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCPreview.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	686080
Entropy (8bit):	6.62783773879799
Encrypted:	false
SSDEEP:	12288:hkfvH6rnAMQ/qeboMrliTYJPFSnCAgG0pMGTfTboeLbrD+imgdmMF8oY7Uz3:WnH6rAM4qebo+ATYJPFSnCAgG0jvoWPT
MD5:	25D9993DBAAF9FF69438F92CE24E2EA9
SHA1:	81462CBF22C61A3DEF00094E60520B3AB532282D
SHA-256:	579AE68AA8399E38DC990CED49F6F8BF5D35DB046E38C97C64EFBD002B48D928
SHA-512:	3296EB25D13E8C99909BEA4E9A67E8BBD641C3B90ECDDA5E1D821A96AAEA6C7D10B9F9432E4BCB4AB903C9B1520E8A8499CA491626572BD22094280345A3693B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,G.gh&l4h&l4h&l4...4k&l4.w.4I&l4.w.4"&l4.w.4.&l4..4d&l4et.4m&l4h&m44'l4et.4r&l4et.4z&l4et.4i&l4et.4i&l4h&.4i&l4et.4i&l4Richh&l4........PE..L.....mc...........!.....>...j......iQ.......P............................................@.........................................P.......................`..4h...V..8............................(..@............P...............................text....<.......>.................. ..`.rdata.......P.......B..............@..@.data...L_.......,..................@....rsrc........P......................@..@.reloc..4h...`...j..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\HCVoiceTalk.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	689152
Entropy (8bit):	6.657811406045089
Encrypted:	false
SSDEEP:	12288:YjyFfOgRx6ekVVMnxAstyc7GRSNM0NbsZW1Ws0FuzHP73G6+5OnhILJx5PsFquu8:YjMf56ekVVMxAQ70FuzHPywn2Lf5PsFL
MD5:	849BBFCFA413859B621048E4561F1D28
SHA1:	C3638A401047D17100D1B2EE5BDB206BCE92799D
SHA-256:	EA26D8B87E79A88B4C99A144FCA713A892693692E9348956935FBB08FB7785D6
SHA-512:	959CCFC61976D4A8D280D80C2C3E7ACD4338A042CE30FE631A327DD006AB38838F04DB425DEF7404CBC51EA7BD1576EB312AF070B613EE89F825ECDEBEFA8B26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......j.@....}...}...}..$},..}z..}?..}.}.}-..}h..}...}h..}f..}h..}...}.".}"..}#..}+..}../}5..}#..}5..}#..}%..}#..}/..}#..}/..}..}/..}#..}/..}Rich...}........................PE..L.....mc...........!.........Z......i^.......0............................................@.........................pq..(....z.......0.......................@...d.. 5..8...............................@............0...............................text............................... ..`.rdata..zk...0...l..................@..@.data..............................@....rsrc........0......................@..@.reloc...d...@...f..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\OpenAL32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	375808
Entropy (8bit):	7.079582943202465
Encrypted:	false
SSDEEP:	6144:iaVgHJEoFJdVBJUMhZW9stxtl91TfE3wxxmpcYK4vcXr1+OUbyc5/g1DnUq46t0r:7V5oFJdVBJUMhZ2I3l9pM3wx+cYK4vcQ
MD5:	F1AE1CEA6A77616C739AC021C38EB910
SHA1:	152B5379395C03270243610A293D1D7555BE725D
SHA-256:	6D1626E2C850B15A6A1F0CAC3CEEC9F24A20F6EE3A9C4199F9BF2E02CA5DD2C8
SHA-512:	B2118491B4B0FBB37103BFB2B76FDBE68BE969EF1FF9106012FFFB94EFDCE9B76EF2290313D6D563ED943472D3E9BABF85F7B8BD2B254293D2C8C6706384E79B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................k.......m.......\|.....b.n......3..........B.....{.......j.......l.......i.....Rich............................PE..L....1._...........!.....l...L......Qu....................................................@..........................}..!....p...................................-...................................o..@...............\|............................text....k.......l.................. ..`.rdata..1............p..............@..@.data................~..............@....rsrc...............................@..@.reloc..v3.......4..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\StreamTransClient.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	722432
Entropy (8bit):	6.739964422128905
Encrypted:	false
SSDEEP:	12288:TJ6/czYIiKyMFPG+fGN8GtqJQm71KScBSQCeXU9Bc4IheM67ltAQ7:TAczYIi0PGV8Gtq7gPXXU9B26MQ
MD5:	93EA752C99F74DAF60B47F6DAF463114
SHA1:	8326C79D233D832FB6FDBA437206F85E74A3F89C
SHA-256:	1EC7DEF31FA9B60F5F7E45D79B5A4ECEEA901031C9E992AC525DE77C8B2D7C3A
SHA-512:	617D9B275ECBB335F9CD2A19CA8124D5170AA7A7BF70FCE96D956E826E405E5FEAA884235539A97EDA824D94320960A078631955438597218279FB1B080169CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2...v.v.v.v.v.v.....r.v.0..W.v.0..8.v.0...v.A..{.v.v.w...v.{.._.v.{..w.v.{..V.v.{..w.v.{..w.v.v...w.v.{..w.v.Richv.v.........PE..L.....3c...........!.........L............................................... !...........@..........................d......@j........ ....................... .xk......8...............................@............................................text.............................. ..`.rdata..:...........................@..@.data............*...l..............@....rsrc......... .....................@..@.reloc..xk.... ..l..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\SystemTransform.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	720896
Entropy (8bit):	6.76867680900025
Encrypted:	false
SSDEEP:	12288:jBv0gRyuyE1GnFFFZ62A1fp6P4lMnKqUmyrmb3muX:jBL8lFFFZsfpO4ltmmmbm
MD5:	9C5F17C3BD94822ABD3F324512433904
SHA1:	E40D3B6538DF16025CD7BD4F32AFDAD0FA1995C3
SHA-256:	121DAA31C1CD22E86256BA3B9D5707E9046CF1D1C88464B206029E862ED81C9D
SHA-512:	3AB58CD702DEB5BD3D015CB64003ADB23490FEC7B13E55201654E391A2875C2613997C8BFA50CBF350DB8866B3767D8C25C9CC641D79947BE642C14933E07BB8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K.FQ..Q..Q..XR..r..v...R..Q..7..XR.....XR..%..XR..P..Ox..P..XR..P..RichQ*..................PE..L...,.gb...........!.................x...............................................................................N..7....E..(................................J..................................@...@............................................text...6........................... ..`.rdata..'D.......F..................@..@.data....K...`...p...<..............@....rsrc...............................@..@.reloc...M.......N..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-0AS8F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	720896
Entropy (8bit):	6.76867680900025
Encrypted:	false
SSDEEP:	12288:jBv0gRyuyE1GnFFFZ62A1fp6P4lMnKqUmyrmb3muX:jBL8lFFFZsfpO4ltmmmbm
MD5:	9C5F17C3BD94822ABD3F324512433904
SHA1:	E40D3B6538DF16025CD7BD4F32AFDAD0FA1995C3
SHA-256:	121DAA31C1CD22E86256BA3B9D5707E9046CF1D1C88464B206029E862ED81C9D
SHA-512:	3AB58CD702DEB5BD3D015CB64003ADB23490FEC7B13E55201654E391A2875C2613997C8BFA50CBF350DB8866B3767D8C25C9CC641D79947BE642C14933E07BB8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K.FQ..Q..Q..XR..r..v...R..Q..7..XR.....XR..%..XR..P..Ox..P..XR..P..RichQ*..................PE..L...,.gb...........!.................x...............................................................................N..7....E..(................................J..................................@...@............................................text...6........................... ..`.rdata..'D.......F..................@..@.data....K...`...p...<..............@....rsrc...............................@..@.reloc...M.......N..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-0O0CK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2054144
Entropy (8bit):	6.98550283512543
Encrypted:	false
SSDEEP:	24576:BuaXBmg6NbeeHX3k2BXnRq9ySOtwMMN7R9umPYsBgj5StJqI36KRtK8kn:EaXUkAXnRqsw97cs85y1tE
MD5:	57F215C6207266B4D6F49EB2F3143E4C
SHA1:	25555991792C8E423ED2A9E990D32BE9249407FF
SHA-256:	C4989F004CE6986ED9F8B1C49E219B985CD05D04A15FB4E1C5F681844D498358
SHA-512:	CE713A39681C03BC478894B5D4FE2408ECC5FBCDCE0B0233DE5431C72EAD478D04BBA7AA1339646E31572F5308D218D9F5060E0F8AA7CFDF0771B5898E8FF20B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......................y......M.......d.......c.......t..............I.......c.......).....u.........d......L......\|......=.......z.....Rich............................PE..L.....a...........!.........L............... ................................ .....s...............................@.......0~..P...............................\|G...!............................................... ...............................text............................... ..`.rdata..,p... ...r..................@..@.data................~..............@....rsrc...............................@..@.reloc...Q.......R..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-1LITI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	686080
Entropy (8bit):	6.62783773879799
Encrypted:	false
SSDEEP:	12288:hkfvH6rnAMQ/qeboMrliTYJPFSnCAgG0pMGTfTboeLbrD+imgdmMF8oY7Uz3:WnH6rAM4qebo+ATYJPFSnCAgG0jvoWPT
MD5:	25D9993DBAAF9FF69438F92CE24E2EA9
SHA1:	81462CBF22C61A3DEF00094E60520B3AB532282D
SHA-256:	579AE68AA8399E38DC990CED49F6F8BF5D35DB046E38C97C64EFBD002B48D928
SHA-512:	3296EB25D13E8C99909BEA4E9A67E8BBD641C3B90ECDDA5E1D821A96AAEA6C7D10B9F9432E4BCB4AB903C9B1520E8A8499CA491626572BD22094280345A3693B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,G.gh&l4h&l4h&l4...4k&l4.w.4I&l4.w.4"&l4.w.4.&l4..4d&l4et.4m&l4h&m44'l4et.4r&l4et.4z&l4et.4i&l4et.4i&l4h&.4i&l4et.4i&l4Richh&l4........PE..L.....mc...........!.....>...j......iQ.......P............................................@.........................................P.......................`..4h...V..8............................(..@............P...............................text....<.......>.................. ..`.rdata.......P.......B..............@..@.data...L_.......,..................@....rsrc........P......................@..@.reloc..4h...`...j..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-3HBPA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	6.55092063463221
Encrypted:	false
SSDEEP:	1536:etPFvOFJvapyoa3UeceWACYThGcI2m+J//Oe2DcBpkgZFPBG64R9P0TU:imSwTUrAnMcb6gZFPArR9P0
MD5:	7C6B77E54F4050F91B438310E063C239
SHA1:	113DC3A534A140B578813B45FE49B55E5F3E3DD2
SHA-256:	4D8F58368EC36F8FFBE2A3E2F2E0651DC2DA20F4761592AEDA947A555C56FA67
SHA-512:	AA2BB8F99156E631CE06BB3B7F89C93F0289547BA0C047A795E153175F4750D313C5F54F0F8E90EA9A191F0814BDA111552AF1026251F910BF7D897BB3DB07D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........F...........C.......U.e.....}......_......E.....M..............R.......D......B......G....Rich...........................PE..L...\|'.a...........!................................................................^.....@.........................p...........x.......................................................................@............................................text............................... ..`.rdata...O.......P..................@..@.data....z... ......................@....rsrc................&..............@..@.reloc..f........ ...,..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-3V2DB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.6647075682204004
Encrypted:	false
SSDEEP:	12288:AcEl0P8Ux5PMDn3yu02XCq1cVPO8dyAiPYKJGdM:fElyEniun1cVPOGyAip
MD5:	CBE7D35ED18C0C4AC30D674D24B8FEA6
SHA1:	C7D285D8E305C7589ABA1DF065B99E1708CD03CB
SHA-256:	663C9028A32767B8D3E824073B32335519380FB5D5BFB7D0E39E20F624AE8713
SHA-512:	90F45275650896C150E1D0C42706B1C5CAC6803A9DF3643E7C7C74656AC041C742043D83D1521A2E2F44447E880539F900440B419488A3F3BC901D9F6EB8B8D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).{.m...m...m...d..O...d.....Jen.n...m.......s..n...s..x...d..&...d..l...s..l...d..l...Richm...........................PE..L...:..`...........!.................y.......0.......................................=..........................................(....`.......................p...+...1.................................@............0...............................text............................... ..`.rdata......0....... ..............@..@.data....~..........................@....rsrc........`.......l..............@..@.reloc...-...p.......r..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-5ONIC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	375808
Entropy (8bit):	7.079582943202465
Encrypted:	false
SSDEEP:	6144:iaVgHJEoFJdVBJUMhZW9stxtl91TfE3wxxmpcYK4vcXr1+OUbyc5/g1DnUq46t0r:7V5oFJdVBJUMhZ2I3l9pM3wx+cYK4vcQ
MD5:	F1AE1CEA6A77616C739AC021C38EB910
SHA1:	152B5379395C03270243610A293D1D7555BE725D
SHA-256:	6D1626E2C850B15A6A1F0CAC3CEEC9F24A20F6EE3A9C4199F9BF2E02CA5DD2C8
SHA-512:	B2118491B4B0FBB37103BFB2B76FDBE68BE969EF1FF9106012FFFB94EFDCE9B76EF2290313D6D563ED943472D3E9BABF85F7B8BD2B254293D2C8C6706384E79B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................k.......m.......\|.....b.n......3..........B.....{.......j.......l.......i.....Rich............................PE..L....1._...........!.....l...L......Qu....................................................@..........................}..!....p...................................-...................................o..@...............\|............................text....k.......l.................. ..`.rdata..1............p..............@..@.data................~..............@....rsrc...............................@..@.reloc..v3.......4..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-6999P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	978432
Entropy (8bit):	7.389576051888232
Encrypted:	false
SSDEEP:	24576:Mf0TfklyKuJGavkg3Ny4WbbbVKHYsa4QhBAUZLYr5vx:AaayKuJGaXFQK4sDQhBAUZLYrtx
MD5:	FD1DC6C680299A2ED1EEDCC3EABDA601
SHA1:	E702404882B03014ABEB2ADEAD38A9E87AD90046
SHA-256:	CB016E794D3311C71F21D87803E10A0E1133995F62A485EB37B321CD9B9E1087
SHA-512:	2AED2D9F2D086A52A25F320DF3F2BDA144C6ADDE7D7F3BB8974EBCDEE7D65130246B357A54E383DAA88C22578193009EF0AC1F627C7094C413DC157ADCBC3DF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.mA..........."...8...........................h.........................@................ .........................l............ .......................0.......................................................................................text...............................`..`.data...@...........................@....bss.....................................edata..l................................idata..............................@....rsrc........ ......................@....reloc.......0..................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-92IS9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	747520
Entropy (8bit):	6.68713993447613
Encrypted:	false
SSDEEP:	12288:omcOzStOF/Jj89bLkGl2FwlxwwSTeFqMbErbrISc9dG09c8YhY2VeZlXTKkwmlv:2OzStOFxj89bLk9FwbwwxFR9FQ+UebXJ
MD5:	A0F939BD22AC019BC26343EB570AF45C
SHA1:	E606452ABFCD9F76F55CC056E45040A6BB58B281
SHA-256:	361C3E7ABAF36AD962F43F8ADDDDE3969CADCDE294A0ABC36251792F137B7C75
SHA-512:	ED20F19A0AB4C47E6B79AFEDB1CEF14963EAAAAACC1B24EE58DEED43A084EECEE9149DEEE519251E7D498FC26F98AB6CB14C1686BD13B4ABBDBFDF3C5B4CA338
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lI.Z((..((..((....].+(..nyE..(..ny{.`(..nyz..(....Q.$(..%zG.-(..((..C)..%z..2(..%z{.>(..%zF.)(..%zA.)(..((..)(..%zD.)(..Rich((..........................PE..L.....mc...........!................r.....................................................@.................................X........P.......................`...g..P...8...........................P(..@............................................text............................... ..`.rdata..............................@..@.data...L_.......,..................@....rsrc........P......................@..@.reloc...g...`...h..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-AN0JV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	876544
Entropy (8bit):	6.683799077092424
Encrypted:	false
SSDEEP:	24576:bPM+ZfsZZG/AsxF578NBJ8HhYG2UQtqnzAu:bPM+Zic/HbEJ8m3kH
MD5:	3DE8E85F33A979B479F6CF82312EAAE3
SHA1:	B74E6A3D40AC3F8F6090FB1D8BD2F071C7D1865E
SHA-256:	16BF975287FAD23D7860F6E23DF957A80E06D04B43D672E4057ACF7BDFE16C83
SHA-512:	A6190BFCB8447F1D1421FE4EFECDCC6D7AC8376072E664AD0F001A7677952AA2B86965EE5D61FBFC3FA10CF68B840E8CBF7409B219D5F9E1EC980E5D336C6375
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i..:....i...86..i...8...i...8..mi..y."..i...;4..i...i...h...;...i...;...i...;5..i...;2..i...i~..i...;7..i..Rich.i..................PE..L.....mc...........!......................................................................@............................4...$...................................Dp.. ...8............................!..@............................................text.............................. ..`.rdata..............................@..@.data............*..................@....rsrc...............................@..@.reloc..Dp.......r..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-AO5VR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655872
Entropy (8bit):	6.890407230950918
Encrypted:	false
SSDEEP:	12288:1hr4UCeeHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axPFmRyy6aE:5e2g5gmO791I0E5uO9FAN9mRyyzE
MD5:	4D03CA609E68F4C90CF66515218017F8
SHA1:	545E440940073D5EC49D47FEFD421730F8B33EFB
SHA-256:	CF420ACED0D810E1D75F6811DD986F2D9FDED2FBB8D61FC9A7024520C475FEBB
SHA-512:	1B52D09F94BD37850D098AE7222E85E16A4F6DF14CFDFC28526CD98B81FB009865FA75774EE4FEAA2E5D5861BEA27759FE4FB979C902F8EA60AFA8C3E1F723FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L......H...........!.....Z..........@-.......p....Rx.........................0......!f....@.........................`....\|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-DE2KP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905728
Entropy (8bit):	6.695011112510979
Encrypted:	false
SSDEEP:	24576:OjVMGTPdY0wK32gSiCif9NmwgoS7VHmPXDJTquH:OjVMGxLwKei5NfgrSXDJTdH
MD5:	58FF1A109A828A340E429BDC6A38D688
SHA1:	A95F3C7F71C99432FF7ED4A3AE1443E568E04EB8
SHA-256:	D92D2A648C559C64587AC4DE58574E6F47087F855C92A00BAF32F10E497D94A2
SHA-512:	70283D76B30B503B47B17992B8B95D5319C2924242FA6BE06F7ED45203A82C49869B48BED1FA92D0905B36023D4D72B49DB6AEFD6CD74F3785799AA5B258CCDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R^[..?5..?5..?5....?5.Pn..4?5.Pn..X?5.Pn...?5......?5..m...?5..?4.P>5..m...?5..m...?5..m...?5..m...?5..?...?5..m...?5.Rich.?5.........PE..L.....mc...........!................y........0............................................@..............................)..T........`.......................p.......5..8............................Q..@............0..4............................text............................... ..`.rdata.......0......."..............@..@.data....#...0...,..."..............@....rsrc........`.......N..............@..@.reloc.......p.......R..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-EM24B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	722432
Entropy (8bit):	6.739964422128905
Encrypted:	false
SSDEEP:	12288:TJ6/czYIiKyMFPG+fGN8GtqJQm71KScBSQCeXU9Bc4IheM67ltAQ7:TAczYIi0PGV8Gtq7gPXXU9B26MQ
MD5:	93EA752C99F74DAF60B47F6DAF463114
SHA1:	8326C79D233D832FB6FDBA437206F85E74A3F89C
SHA-256:	1EC7DEF31FA9B60F5F7E45D79B5A4ECEEA901031C9E992AC525DE77C8B2D7C3A
SHA-512:	617D9B275ECBB335F9CD2A19CA8124D5170AA7A7BF70FCE96D956E826E405E5FEAA884235539A97EDA824D94320960A078631955438597218279FB1B080169CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2...v.v.v.v.v.v.....r.v.0..W.v.0..8.v.0...v.A..{.v.v.w...v.{.._.v.{..w.v.{..V.v.{..w.v.{..w.v.v...w.v.{..w.v.Richv.v.........PE..L.....3c...........!.........L............................................... !...........@..........................d......@j........ ....................... .xk......8...............................@............................................text.............................. ..`.rdata..:...........................@..@.data............*...l..............@....rsrc......... .....................@..@.reloc..xk.... ..l..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-JD9GS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1057792
Entropy (8bit):	6.705189942336038
Encrypted:	false
SSDEEP:	24576:X1mSi2ToaGE1RaFaXR77xtXVIBGSyvP5S60Vcm:X1mSi2IsasXBttXVIBLwUVcm
MD5:	8B746412385B23F9B6D1EB83AE1B9B69
SHA1:	3A53E8F82D972EAFD7D7326D75DBBA387438B8CB
SHA-256:	479D43C35F63E6BD88C0E24A8C2A22D31997632762FB51F30AD2276870052ED8
SHA-512:	728AD3F08A4668A24E66622BCA2A956E06D3572F75D67BB72646D17E15B62C4B3AB2DC76346BD8F8303BD4BD0D708920C1C0B5ADDF2FCDF4E2500D94FC919F61
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4u..U.Z.U.Z.U.ZB..Z.U.Z...Z.U.Z...Z.U.Z...Z.U.Z...Z.U.Z...Z.U.Z.U.Z.T.Z...Z.U.Z...Z.U.Z...Z.U.Z...Z.U.Z.U.Z.U.Z...Z.U.ZRich.U.Z........................PE..L.....mc...........!.........t...............................................P!...........@..........................F......dd........ ....................... ........8...............................@............................................text............................... ..`.rdata..............................@..@.data...,........*...r..............@....rsrc......... .....................@..@.reloc....... .....................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-NFHD7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	689152
Entropy (8bit):	6.657811406045089
Encrypted:	false
SSDEEP:	12288:YjyFfOgRx6ekVVMnxAstyc7GRSNM0NbsZW1Ws0FuzHP73G6+5OnhILJx5PsFquu8:YjMf56ekVVMxAQ70FuzHPywn2Lf5PsFL
MD5:	849BBFCFA413859B621048E4561F1D28
SHA1:	C3638A401047D17100D1B2EE5BDB206BCE92799D
SHA-256:	EA26D8B87E79A88B4C99A144FCA713A892693692E9348956935FBB08FB7785D6
SHA-512:	959CCFC61976D4A8D280D80C2C3E7ACD4338A042CE30FE631A327DD006AB38838F04DB425DEF7404CBC51EA7BD1576EB312AF070B613EE89F825ECDEBEFA8B26
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......j.@....}...}...}..$},..}z..}?..}.}.}-..}h..}...}h..}f..}h..}...}.".}"..}#..}+..}../}5..}#..}5..}#..}%..}#..}/..}#..}/..}..}/..}#..}/..}Rich...}........................PE..L.....mc...........!.........Z......i^.......0............................................@.........................pq..(....z.......0.......................@...d.. 5..8...............................@............0...............................text............................... ..`.rdata..zk...0...l..................@..@.data..............................@....rsrc........0......................@..@.reloc...d...@...f..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-PNOA2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5288608
Entropy (8bit):	7.908635958052514
Encrypted:	false
SSDEEP:	98304:YxqNFK4d/9WlgaVnTQOZZMZ9WIuuJ2t1fRlgoG0/pPK1Y29Q/a1D54+ne6fcY:YxdCW1LZa9WIuuJ+4iKm2l14+ne6
MD5:	59DD2E8A15777C35E991885436C277EC
SHA1:	70C6695E9C155B6A4EA97154B3564BD6226D0E07
SHA-256:	EACA00F9F2B6C19A90298CA01E33656CD92AD7153517596DD9A1157A5B19A68D
SHA-512:	6E3120F36CD509A34EDDF1B244D538B31E90BF991DA27EC83649333752F89F8144ABD1734F465D32BBAB0EB355723A1202A52BA362C1276D81BEA448FECEE538
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......3..wi..wi..wi...a..ti..P...ui...u..li..AO...i...J..vi...J..ui..#J..}i...v..ri..#J..ui...K..si..wi...h...a..di..AO../i...o..vi...I..vi..Richwi..................PE..L...^.{N...........!..........k...............................................p.......Q..............................S..H...(9........o...............P..2....o. L...................................................................................text...>........................... ..`.rdata..............................@..@.data...@-j......0J.................@....rsrc.........o.. ....O.............@..@.reloc..^.....o.......O.............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-RM1K1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1361408
Entropy (8bit):	6.733125598553717
Encrypted:	false
SSDEEP:	24576:RtERzMFVtn1f1mg7pvyRI7o5IClBW0X0EYnX+t1DXRJ1FRKbShFmzPJ9ylSoJMUQ:RGRzMh1f1mg7p4z5ICmE71DX/1FRKbSE
MD5:	57C49243EF2331AED4EF011D28D32786
SHA1:	F41EC94D91F898C1231184579302371D6A2A06E3
SHA-256:	D6CBD8B7FDE5EF39AFEE871ED27E92CD0990D3F677B53BEF1F8A20B168AD15FC
SHA-512:	227FCECD9994F409581057F0C8A84F0FB68E949D338209290088DEEF5B9062025DF3F0396422F8D151AC48DA688A28DFE55601B5D9E19A37A6A1E9DF8FA0B3D8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_C^.>-..>-..>-.^....>-..o...>-..o...>-..o...>-......>-..l...>-..>,..?-..l...>-..l...>-..l...>-..l...>-..>...>-..l...>-.Rich.>-.........PE..L.....mc...........!.........................................................&...........@.........................p...8.............%...................... %.h.......8..............................@...............T............................text.............................. ..`.rdata..............................@..@.data...."..........................@....rsrc.........%.....................@..@.reloc..h.... %.....................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\is-RUF54.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	855552
Entropy (8bit):	6.691412442831537
Encrypted:	false
SSDEEP:	24576:/dC++I0ETngTcKoMhdU0eH9XYMS8eFaTX:/dC++4bgTTTd1urQ0TX
MD5:	9A5970AA663B7E2FBDA7DB9EE8CF724C
SHA1:	CA42F49B974856DF3F96AE2E8429B50FFA79041E
SHA-256:	31D9A1295C3EEEA0177FA2CBF4592C9114784DF259370016FBC562119F2EC671
SHA-512:	6477DB39D239FC465B0E91A719D73C063C0676DDDBDCAF1C328E600E39C9E0D0649EDCC1CA9CC1B990743A26FA6D0E473D928C1A9E2DD6BB5BD31C33B5E6F449
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%.g.%...%..%...%.=%...%.<%[..%O8.%...%...%...%...%...%..9%...%..=%...%...%...%...%...%..K%...%...%...%Rich...%................PE..L.....mc...........!.........4...............................................0............@..........................9.......V...................................r..p...8...............................@............................................text...v........................... ..`.rdata..L...........................@..@.data...l........,...j..............@....rsrc...............................@..@.reloc...r.......t..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\libiconv2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	978432
Entropy (8bit):	7.389576051888232
Encrypted:	false
SSDEEP:	24576:Mf0TfklyKuJGavkg3Ny4WbbbVKHYsa4QhBAUZLYr5vx:AaayKuJGaXFQK4sDQhBAUZLYrtx
MD5:	FD1DC6C680299A2ED1EEDCC3EABDA601
SHA1:	E702404882B03014ABEB2ADEAD38A9E87AD90046
SHA-256:	CB016E794D3311C71F21D87803E10A0E1133995F62A485EB37B321CD9B9E1087
SHA-512:	2AED2D9F2D086A52A25F320DF3F2BDA144C6ADDE7D7F3BB8974EBCDEE7D65130246B357A54E383DAA88C22578193009EF0AC1F627C7094C413DC157ADCBC3DF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.mA..........."...8...........................h.........................@................ .........................l............ .......................0.......................................................................................text...............................`..`.data...@...........................@....bss.....................................edata..l................................idata..............................@....rsrc........ ......................@....reloc.......0..................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HCNetSDKCom\msvcr90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655872
Entropy (8bit):	6.890407230950918
Encrypted:	false
SSDEEP:	12288:1hr4UCeeHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axPFmRyy6aE:5e2g5gmO791I0E5uO9FAN9mRyyzE
MD5:	4D03CA609E68F4C90CF66515218017F8
SHA1:	545E440940073D5EC49D47FEFD421730F8B33EFB
SHA-256:	CF420ACED0D810E1D75F6811DD986F2D9FDED2FBB8D61FC9A7024520C475FEBB
SHA-512:	1B52D09F94BD37850D098AE7222E85E16A4F6DF14CFDFC28526CD98B81FB009865FA75774EE4FEAA2E5D5861BEA27759FE4FB979C902F8EA60AFA8C3E1F723FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L......H...........!.....Z..........@-.......p....Rx.........................0......!f....@.........................`....\|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HWDecode.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1325056
Entropy (8bit):	6.538912426398886
Encrypted:	false
SSDEEP:	24576:U+hcnIflk51vNrhW2ORXffWXCphzIciJk44wBP5+o0erXwMmwb1E:U0cnklkDz27zTiJn4wRZZ5mwbu
MD5:	F83C16A2E9274F2118E1734A9B9B1B5E
SHA1:	384F66EE3E055AC0418921820396A5948793718D
SHA-256:	DEE59B389BC51ED2950FAAB315FEFA3FE9609F6833224D53D28E789475B4BFBE
SHA-512:	4A2AD713B789190D5D305CCF8190EF33C221F0DC5C4A216C768348D53406EC43528D307FBBC966231CA0CCA5CA23DBDA669C3E230FB6C22ECDC39E8062A10F1D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tt~w0..$0..$0..$.Z.$2..$9m.$...$9m.$...$..}$1..$9m.$b..$..k$!..$0..$E..$9m.$s..$9m.$1..$.G.$1..$9m.$1..$Rich0..$........PE..L...JW.Z...........!.....l................................................................@.........................`...........................................W..................................P...@............................................text...sj.......l.................. ..`.rdata...0.......2...p..............@..@.data...l...........................@....rsrc...............................@..@.reloc...r.......t..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HXVA.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1878592
Entropy (8bit):	6.6018172083540305
Encrypted:	false
SSDEEP:	24576:aHdkoZbI7+BNNNYC7vqv8viwa/mlWwvsv/6UQon0OKjo5Nd83KJXl0pDcY0IdZgp:a9y2NCwayMV5Nd8aJXlwhhSyd2b5V0e
MD5:	109E041620DFEF9BC1BDA3D8CB4CBEB7
SHA1:	11C8DD3472F42132C29BE3DC4D2E4926BB29DC58
SHA-256:	02C4FA2C535EB8D8ACD888C13CEB5A97C44AE2A293BBE58D4A673E3EF9693A87
SHA-512:	A0168901792C8E7B853DE0882D8F2A8F2E313CA6AF02B58451A13BE2476938798BCD03A626966B84855253D63FD614EB1E109B12FFD3FDAD06255413C134B200
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........W2Q.9aQ.9aQ.9a...aP.9a...a..9a...a..9a...a..9a...aP.9a...aP.9av.Wa[.9a\-.a..9aQ.8a..9a...aD.9a...aU.9a\-.a\|.9a\-.aP.9a\-.aP.9aQ..aP.9a\-.aP.9aRichQ.9a........PE..L...1..a...........!.........$............... ...............................`............@.........................0...................................@ ..........0$..8...........................`0..@............ ...............................text...,........................... ..`.rdata..:.... ......................@..@.data............:..................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\HmMerge.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87552
Entropy (8bit):	6.518079451361349
Encrypted:	false
SSDEEP:	1536:zyqciylsql8Ao9lgxjt+PyK+vh6d6Mt+Gu0aPnHuM+jZ/kd8j7Ja/f9N1+LOt6qf:z1FyOql8Ao9lY+PYvgu5PnHuBjZcd8jY
MD5:	4F07153B94647A8F0DD844AD1F79C092
SHA1:	1B59C179284C4675D5408391F96C95F8DA2E9237
SHA-256:	7559B5BC65BCAE4BFDFF50AF2343B117F631B60F5507EFD3A3344C6684661DCA
SHA-512:	5EC61C9791F4DE674F2496BDC3BFD20EA8153B1E42017810A7F540DAC6B613C11395293E9F63627A02AC8A8008E05FAAAFB9575DD914C48FE69017112EFCD6C8
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......O 2c.A\0.A\0.A\0.9.0.A\0...0.A\0.9.0.A\0.9.0.A\0,.'0.A\0.A]05A\0.9.0.A\0.^W0.A\0.A\0.A\0_bl0.A\0.9.0.A\0.9.0.A\0...0.A\0.9.0.A\0Rich.A\0........................PE..L......^...........!.........J...............0......................................IL.............................. A......\;..<................................... 1...............................................0...............................text............................... ..`.rodata.p.... ...................... ..`.rdata.......0......................@..@.data....h...P...(... ..............@....rsrc................H..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\ISTask.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.357541095717686
Encrypted:	false
SSDEEP:	1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
MD5:	86A1311D51C00B278CB7F27796EA442E
SHA1:	AC08AC9D08F8F5380E2A9A65F4117862AA861A19
SHA-256:	E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D
SHA-512:	129E4B8DD2665BCFC5E72B4585343C51127B5D027DBB0234291E7A197BAECA1BAB5ED074E65E5E8C969EE01F9F65CC52C9993037416DE9BFFF2F872E5AEBA7EC
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................<......0.............@..........................`.......................................................@....................... ..h...................................................................................CODE....\........................... ..`DATA....h...........................@...BSS......................................idata..............................@....edata..............................@..P.reloc..h.... ......................@..P.rsrc........@......................@..P.............`......................@..P................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\IssProc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	976786
Entropy (8bit):	6.1059114855282175
Encrypted:	false
SSDEEP:	24576:wdB0j3YegUqHoYe2M5xST/mPNg3PyQSeBU:wnm3UUHb2EW/mPNgo
MD5:	87E1A4947E7E93D1FAD095AB91B20D70
SHA1:	BB44EDD085EE2B521F9124FD2DD1B57D018CA5A0
SHA-256:	F7046341C5B96BF9E499DFD6433DF171B7D13C02EAC8AF10C0669B95ABD1BCE2
SHA-512:	BC0A220AFC257349396FDDD58AE8880D9073A6D34E979080018E0ECAA0062A026051237A022313A52FB0EB3E4EF9705B5A21079DC33092CE753E5A2BB6E4C963
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+j.M....=......#...8.........z................pk.......................................... ......................p..6.......h.......x.......................0....................................................................................text...4...........................`..`.data...............................@....rdata..\...........................@..@.bss.....x...............................edata..6....p......................@..@.idata..h...........................@....rsrc...x...........................@....reloc..0...........................@..B.............>.................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\LibDataAccess.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.404634465764856
Encrypted:	false
SSDEEP:	1536:S9RVUqAyonEZRNEFr6bpQlLRfk4Ti0uw8IGxlvByGhRhfD:S9RVUqAyHZgrf1eIGZyORhf
MD5:	F21007192D5DC743D37CFCF14904A01A
SHA1:	4B7BEECEB0F470EFE9FB21CED776D93AA6FFE5DF
SHA-256:	76029693021C9FACF117742158C1B2D686E4A44AA5795AAE0977CD0E1C248ED7
SHA-512:	237EA574E1F470F180CC05995334C063772B7414A2B8925E511BBCA4F7CC945692B02660761ED49CB388BD50DBF7EC4B7C40480D088F51F1CD46A7806D27B7C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r..!6c.r6c.r6c.r?..r c.r?..rXc.r...r4c.r?..r5c.r6c.rVc.r?..r.c.r?..r7c.r?..r7c.rRich6c.r........PE..L.....e...........!.....:...x...............P......................................~.....@.........................P...A.......<...............................,....Q...............................v..@............P..D............................text....9.......:.................. ..`.rdata...B...P...D...>..............@..@.data...$1..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\LocalDB.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	6.248995357251524
Encrypted:	false
SSDEEP:	768:XDU4HaoGoYTIPOW6ysjv0B1s4dby5M/FPTOc8s1qMbk62OKR8QBYWi:4eYTIPOW6ysbU1Pdby5MNSc8s1qMo62U
MD5:	3A5478A176DF86880D872740E96ADC57
SHA1:	CF8D23C0991A8260470C2989ECBA6AFF88CD64AE
SHA-256:	97F59D9AED4378019628AFA4F17FEEAFEBF5FD91D12866E7EE81730FFE9017CD
SHA-512:	66EB44D2A8E327433148741A1DB3F4603A14B28BFAA3389F28F03EF27B211BF2EC8FAB6BBDCD9D2A3ED2E5DA565A00B71012031741F08FB0096897ECCFBE39BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.q.!...!...!...(.%...... ...(. ...(.,...(.%....Ld.#......"...!...r...(.)...(. ...?.. ...(. ...Rich!...................PE..L.....e...........!.....T...B......]V.......p......................................qr....@.........................0...p......d.......D...........................@q..................................@............p..,............................text...ER.......T.................. ..`.rdata...-...p.......X..............@..@.data...............................@....rsrc...D...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\MP_Render.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	356352
Entropy (8bit):	6.754987401754759
Encrypted:	false
SSDEEP:	6144:aP+WEcVy+39YFTSVUGjvjOzR5D6oAzsRT89:a2gY+39eS1POV5D6voRo9
MD5:	AAA00C04821532C545E390C89970A2F9
SHA1:	94532D856B5EDB02A36D4083DDE3AC4D26D6C15E
SHA-256:	FEE1B82D0E13C08E0F70EF2DD6834D44EED0EB130F16D308616826933474A7C6
SHA-512:	B54DC80FAD8F0DDE262152A130DFE045E9B91A4DB93A3BA6D3E30D49F9B4B53028FB35C6F96F59508975129A495EAEE4673EFC0CDFB7E4F47A336323A2ED4195
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................q.d.......m.......{.!....#................\|.......j.......l.......i.....Rich....................PE..L.....Q[...........!................`...............................................wq..............................P8..\....-..x...............................t&..P...................................@............................................text............................... ..`.rdata...;.......<..................@..@.data...\|\|...@.......*..............@....rsrc................B..............@..@.reloc...'.......(...H..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\MP_VIE.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3408008
Entropy (8bit):	6.439717447308692
Encrypted:	false
SSDEEP:	49152:UWcOLf2zTASjTxgu4gufguTJ7hMDkfiY2Qeo49:UWcOLf2zT5rHzp9
MD5:	DAD876D137BD65D1D2F298E7B8F8C318
SHA1:	211EF46E6C5960BBB9C69E43766EB2C01C9DFF59
SHA-256:	B3F3E842D21EF89FB53A6D718AB2F5C7A24DFBA088B6D3389D6FB1F2BF9C06DA
SHA-512:	59F3842D6571053F534F68051D75EB9A3E8A681AE17886E23348838EA20F7B6D65987776D501A1E892600EC54DC62834267D51686CEE7A294FEF21C2B1E746FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R?<..^R..^R..^R..B\..^R.yAX..^R.yAV..^R..^S..^R.tAA..^R..AX.4^R..R..>^R.1./..^R..^R.=[R.B}c..^R..XT..^R..~V..^R.Rich.^R.........PE..L....:.Q...........!.....@2.........{........P2...............................3......v4..............................,3......3.<....P3.............H.3.@ ...`3.tk..`P2..............................................P2.L............................text....82......@2................. ..`.rdata.......P2......P2.............@..@.data...8....03.. ...03.............@....rsrc........P3......P3.............@..@.reloc..{...`3......`3.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\MapNetHDD.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95296
Entropy (8bit):	5.457397189343623
Encrypted:	false
SSDEEP:	1536:41pRi3A0lcFMbxAOomOYILwa7c7dA3hdej:kvi3A0lcFMbxAONOY/acpuK
MD5:	4406E8265B80FC6B36046B07F98067B4
SHA1:	BEBB9E97BCF0477FF8A867E4241E49F52A9583C4
SHA-256:	1E6F8DD640C43C37F91D40C44E9B382EA9CEF9801FDC0183CE53A9742CA2928A
SHA-512:	4DB3ACA14A2DDC6F152C065232BF44F87D8DB54D5B273318101947D68B6286FE63F3531D3207FB7760042FB0B34E11E49D10555EF617109403F0BB3C3E6E4EDF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..2..2..2S.D2..2..G2..2..Q2...2.c.2..2..A2..2..2(..2..V2..2..F2..2..C2..2Rich..2........................PE..L.....e.............................b............@.......................................@..........................................0...9...........T..@ ...p.. ...0...............................P...@...............4............................text...R........................... ..`.rdata...+.......,..................@..@.data...............................@....idata...*.......,..................@....rsrc....9...0...:..................@..@.reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\MsgCenterQt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	4.847392796872375
Encrypted:	false
SSDEEP:	768:tWqAV6qVqzI7+ZqsSWOFZLpvTR1UPJzOBDOKj2Cp:tWqvqSMYCbUPJADOKj2
MD5:	91DD086F09AC2A5B5BC6E033B7E113B0
SHA1:	AF83B085C6749ED35E85CECED49B273869FB2AEE
SHA-256:	D950BB05785D0FAA32602BF6997AEC788675658086378248A022E53245A29F99
SHA-512:	78DD858EE3733EF461FD382C19BD633729685D08A331AC867D4B654B493E579E39CADADD275FB591A3B91B1F1327E35C0B2769F6D15A36A43C47B2B560DBC2E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...[..[..[.Z.L..[..#O..[..#Y..[..#I..[......[..[..[..#^..[..#H..[...N..[..#K..[.Rich.[.................PE..L.....e...........!.........B......e........................................@............@.....................................d.... ..L....................0..T... ...................................@...........0................................text............................... ..`.rdata...!......."..................@..@.data...(...........................@....idata..{...........................@....rsrc...L.... ......................@..@.reloc..{....0......................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\NPQos.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1344512
Entropy (8bit):	6.7094779678629335
Encrypted:	false
SSDEEP:	24576:RuElCoqrkWPVF7/Ft4/QH7s1UbgksX9wrAto8c/lztqOJG:4vYcl/Ft6ObQuT/
MD5:	9A2F17DD74365C29E9FA1A9503FA750F
SHA1:	3492DACEF4E0C52DF6B72C00E27C6781F6C31C03
SHA-256:	A69E597D4B244EE7974ABBA67929975CAB0BC21F324D26F070826AAA733EDB6F
SHA-512:	0061DB34DCCF2A67B14F78E1F9730CFCD992EAE992E024D02866783A72C8B8DBB8A4F52B8771EBB74C4587DA035CCB061EE56C5EDEE74C4C84F88B69D65685A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?!..{@m.{@m.{@m.....z@m.r8..\@m.r8..@m.\...y@m.e..}Am.r8..~@m.{@l..@m.r8..@m.r8..z@m.e...z@m.r8..z@m.Rich{@m.................PE..L.....^...........!................LN...............................................@....@..........................%......D...P....`.......................p...h......................................@............................................text...>........................... ..`.rdata...L.......N..................@..@.data....,...0......................@....rsrc........`......................@..@.reloc..F....p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\NetworkApi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	6.229257200100164
Encrypted:	false
SSDEEP:	768:Y03RnwS+o2zYfvEatv2d32XCBbU43INGlOtROJ:j3FwS+DzYfvE043SCBv2GlOtROJ
MD5:	E4C7695A64D1ADA60AEB731B968ECBDC
SHA1:	3EEC7B6E344DA5D03FF0B92D07A1FF2BDB76BF07
SHA-256:	4C333EA0B74AD5E15BE89D7A488C0BAA31E4B94CE3DCD3D8B50C3940BFA84CB6
SHA-512:	BCADB9BEB363E0F47D243AE4C731DDC7F654619D9F3F8EBFC1FB27D9707F548FFBDFC8ABF5B9732D7746B4332CCA90D9F20EA3CA99F761A3FA2A19BB102280F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................(.".....!.....7.....0....\|......'...........>.....&.....%....Rich....................PE..L.....e...........!.....V...,......GX.......p............................................@.............................9.......d...................................Pq...............................u..@............p..8............................text...UU.......V.................. ..`.rdata..9....p.......Z..............@..@.data................v..............@....rsrc................x..............@..@.reloc..h............\|..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\NpfDetect.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	165408
Entropy (8bit):	6.618708055696421
Encrypted:	false
SSDEEP:	3072:FhZ8JWtHMQNzuEhIsYDz/49GGH8kAGpwRYhd0E:PZ8JWtHZqZz/49dvAah+E
MD5:	97C0B7E26CF526FB2111678CD0B97611
SHA1:	6D53A7F86B6B1608D3BA6E8A1C7CAED34734BF68
SHA-256:	E47FF026C3D569AA9855D2FA40F64E9A62B87065944C4469BE46F3576DF6444F
SHA-512:	25DFEFA70BBB4BF6D4A944ACA621E5EA77BF55022292F76C3EA375ED1D8C2A83E38CEF99D4AC442E9DD1821577BC0D1A14729F09BA5EE94761A091DEA2B88BD4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.4q..Z"..Z"..Z".a."..Z"S."..Z"S."Q.Z"S.".Z"L.I"..Z"..["N.Z".."..Z".."..Z".."..Z".."..Z"Rich..Z"........PE..L..._D.V...........!......... ...........................................................@.............................g...x...<....................H.. >......8.......8...............................@...............4............................text.............................. ..`.rdata..T...........................@..@.data...h\|...0......................@....rsrc................(..............@..@.reloc..8............,..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69960
Entropy (8bit):	6.805631727988293
Encrypted:	false
SSDEEP:	1536:IfjGURVk5nMuOPCR45JF5aTSpz7dT3hTFI3hZR:gikiR45JF5auVpdFqR
MD5:	191F9AAA1C9DC443D70096D556C046BB
SHA1:	D48C71395DD5891AA785DFECA90D0A9757E80CA7
SHA-256:	02B0F286FB92F289C0875CDBCA9942C3E7E53E91CE5C776919B622DC791F28D3
SHA-512:	3D07B493F37051D95894F59585E17B1C85ADD1F302F8715B82A74A0365661D7500E3AA3DDA5786CDF1A776BEC79CB532F9F61DD67A9A7FB8B3DF07D888850446
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................R......C......U..........................\.....B......G....Rich...........................PE..L......Y.................l...D....................@.................................C.....@....................................d.......................H]......\...`...............................p...@...............0............................text...$j.......l.................. ..`.rdata...............p..............@..@.data...............................@....rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\NpfOccupy.xml

Download File

Process:	C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.0830231514691375
Encrypted:	false
SSDEEP:	3:LZFGb+vNA/KXAXzovQ:fG6yKXU
MD5:	5356317350DE472E9A853C46CEBA4122
SHA1:	CCECA28386FB4745D7CDC40417B17B630C70F2D3
SHA-256:	D425AFBA0A48B94FDA128DF00675CA584A7BD814A8F1A1CE1803DEFE80691EFA
SHA-512:	7A30A11031FBDB35C685E518C1DE97BBDA90372CC90D1C731FB97C4DD0F9A2E65FECC0E999CB2006F595FFFD1D39F20A6DA9AD4B2C85C8455A74778B09991C33
Malicious:	false
Preview:	<NpfApp>.. <result>no process</result>..</NpfApp>..

C:\Program Files (x86)\Ezviz Studio\OpenAL32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	375808
Entropy (8bit):	7.079582943202465
Encrypted:	false
SSDEEP:	6144:iaVgHJEoFJdVBJUMhZW9stxtl91TfE3wxxmpcYK4vcXr1+OUbyc5/g1DnUq46t0r:7V5oFJdVBJUMhZ2I3l9pM3wx+cYK4vcQ
MD5:	F1AE1CEA6A77616C739AC021C38EB910
SHA1:	152B5379395C03270243610A293D1D7555BE725D
SHA-256:	6D1626E2C850B15A6A1F0CAC3CEEC9F24A20F6EE3A9C4199F9BF2E02CA5DD2C8
SHA-512:	B2118491B4B0FBB37103BFB2B76FDBE68BE969EF1FF9106012FFFB94EFDCE9B76EF2290313D6D563ED943472D3E9BABF85F7B8BD2B254293D2C8C6706384E79B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................k.......m.......\|.....b.n......3..........B.....{.......j.......l.......i.....Rich............................PE..L....1._...........!.....l...L......Qu....................................................@..........................}..!....p...................................-...................................o..@...............\|............................text....k.......l.................. ..`.rdata..1............p..............@..@.data................~..............@....rsrc...............................@..@.reloc..v3.......4..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\PlayCtrl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4629568
Entropy (8bit):	6.615107373053946
Encrypted:	false
SSDEEP:	98304:I2po51Ma7WrO9XHqYnLW6jDwroQvwvrx+zU0zHxqATxj2:IQCXfJ6oQojx+zzzHja
MD5:	F08E03127DCD470C45DE029574C1C630
SHA1:	8774EBB14ADBF284BF4A839A7EB405D0BB0E7069
SHA-256:	821326BFDF4A0A1B1B298425DF59CEA5E62FA898EBE4BAA1FE424535F11CD70F
SHA-512:	108ED88915EFAC2D88885F2DE9A6B458BAA1643B5B29F9BC829CD9DDDC594B83403E653068F2283F3708F521C99F9F3DA774702B6C31108ABEB6337195DDB6AB
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......N=...\.U.\.U.\.U..;U.\.U..8U.\.U.$;U8\.U..OU.\.U-..U.\.Ul.`U%\.U.$'U.\.U.C.U.\.U.$-U.\.U..=U.\.U.\.U.\.U^..U.\.U.\.U.\.U..-U.\.U..US\.U.$Uj\.U.$<U.\.U..:U.\.U.$?U.\.URich.\.U........PE..L...S."c.........."!......8...........2.......8..............................@N.......F...............................B..J....B.......L...............F.@ ....M..)....8...............................................8.p............................text.....8.......8................. ..`.rodata.p.....8.......8............. ..`.rdata...U....8..V....8.............@..@.data........@C.......C.............@....data1........L......2E.............@..._RDATA..@.....L......>E.............@..@.rsrc.........L......DE.............@..@.reloc..Z9....M..:...JE.............@..B........................................................................................................................

C:\Program Files (x86)\Ezviz Studio\QtCore4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2554880
Entropy (8bit):	6.591414672760471
Encrypted:	false
SSDEEP:	49152:XL2lv4yEptIJxK5IFJsv6tWKFdu9C1TzLyvL/6mShMZtmjNUVrciV5P+7QVg07s1:72lcXIrU6Jsv6tWKFdu9C
MD5:	9945C8F8EB3DF171E1B576A9009D5117
SHA1:	FC07A2A6FD15989D71E2C4B5FF0377C2EB34CA21
SHA-256:	366BE6E5BAD7CAA4989D5339DBF68CEC42CF5A5EDF8573AAE85EF37222CC7C0B
SHA-512:	6DAAFF96046C80B197A3E0B5AD879015949C720F114B5D42B0DC7DB482873919294540DFE0B3B1D9E65B984BFFDCC77969904A6835CA8EF77539C58C6ED1310D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#...#...#..el...#...q...#...q...#.......#......#...#..."...q...#...q...#...q...#...q...#...q...#..Rich.#..........................PE..L......R...........!.................f.............g..............U..........@'.......'...@..........................U!.Pv...9!.......&...................... &.8...................................(j..@...............\............................text...n........................... ..`.rdata..P...........................@..@.data...`2....%..,....%.............@....rsrc.........&.......%.............@..@.reloc....... &.......%.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\QtGui4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8358912
Entropy (8bit):	6.729195080956289
Encrypted:	false
SSDEEP:	98304:VxwW0Zvw2/EUpSf9DSGpL5550w8chBhZug63GS+L+z2/zSA:VxoZvwBfdL5sKtcP
MD5:	4A87B028A26BDFA8BC5B8678EC777A8A
SHA1:	F5CC12C71D82E399C21C37DFE9730A04BF4415C2
SHA-256:	A65F7351FF0B008DA6F4D69304CEDE6FDC7505FE582267E6EE0E5D7DB91636FD
SHA-512:	61061DB5D6AB92D0AED50271755E7FF553CFA123FEEA540A1FFE025DE41AA08CE65312EBB4A4B026F2A459C9CCA659CE7B072AF0276E765F5AF62B654DFBF1AA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C...C...C.....(.B...].+.J...d[.F...].-.E...d[.T...C......].=.]...].:.....].,.B...].*.B...]./.B...RichC...........PE..L......R...........!......W..r(.......Q......0W....e..............U.................3t....@.........................p.j.'a.. ii.,.....x.......................x.t....OW..............................vb.@............0W..............................text.....W.......W................. ..`.rdata.... ..0W... ...W.............@..@.data.........x.......w.............@....rsrc.........x......zx.............@..@.reloc..$.....x.......x.............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\QtNetwork4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1025024
Entropy (8bit):	6.51461365339135
Encrypted:	false
SSDEEP:	24576:bFZSxRN3kJai0rl0zMDNfQ3zLZwyXYbAyY:bFZSxRS8KISDOzEyY
MD5:	62C8DD03AAE60CDB0D93909C0E336AEA
SHA1:	C50BF8BE7AAC3682E0512319B357C6D232CCAE41
SHA-256:	21D25C89A64666A11E94C4737B14595511684D75F7F14E71A05C84D8EC822647
SHA-512:	9EC75C662D25BAC8DECCDD6C3E83C8561A2B22B59AB8EC1C77E86A93094E92A42C69E2CD374F4DA5374AFF30CDBFCAE2B170882E1E161A7F32D93F792582CBE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G..<G...G..9G...G..:G...G..,G...G..+G...G..<G...G...G...G.E.G...G..+G.G..=G...G..;G...G..>G...GRich...G........PE..L...A..Q...........!.....2...n......E........P.....d..............U.................L1....@.........................P[..........d....................................................................\|..@............P...............................text....0.......2.................. ..`.rdata..H+...P...,...6..............@..@.data...L=...........b..............@....rsrc................z..............@..@.reloc..4".......$..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\QtOpenGL4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	764928
Entropy (8bit):	6.669106147235707
Encrypted:	false
SSDEEP:	12288:ggGeJLBm1hmvXaCckVzTe9XXYCS9RT1wACAOv8e4rWkbig:g0BGmvXaCckxMHlS9RT1wACAOE
MD5:	A8591BC0151D4C57D0746CE4DD6432EF
SHA1:	214E155C65554935B655B655B4A07CAD15EAEACA
SHA-256:	D7F4D4C110D7BB4EA731873D81B092E3EF3BDA6A72C3D8FBC532E4998E0A92DC
SHA-512:	EE6385CDD3E5245F198CD59EE08AF6ED30F7B89A559DADD11C8D5EA8CD0057E5D07AFCB90BCBDDED649ADB292D8B91A0CBCB3F5E275AF458E63B48D172B47DE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9}P.}.>.}.>.}.>.cN....>..S..\|.>.cN..u.>.cN..s.>.cN..{.>.td..y.>.Z.E.t.>.}.?...>.td..b.>.td..\|.>.td..\|.>.td..\|.>.Rich}.>.................PE..L......Q...........!.....0...x...............@.....c..............U.......................@.........................p)..............@.......................P...e......................................@............@...............................text............0.................. ..`.rdata..N....@.......4..............@..@.data....I.......B..................@....rsrc........@.......$..............@..@.reloc..$....P.......*..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\QtPlugInManager.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	5.084125091817236
Encrypted:	false
SSDEEP:	768:ZOyY7dTQzsCuV/ILSmY8lhcELGL3/hglgz23OKRuQNv:01VwsCuG+sUEaL3/+OKRuQNv
MD5:	475E16473CCE539A5908466F7C58F5C2
SHA1:	62F329D4F7052DF0C7094C33BEB0F89D5657F951
SHA-256:	3C34717314E1EB298C6B7C5596F9C4BC43E74A07685085E2D004B6E1A35A5A20
SHA-512:	7DFE8A7778EC69E17EE6DB56790F35B33AC206AE844D3700F3634F2AEE265A2FABC889EAB86C58845EFA9BCC929C80498930F824B0ED485AE5BB1D64D97570EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q.;.0ih.0ih.0ih]..h.0ih.H.h.0ih.H.h.0ih...h.0ih.H.h.0ih.0hh.0ih.H.h.0ih.H.h.0ih.b.h.0ih.H.h.0ihRich.0ih........................PE..L.....e...........!.........V...............................................p......&.....@......................... ........0.......P..L....................`..@... ...................................@............4..h............................text............................... ..`.rdata...).......*..................@..@.data...(.... ......................@....idata..a....0......................@....rsrc...L....P.......&..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\QtSvg4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	277504
Entropy (8bit):	6.517810468792593
Encrypted:	false
SSDEEP:	6144:BCUI3+gAJiyKNU633Gmkm8nPyQ6Pejv0itXt70Gy4cY2mqOyCNcK1Dv45:XI3+gA4yKK633Gm/ePyQ6Wjvf
MD5:	B52AA20EFEA636D0834820A06D89324D
SHA1:	38095988EAFF2A1CFA2EB2428F70A2270D66EF31
SHA-256:	FF3608B203F1A104720060A071B5EA18922754C927C262787C84795256BFDBCB
SHA-512:	B9FEEC9264A3DA8C1CC99E8F9B1BFFE0352425B2B434974E44957E6BA3DAD71FBA863CAFB96B92EE9A03149D9F6A8FB6C61F34B90A048E78BAD76CB829E682AE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................@..................................\|..............................Rich...................PE..L...L..Q...........!.........z.......~.............f..............U..........p......w.....@.........................p...."..\|a..d............................ ...;..................................@...@............................................text...k........................... ..`.rdata...#.......$..................@..@.data...X...........................@....rsrc...............................@..@.reloc...E... ...F..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\QtWebKit4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12747264
Entropy (8bit):	6.6817162366350065
Encrypted:	false
SSDEEP:	98304:PxRSeXoBhwRkPyEeqMbLH09KOJu1tzFaUFlNNN7wIgQB:ZRVXoBuQGbDqu/J/tgQ
MD5:	AB3C99F71055A79EEBABB4B0405B57FA
SHA1:	965C3D40E7AD3AA7C8AC24680839D27EF16EC832
SHA-256:	C8D18BFEB07A9D388F717F7C8D6CFAB6EA27BC5382B0166E1004445137103E56
SHA-512:	1D0FF85F29EE07A950789D50913ABB6583B44DE357586618C3CCAE7822E59D2B9F27B5D6A7188947865CD26EDC4A86AD42F8173E76BAEFC15B7EDDAA21D640B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eg..!.@B!.@B!.@B.I.B#.@B?T.B/.@B?T.B..@B?T.B%.@B?T.B).@B(~.B'.@B..;B..@B!.AB9.@B(~.B .@B(~.B..@B(~.B .@B(~.B .@B(~.B .@BRich!.@B........PE..L.../..Q...........!..........<....../}...........................^.................J1....@......................... ............... .......................0......................................(...@...............d............................text...]........................... ..`.rdata....-.......-.................@..@.data....j.......(..................@....unwanted...........................@..@.rsrc........ .....................@..@.reloc.......0.....................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\QtXml4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	340992
Entropy (8bit):	6.4314715652629175
Encrypted:	false
SSDEEP:	6144:Y2o+3SlfoWPbMIoV50sWTwlZ2ysNOmmNSu7:i+3SlfoWPYIoP0s2Vu7
MD5:	F1B2CE3DCAEAB0267543035BFFD10851
SHA1:	D8BF3346E4399FAAF5C1884C7FA349972B1FCDFD
SHA-256:	03BDFF0CA987FAE960EB15543902776DC3CAA69E4315CC8903367F5D6F2F2BDE
SHA-512:	88F3FCBD537CB4D262F94C0AF1B5E46A8632C03332815DC8A8D0DA73E19FBE69F5540990BE9E24799980B9786DDBAC4D72F54ADDBB98BB269A4D7FD2811D38B2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7w..s.o.s.o.s.o.T...q.o..Y..r.o.mD..q.o.mD..~.o.mD..t.o.s.n.h.o.mD..{.o.mD..r.o.mD..r.o.mD..r.o.Richs.o.........................PE..L......R...........!.....J...................`.....a..............U..........p.......1....@..........................B......t...d................................L...d..................................@............`..\|............................text...tI.......J.................. ..`.rdata.......`.......N..............@..@.data...L...........................@....rsrc...............................@..@.reloc...W.......X..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\RemConfig\AMRemConfig.xml

Download File

Process:	C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.051621676372326
Encrypted:	false
SSDEEP:	3:vFWWMNCmXyKgCrkvsxI61WDH7CQEHovFZtcWsrDEQJWzu6961y:TM3iWkUxV27CVovFbcWsrDEcWoy
MD5:	ECEFA2A71A32D97599C17CFDC83E98BF
SHA1:	FD2B1B7BC15D7F584B317099EEC2FB6EEF32A9C4
SHA-256:	FFEFD67A0E6787F7644ED6E76C44B136AC9B381A0E89FE4A30B68F33B721F967
SHA-512:	5D065020B642948C8B5924E87C51214931D0CF91E108BA81F8D37A4EB2DDE142E13884B68323E1DA5CFDE17CC18A2CF239D7143F76E44A4BCE5EDF0E8BDF2432
Malicious:	false
Preview:	<?xml version='1.0' encoding='utf-8'?>..<AB_Rem_Configure>.. <Language>English</Language>.. <DefaultFilePath>./</DefaultFilePath>..</AB_Rem_Configure>..

C:\Program Files (x86)\Ezviz Studio\RemConfig\DemoTreeView.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.169668058621757
Encrypted:	false
SSDEEP:	6:TM3iWkQIhj6re4wGLQms6ctAWDWms6ctAWD+D6ctAg:TM3irQIx6rScFWPDWm7WPD/WN
MD5:	BBA9593D17599449CBA774B7A3BEBA6A
SHA1:	A23049BECC27A48F350047D5D6754A6BDD1ABBB6
SHA-256:	2E76B5CE03C35F29D6407D85DEF23DDDA8133738CEDA9E918C434BC5CB948294
SHA-512:	65B9F3B2FB2258A98BE9C8F50BC024A3A1900A5FFF965A10E888BD542BFE4D0B127E563C017F006F6468D1B153C0A28A03444B43DAB3FE759F010F672AB80A2D
Malicious:	false
Preview:	<?xml version='1.0' encoding='utf-8'?>..<DemoDeviceList>...<Device>.......</Device>...<Device IP="172.8.20.139" admin="12345" passWord="12345"/>...<Device IP="172.9.204.14" admin="12345" passWord="12345"/>...<Device IP="172.9.204.90" admin="12345" passWord="12345"/>..</DemoDeviceList>

C:\Program Files (x86)\Ezviz Studio\RemConfig\LocalXml.zip (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1313724
Entropy (8bit):	7.97888331073617
Encrypted:	false
SSDEEP:	24576:/XgUF+N5wC+cAXNmaXsFpC2oDauf1ThP99WL6wDQlKItxGJe5szLc9E2dC:vg6uocImaXsi11Tt9906yQwItAKszLci
MD5:	D29177A3341ADE2BB1E3ECF8BDCF48A0
SHA1:	FFA97A58AE8445CB25D958DC91CAB5AEAA768BE0
SHA-256:	2B6B0CD5D8E1EE7FAF7F1E5C1454D84F1D972D93EFCAD551846AABCDBE963DAE
SHA-512:	2E2B42FDD2467BDC01C48FFCF05DEFC7BB452DA717C6622F555617258BFA30B8B7C3C3A33C1B59A3260AE1795D886A2B72C8349A1A7570B870355134E04A9869
Malicious:	false
Preview:	PK........J\RC@.`.B....7......80_ST_V22.xml.[ms.6......?f.B.%.A.%;.e...k...a.c....-...^I...'.k.k:..}v...`./d..M.y.,'4}w...=..tIc......\.99.ux..x.H..tA.....(0<x..PN.#.........'.pe$....%.Q........$.Q...0.@P...[..A.Rv...Q...\|6..I..g............eu;?..G..'.^$(_..xx.API.%.(!.^Y..gL......WV...S).@`....$Z.=...1...DG...1q.X..d...bU...).......=..".....i.p.]#O.R...h...'e..2...D....v....0..A..x:........y.u$.....{.....<pN.y[LM.....c35..(w.s$.5m8QJ...5}.s&.De..t[(..<../..C..N..{rI.F..T...!u..f....cWC...y...gTd..Y..\r........:...WsG......9..n......{}5.9..b./s..{..vv.wE.'..\|..xrea..\|..=......P.p.%X.....nW.....y.S...D...M...d..e.................p'..(.....$.g..8u....n..1>.-.N....H.%]>8.uH..p.8.$..6...y..^:".uJ.Z..~$..q..A................/..>.N..I.+F.lD.{..V>.l.V..pE...=......Hc...?.%e.4j`:g`....Ju.D.ldSue...1.....8{.t%.9..6.h.%O+,.6Aml.W2.T.M.....y...[.]...U.S..J=..I...5..Sq.....N..S..F2M.V5D..1,m\.t.2...\|2.\|6q].n.f..MU.......).b.,ZP5w.?y h.*@P.KL...~kD7

C:\Program Files (x86)\Ezviz Studio\RemConfig\ScheduleTemplate.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93409
Entropy (8bit):	4.8337440220441446
Encrypted:	false
SSDEEP:	1536:Hs1yDA5GUrByz8F21W8huSVMPmFHENq74Od8z8zyBj+PMwz2pDMRCfYShvBILil8:Hs1yDA5GUrByz8F21W8huSVMPmFHENqp
MD5:	FC8DA8D0EF62A6F4D6C7B47BA0B517B7
SHA1:	D7B8C313CE09CC5964792EFD1D7F02158A086877
SHA-256:	47BC58E8213A8B35573254AF74B3A5BA57214C0D788D071375A99AEC1F2BDD7A
SHA-512:	E35D87A6DF4C0F21226EC4D380284BAB37984B2ACBE4632E727B71D04C297774BFB2DD98B5B9A98DA8049226E72E890DFABB96DE3571A0EF25587D5129E5F579
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<ScheduleTemplate>.. <Template>.. <RecordScheduleTemplate>.. <No>1</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>2</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>3</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>4</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>5</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>6</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>7</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>8</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>9</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>10</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>11</No>.. <Name/>.. </RecordScheduleTemplate>..

C:\Program Files (x86)\Ezviz Studio\RemConfig\SerialSDK.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323672
Entropy (8bit):	5.7718472021219815
Encrypted:	false
SSDEEP:	3072:QtrqyHWWB0lRsimU8z9JyRJ13q1ZkGmxPUGXpJ4sa2OlbxfAmTfZwgkRFMpse5g:QtFXBOsimnhc3q1mGq5JpvOffAmjvkqg
MD5:	1E2AE4A963C85B291C8AD9125AC2CBA9
SHA1:	AAD37EE2751FD0E65B64D3334C43CDA568AB85C0
SHA-256:	E8CD5CB44BFCB277DEDC7B6A04497097F6A7E75030024396FA267251B0B008BE
SHA-512:	4089A856E4A25EA4569EA43F2496650D3B41C341B53F2F9739B12B51B6B7F3EDADFDB22865DA60B628E0C35527462BF4FEA249292283CFECB2C6EFDE61DB1EC9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\{..=.J.=.J.=.J.!.J.=.J.!.J.=.Jn".J.=.J.".J.=.JE2HJ.=.J.=.J3=.Jn".J.=.J>;.J.=.Jn".J.=.JRich.=.J................PE..L....[.U...........!.........P...............................................0...................................................................................(..................................................,................................text...r........................... ..`.rdata...:.......@..................@..@.data........ ...`... ..............@....idata........... ..................@....rsrc...............................@..@.reloc...;.......@..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\RemConfig\ShowRemConfig.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23756288
Entropy (8bit):	6.602450556939898
Encrypted:	false
SSDEEP:	196608:A3LjCMBP0E9HtSrad30nsRylT4UnagSL8D1PVnYV9gQ5UyCi1pw:AC8P3vRyeN8RYDv5UyCi1pw
MD5:	F35216EEB321CABA14E78071959CED21
SHA1:	25138D961F7240338467AE572C059747F2969BF8
SHA-256:	C17EF49C3C1E04C4A704B02776E62BDBE3B25AAEFC7AAAD7CDC147022CC76269
SHA-512:	B4D94CD433EBF0B7D93F80B7D88EFB38B852EC2359362C2D3A6C478319DCAD801136EB6C17CD1355294CE8DCB31A13B6987A352FF7A8231EE8642FD0A1766153
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L. .-.s.-.s.-.sQbzs.-.s.Uys.-.s..s.-.s..s.-.s...s.-.s.Uos.-.s.2.s.-.s...s.-.s.U.s.-.s.-.s. .s.Uhs...s.U~s.-.s..xs.-.s.U}s.-.sRich.-.s................PE..L...e..U...........!......................................................... k......]k...@.........................0.Z.U....zX.@.....\.......................\.X...................................p.G.@...............P4...........................text............................... ..`.rdata...O.......P..................@..@.data.........Z..b....Z.............@....rsrc.........\......:\.............@..@.reloc...=....\..>...@\.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\RemConfig\TreeView.XML (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43453
Entropy (8bit):	4.437692379341381
Encrypted:	false
SSDEEP:	192:Pcv7av6bRvwXEPvOPrOvS3veavrNXETvIvCvDtdtvZvPt6l5:PcGmRYX8LK3GaTNETQaZBEX
MD5:	5847F745953181CA4631A3D075CAAEA2
SHA1:	6EB0B74F33745FCE7EAF1CD2038EF6723C1C8F2D
SHA-256:	4D5CAED9B1DD551E6D6050BC5EA28F630DCB5E489A887A3FE6F9F3ECFEBC8E69
SHA-512:	E6BE20FC2E1BA1423DBE55D873CF81E371D943D40ACA111213D3A413AAF4A1947CDAE5E0CA21A2182F65136773D1F5AB6A36D87C25C51642515CE1F982C8D862
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<TreeViewDisplay>.. <DeviceDisPlayLists>.. <Level1Node>.. <ID>0</ID>.. <DisplayName>System</DisplayName>.. <Visible>1</Visible>.. level2 *DeviceInfo-->.. <Level2Node>.. <ID>0</ID>.. <DisplayName>DeviceInfo</DisplayName>.. <Visible>1</Visible>.. </Level2Node>.. level2 Genernal-->.. <Level2Node>.. <ID>1</ID>.. <DisplayName>General</DisplayName>.. <Visible>1</Visible>.. </Level2Node>.. level2 Time-->.. <Level2Node>.. <ID>2</ID>.. <DisplayName>Time</DisplayName>.. <Visible>1</Visible>.. </Level2Node>.. level2 system maintenance-->.. <Level2Node>.. <ID>3</ID>.. <DisplayName>Maintenance</DisplayName>.. <Visible>1</Visible>.. </Level2Node>.. level2 **RS232-->.. <Level2Node>.. <ID>4</ID>.. <DisplayName>RS232</DisplayName>.. <Visible

C:\Program Files (x86)\Ezviz Studio\RemConfig\is-1P4BG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93409
Entropy (8bit):	4.8337440220441446
Encrypted:	false
SSDEEP:	1536:Hs1yDA5GUrByz8F21W8huSVMPmFHENq74Od8z8zyBj+PMwz2pDMRCfYShvBILil8:Hs1yDA5GUrByz8F21W8huSVMPmFHENqp
MD5:	FC8DA8D0EF62A6F4D6C7B47BA0B517B7
SHA1:	D7B8C313CE09CC5964792EFD1D7F02158A086877
SHA-256:	47BC58E8213A8B35573254AF74B3A5BA57214C0D788D071375A99AEC1F2BDD7A
SHA-512:	E35D87A6DF4C0F21226EC4D380284BAB37984B2ACBE4632E727B71D04C297774BFB2DD98B5B9A98DA8049226E72E890DFABB96DE3571A0EF25587D5129E5F579
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<ScheduleTemplate>.. <Template>.. <RecordScheduleTemplate>.. <No>1</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>2</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>3</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>4</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>5</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>6</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>7</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>8</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>9</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>10</No>.. <Name/>.. </RecordScheduleTemplate>.. <RecordScheduleTemplate>.. <No>11</No>.. <Name/>.. </RecordScheduleTemplate>..

C:\Program Files (x86)\Ezviz Studio\RemConfig\is-5G1G7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	892928
Entropy (8bit):	6.631036842323821
Encrypted:	false
SSDEEP:	24576:XZmVBgC9XzrG3/DlpD5ol/kOski73nE65xWF5rDRlSYth:EzSARP
MD5:	AF3DC7EF6A79617A594AD78D137803BD
SHA1:	9AF165812FCCD1ABE231C1394D8835FF256DAA6F
SHA-256:	0CB34841194F94B7C9AF64FA66CB4621262966126C9AB41AE8618762C8FD41C4
SHA-512:	7292385B1A31114FDBA7280BC8E88EC8D55B276DD253F607C7DF376F54F49B8C39931E6C4F0EBCA9F3C265EF8141B092332EE2418027A2ACA489A6A93A48ECC3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^$B..E,..E,..E,.=.W..E,.....E,..=...E,..=...E,..=...E,..E-..A,..=..E,..=...E,..=...E,.Rich.E,.........PE..L.....R...........!.....J...R..............`.......................................F....@..........................]..r.................................... .......p..................................@............`..h............................text....I.......J.................. ..`.rdata..B....`.......N..............@..@.data...t...........................@....rsrc...............................@..@.reloc..b.... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\RemConfig\is-9MGNB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323672
Entropy (8bit):	5.7718472021219815
Encrypted:	false
SSDEEP:	3072:QtrqyHWWB0lRsimU8z9JyRJ13q1ZkGmxPUGXpJ4sa2OlbxfAmTfZwgkRFMpse5g:QtFXBOsimnhc3q1mGq5JpvOffAmjvkqg
MD5:	1E2AE4A963C85B291C8AD9125AC2CBA9
SHA1:	AAD37EE2751FD0E65B64D3334C43CDA568AB85C0
SHA-256:	E8CD5CB44BFCB277DEDC7B6A04497097F6A7E75030024396FA267251B0B008BE
SHA-512:	4089A856E4A25EA4569EA43F2496650D3B41C341B53F2F9739B12B51B6B7F3EDADFDB22865DA60B628E0C35527462BF4FEA249292283CFECB2C6EFDE61DB1EC9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\{..=.J.=.J.=.J.!.J.=.J.!.J.=.Jn".J.=.J.".J.=.JE2HJ.=.J.=.J3=.Jn".J.=.J>;.J.=.Jn".J.=.JRich.=.J................PE..L....[.U...........!.........P...............................................0...................................................................................(..................................................,................................text...r........................... ..`.rdata...:.......@..................@..@.data........ ...`... ..............@....idata........... ..................@....rsrc...............................@..@.reloc...;.......@..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\RemConfig\is-BUDS6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23756288
Entropy (8bit):	6.602450556939898
Encrypted:	false
SSDEEP:	196608:A3LjCMBP0E9HtSrad30nsRylT4UnagSL8D1PVnYV9gQ5UyCi1pw:AC8P3vRyeN8RYDv5UyCi1pw
MD5:	F35216EEB321CABA14E78071959CED21
SHA1:	25138D961F7240338467AE572C059747F2969BF8
SHA-256:	C17EF49C3C1E04C4A704B02776E62BDBE3B25AAEFC7AAAD7CDC147022CC76269
SHA-512:	B4D94CD433EBF0B7D93F80B7D88EFB38B852EC2359362C2D3A6C478319DCAD801136EB6C17CD1355294CE8DCB31A13B6987A352FF7A8231EE8642FD0A1766153
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L. .-.s.-.s.-.sQbzs.-.s.Uys.-.s..s.-.s..s.-.s...s.-.s.Uos.-.s.2.s.-.s...s.-.s.U.s.-.s.-.s. .s.Uhs...s.U~s.-.s..xs.-.s.U}s.-.sRich.-.s................PE..L...e..U...........!......................................................... k......]k...@.........................0.Z.U....zX.@.....\.......................\.X...................................p.G.@...............P4...........................text............................... ..`.rdata...O.......P..................@..@.data.........Z..b....Z.............@....rsrc.........\......:\.............@..@.reloc...=....\..>...@\.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\RemConfig\is-J8HI4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43453
Entropy (8bit):	4.437692379341381
Encrypted:	false
SSDEEP:	192:Pcv7av6bRvwXEPvOPrOvS3veavrNXETvIvCvDtdtvZvPt6l5:PcGmRYX8LK3GaTNETQaZBEX
MD5:	5847F745953181CA4631A3D075CAAEA2
SHA1:	6EB0B74F33745FCE7EAF1CD2038EF6723C1C8F2D
SHA-256:	4D5CAED9B1DD551E6D6050BC5EA28F630DCB5E489A887A3FE6F9F3ECFEBC8E69
SHA-512:	E6BE20FC2E1BA1423DBE55D873CF81E371D943D40ACA111213D3A413AAF4A1947CDAE5E0CA21A2182F65136773D1F5AB6A36D87C25C51642515CE1F982C8D862
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<TreeViewDisplay>.. <DeviceDisPlayLists>.. <Level1Node>.. <ID>0</ID>.. <DisplayName>System</DisplayName>.. <Visible>1</Visible>.. level2 *DeviceInfo-->.. <Level2Node>.. <ID>0</ID>.. <DisplayName>DeviceInfo</DisplayName>.. <Visible>1</Visible>.. </Level2Node>.. level2 Genernal-->.. <Level2Node>.. <ID>1</ID>.. <DisplayName>General</DisplayName>.. <Visible>1</Visible>.. </Level2Node>.. level2 Time-->.. <Level2Node>.. <ID>2</ID>.. <DisplayName>Time</DisplayName>.. <Visible>1</Visible>.. </Level2Node>.. level2 system maintenance-->.. <Level2Node>.. <ID>3</ID>.. <DisplayName>Maintenance</DisplayName>.. <Visible>1</Visible>.. </Level2Node>.. level2 **RS232-->.. <Level2Node>.. <ID>4</ID>.. <DisplayName>RS232</DisplayName>.. <Visible

C:\Program Files (x86)\Ezviz Studio\RemConfig\is-JU1I7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.051621676372326
Encrypted:	false
SSDEEP:	3:vFWWMNCmXyKgCrkvsxI61WDH7CQEHovFZtcWsrDEQJWzu6961y:TM3iWkUxV27CVovFbcWsrDEcWoy
MD5:	ECEFA2A71A32D97599C17CFDC83E98BF
SHA1:	FD2B1B7BC15D7F584B317099EEC2FB6EEF32A9C4
SHA-256:	FFEFD67A0E6787F7644ED6E76C44B136AC9B381A0E89FE4A30B68F33B721F967
SHA-512:	5D065020B642948C8B5924E87C51214931D0CF91E108BA81F8D37A4EB2DDE142E13884B68323E1DA5CFDE17CC18A2CF239D7143F76E44A4BCE5EDF0E8BDF2432
Malicious:	false
Preview:	<?xml version='1.0' encoding='utf-8'?>..<AB_Rem_Configure>.. <Language>English</Language>.. <DefaultFilePath>./</DefaultFilePath>..</AB_Rem_Configure>..

C:\Program Files (x86)\Ezviz Studio\RemConfig\is-LHUUG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1313724
Entropy (8bit):	7.97888331073617
Encrypted:	false
SSDEEP:	24576:/XgUF+N5wC+cAXNmaXsFpC2oDauf1ThP99WL6wDQlKItxGJe5szLc9E2dC:vg6uocImaXsi11Tt9906yQwItAKszLci
MD5:	D29177A3341ADE2BB1E3ECF8BDCF48A0
SHA1:	FFA97A58AE8445CB25D958DC91CAB5AEAA768BE0
SHA-256:	2B6B0CD5D8E1EE7FAF7F1E5C1454D84F1D972D93EFCAD551846AABCDBE963DAE
SHA-512:	2E2B42FDD2467BDC01C48FFCF05DEFC7BB452DA717C6622F555617258BFA30B8B7C3C3A33C1B59A3260AE1795D886A2B72C8349A1A7570B870355134E04A9869
Malicious:	false
Preview:	PK........J\RC@.`.B....7......80_ST_V22.xml.[ms.6......?f.B.%.A.%;.e...k...a.c....-...^I...'.k.k:..}v...`./d..M.y.,'4}w...=..tIc......\.99.ux..x.H..tA.....(0<x..PN.#.........'.pe$....%.Q........$.Q...0.@P...[..A.Rv...Q...\|6..I..g............eu;?..G..'.^$(_..xx.API.%.(!.^Y..gL......WV...S).@`....$Z.=...1...DG...1q.X..d...bU...).......=..".....i.p.]#O.R...h...'e..2...D....v....0..A..x:........y.u$.....{.....<pN.y[LM.....c35..(w.s$.5m8QJ...5}.s&.De..t[(..<../..C..N..{rI.F..T...!u..f....cWC...y...gTd..Y..\r........:...WsG......9..n......{}5.9..b./s..{..vv.wE.'..\|..xrea..\|..=......P.p.%X.....nW.....y.S...D...M...d..e.................p'..(.....$.g..8u....n..1>.-.N....H.%]>8.uH..p.8.$..6...y..^:".uJ.Z..~$..q..A................/..>.N..I.+F.lD.{..V>.l.V..pE...=......Hc...?.%e.4j`:g`....Ju.D.ldSue...1.....8{.t%.9..6.h.%O+,.6Aml.W2.T.M.....y...[.]...U.S..J=..I...5..Sq.....N..S..F2M.V5D..1,m\.t.2...\|2.\|6q].n.f..MU.......).b.,ZP5w.?y h.*@P.KL...~kD7

C:\Program Files (x86)\Ezviz Studio\RemConfig\is-VF347.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.169668058621757
Encrypted:	false
SSDEEP:	6:TM3iWkQIhj6re4wGLQms6ctAWDWms6ctAWD+D6ctAg:TM3irQIx6rScFWPDWm7WPD/WN
MD5:	BBA9593D17599449CBA774B7A3BEBA6A
SHA1:	A23049BECC27A48F350047D5D6754A6BDD1ABBB6
SHA-256:	2E76B5CE03C35F29D6407D85DEF23DDDA8133738CEDA9E918C434BC5CB948294
SHA-512:	65B9F3B2FB2258A98BE9C8F50BC024A3A1900A5FFF965A10E888BD542BFE4D0B127E563C017F006F6468D1B153C0A28A03444B43DAB3FE759F010F672AB80A2D
Malicious:	false
Preview:	<?xml version='1.0' encoding='utf-8'?>..<DemoDeviceList>...<Device>.......</Device>...<Device IP="172.8.20.139" admin="12345" passWord="12345"/>...<Device IP="172.9.204.14" admin="12345" passWord="12345"/>...<Device IP="172.9.204.90" admin="12345" passWord="12345"/>..</DemoDeviceList>

C:\Program Files (x86)\Ezviz Studio\RemConfig\is-VKSQL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	5.8489695835244095
Encrypted:	false
SSDEEP:	768:bw6vENCUvhLcSCE/StC0KuFLRO5ZikoHBc1m7s4wixE+XwVY/nToIf18IOsIOIiy:bDvENBhA+WjPLAVY/nToIfCIOsIOIip
MD5:	72E87AD407BB28F5B471C3396296B377
SHA1:	15CD01170FF8D8531FB16F4F7A1C5FBE810A1057
SHA-256:	91EC6085E862E1EEDC254BF88EFECD4FA67F486216AB3B1473915D15462E71BB
SHA-512:	1569939514C0E30E2FBF7D81586ADA53931AC36B11F306B95B5E0741C6B32C45D88D33271223C99CD4FBD585F0675D5188557E5DFE6901F9FBB2E3E8EC98A698
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2.@.2.@.2.@.:.@.2.@.:.@.2.@.2.@.2.@.:.@.2.@.>.@.2.@.>.@.2.@`9.@.2.@.>.@.2.@Rich.2.@........................PE..L......L...........!................3.............LZ.........................0..................................................<............................ ......`...................................................H............................text............................... ..`.rdata...H.......P..................@..@.data...P...........................@....rsrc...............................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\RemConfig\qss\ABRemConfig.qss (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1854
Entropy (8bit):	5.846731272449076
Encrypted:	false
SSDEEP:	48:Q1u5dAgNPmdy6hgw9awxZRdzePXI1zwYA:AadLPmvePiwYA
MD5:	0BE4FC839C251E13D552C660F40927FD
SHA1:	B0FC9CB53E6F86F5BF31D71DE3C20E7125654CF3
SHA-256:	71A194E946376B819FA7DCE5748AAC25EAF402E0747397ED0C5DA8DECB26006A
SHA-512:	44DB56BEBC117DAFB29789729E6376CD02B12F4A5E9C1E922632BEF54FC2B3A20CD7D08070C60E18E8E3A940CF37512F7A7BB684E8E51963FB8145484C176F92
Malicious:	false
Preview:	/..............................Table..header......../..QHeaderView,QHeaderView::section..{.. border:none;.. border-right: 1px solid rgb(193,193,193);.. height: 26px; ..}..../.MessageBox............./..QMessageBox QLabel..{...qproperty-alignment: 'AlignVCenter \| AlignLeft';..}....ABConfig--CLabel..{...qproperty-alignment: 'AlignVCenter \| AlignRight';...max-width: 150px;..}..../...........CLabel.../..ABConfig--CLabelLeft..{...qproperty-alignment: 'AlignVCenter \| AlignLeft';..}..../.................................160..Edit...........13........................./../................/..QLineEdit..{...lineedit-password-character: 42;..}..../...QTreeview.......*/..QTreeView::item..{...height: 20px;..}....CPathComboBox::down-arrow {.. image: url(:/images/public/ComboBox/comboBoxPathBtn_normal.png);.. width: 18px;.. height: 18px;..}....CPathComboBox::down-arrow:disabled, ..CPathComboBox::down-arrow:off ..{.. image: url(:/im

C:\Program Files (x86)\Ezviz Studio\RemConfig\qss\is-222KN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1854
Entropy (8bit):	5.846731272449076
Encrypted:	false
SSDEEP:	48:Q1u5dAgNPmdy6hgw9awxZRdzePXI1zwYA:AadLPmvePiwYA
MD5:	0BE4FC839C251E13D552C660F40927FD
SHA1:	B0FC9CB53E6F86F5BF31D71DE3C20E7125654CF3
SHA-256:	71A194E946376B819FA7DCE5748AAC25EAF402E0747397ED0C5DA8DECB26006A
SHA-512:	44DB56BEBC117DAFB29789729E6376CD02B12F4A5E9C1E922632BEF54FC2B3A20CD7D08070C60E18E8E3A940CF37512F7A7BB684E8E51963FB8145484C176F92
Malicious:	false
Preview:	/..............................Table..header......../..QHeaderView,QHeaderView::section..{.. border:none;.. border-right: 1px solid rgb(193,193,193);.. height: 26px; ..}..../.MessageBox............./..QMessageBox QLabel..{...qproperty-alignment: 'AlignVCenter \| AlignLeft';..}....ABConfig--CLabel..{...qproperty-alignment: 'AlignVCenter \| AlignRight';...max-width: 150px;..}..../...........CLabel.../..ABConfig--CLabelLeft..{...qproperty-alignment: 'AlignVCenter \| AlignLeft';..}..../.................................160..Edit...........13........................./../................/..QLineEdit..{...lineedit-password-character: 42;..}..../...QTreeview.......*/..QTreeView::item..{...height: 20px;..}....CPathComboBox::down-arrow {.. image: url(:/images/public/ComboBox/comboBoxPathBtn_normal.png);.. width: 18px;.. height: 18px;..}....CPathComboBox::down-arrow:disabled, ..CPathComboBox::down-arrow:off ..{.. image: url(:/im

C:\Program Files (x86)\Ezviz Studio\RemConfig\qwt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	892928
Entropy (8bit):	6.631036842323821
Encrypted:	false
SSDEEP:	24576:XZmVBgC9XzrG3/DlpD5ol/kOski73nE65xWF5rDRlSYth:EzSARP
MD5:	AF3DC7EF6A79617A594AD78D137803BD
SHA1:	9AF165812FCCD1ABE231C1394D8835FF256DAA6F
SHA-256:	0CB34841194F94B7C9AF64FA66CB4621262966126C9AB41AE8618762C8FD41C4
SHA-512:	7292385B1A31114FDBA7280BC8E88EC8D55B276DD253F607C7DF376F54F49B8C39931E6C4F0EBCA9F3C265EF8141B092332EE2418027A2ACA489A6A93A48ECC3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^$B..E,..E,..E,.=.W..E,.....E,..=...E,..=...E,..=...E,..E-..A,..=..E,..=...E,..=...E,.Rich.E,.........PE..L.....R...........!.....J...R..............`.......................................F....@..........................]..r.................................... .......p..................................@............`..h............................text....I.......J.................. ..`.rdata..B....`.......N..............@..@.data...t...........................@....rsrc...............................@..@.reloc..b.... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-0H0FE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	82411
Entropy (8bit):	4.655370826193561
Encrypted:	false
SSDEEP:	768:MBPRwNbCU55EUhmSggY+OpHFK6VxAfo1yDgESILETBfv66z:YRwNeAEEm86vdES4ka6z
MD5:	2DB9055A56027C4D0A5A29A4161A97ED
SHA1:	C06C716ED01996E745EC883EF963E2725260E94F
SHA-256:	821C7F609C01435F38CC8E99B4EBCD9F2C4F52951E9E1051AD7927E745B62BA5
SHA-512:	874AEB92D6C3C77E5EE09B6F84917EF1B98638D90FC05CE9B371BDF4A783CB94FE5715617211480D5677885E9DFE066B31BCE670DEBF26E7D3EC6479CB91B490
Malicious:	false
Preview:	<.d....!..`...B..........G...+.......]..9....;.......;..0D...;..?....;.......;.......M..9....O.......O...H.......`...}..9....m..:...........+;...!..+;..<...+;..C:..+O......+O..;...H4......H.......J......K.......LD...&..L....z..PS.....Zr.....[`.....[`......\...v..._....W.._.......1...DA.......K......<s..............J........6...,...................s.......8.......a.......w......Bu...E..:....E...............%.......%..M........1...0...c...0..>i...0.......0...u...0.......0...9...5.......5...... D..A... D..T...+....'..,...B...,....~..<U...X..<U......<.......F...C...F......H5......H5..A...H5..Ul..H5...&..f....l..f...4...f...?M..f...O...f.......f....f..f.......l....................`......@...............A.......U............`.......`...W.......}......4....e.......e..B....e..U..................y......~.......^....O.(4...Qd.(4...Q..(5...Q..(5...R...y......y..~...y......T..V...0..)..*.0.....+F......+F......+f....U.+f...H..+.z..2..+.....$.+.......+.....X.+.z..3..+.......+....<9.+.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-22BBP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	743354
Entropy (8bit):	4.91144017928325
Encrypted:	false
SSDEEP:	6144:kXKY1cYMIfQRO6U43xDV2cK3qCRZpVPmeOHJ/9oj6Xp5fuYWY:IJeYXoRO6U43xDVXGXVPmCjtY
MD5:	19087505226CC366E64E82271F0B2529
SHA1:	0E39AE92CAD830C0381053802835124171839779
SHA-256:	85E9C12C3E74F34E84E5E910F2F0F7A8C24F5C31CBAEB7ABCD52514B4D102C7F
SHA-512:	89C3B54B33EF9BBB9EDCA17614F4C2072D7B6DEDA4C5B191C3D9C0D8278EE9FFDA7EE9300C38EBCCB8C1DAB3AB90DAC19669F70B4FBB1CE1EF6018205940ABD2
Malicious:	false
Preview:	<.d....!..`...B...H...%...;...%......%.......%.../.....5{...,.../...,...^...............y...0.......1......1.......1..E....2.......2..G....3..Ia...4..I....5...o...5..J....6.......6..J...7.......7..JQ...8.......8..Jx...9..J....P..3....P..Z ...m...9...s..#....s.. <...s.......s.......s..3....s..H....s.......s......s.......s...........Y...@..E....A..F....B..FF...C..Fp...D..F....E..F....F..F....G..G....H..GB...I..Gl...P..G....Q..G....R..H....S..H;...T..He...U..H....V..H....W..H....X..I....Y..I7...`..I....a..I....g..=....s......w..=....x..:....}..'....}..T...............:.......=U......>.......-.......'.......U.......;........x......f.......;...............>......;...............(.......Ug......(5......;.......U.......w...............gJ...p..-....p..Rs.......5.......W......!:..............!s......!.......!........r.......^.....................;]......................................Q......"......."U......"......."..................../..s....;.......;...p...;......;.......>...B...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-2O0SV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	319892
Entropy (8bit):	4.767219587801568
Encrypted:	false
SSDEEP:	3072:RLZTvkvfY+urkt7a62NLX378PVyUGrB9tLyOjCn+exsWy7zXBuonW1rkHoaL0lMO:lZ7k37tnGrfjCnGIE6
MD5:	ACAFCF356E7B47FC4C208C374C5DE162
SHA1:	A8002F2B3F81B83CB4B3BDA9BD04B899B58084E9
SHA-256:	BF5CAEF62F0AC62C30C3EA71D85AB487C608C2EBF64882661C72AC89B93A0C85
SHA-512:	43BA5C5DA13E68FEC2C8833735BF5E0C8B4DAC2189F1AE7B6F2437E3412A2123FF9DCF2C51067D0C4448FC60D1F122F746EDF4C864DB57E092382AE431EE7451
Malicious:	false
Preview:	<.d....!..`...B..I...........+...............@.......A.......B.......C...u...D.......E......F... ...G......H.......I......P...C...Q.......R......S...8...T......U.......V.......W...\...X.......Y...I...]..n=...t..".......................................:...;..J....;..`....;...S...;...[...;...>...;..X....M..ne...O..=+...O..Z.......J....}..n....m..n..........(5...#..+;..5...+;...N..+;...G..+O..5s..+O... ..1.......E@...B..F......H4......HY...u..H...)...I......I@...,..IA...Y..IC..&...J...Mb..J...&...J...&v..K...:d..LD..(s..L...(...PS..0...R.......T....]..Zr..G...[`......[`......\...LY..\...N..._...M..._...[y..1....D...-......E...'......6...........1.......1....w......GK......8........Q...... A...... ....$.......[.."+...,.."....y..&.......L.......X........w......9.......&L...9...........v...E...C...E..XV...E..........'.......X....%..;=...%..........).......k.............u......E...5..*....0..J....0.......0..ie...0.......0..-....0...9...5../...........+...7...,.......,...YU..<

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-2VQII.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	582582
Entropy (8bit):	5.8277847176962565
Encrypted:	false
SSDEEP:	6144:K1TFRa2yuGvOY8vA0ubNF+livjLnvkR3CQ7+:0yEY8vA0ubL+lMfvkR3CQ7+
MD5:	036DA3279D29375502E150D1BB4C88E9
SHA1:	9C37ACAAE85B80A505270B252A82F93D6C3FC968
SHA-256:	8E97C44DC83FB5E5DD362B2FD9559ACBC86DC742A7532E2DAE87E6FD45748D60
SHA-512:	3811AD50998D2DD37CCF9EEC3C45B9A854044D5CD3ACD4405679ABA529FBA77BB7D5C764665DC2E190BD01C01F57C5841C841B9194AEFB23A29B731079305D4C
Malicious:	false
Preview:	<.d....!..`...B...H...%..z....%..=....%.._....%.......*...A...,...c...,...........4......K....0.......1.......1..K....1...w...2..L....2...B...3.......4......5..OE...5......6..O....6.......7..O....7.......8..Pa...8...$...9...K...P..)....P.......m.......s.......s......s..w....s...C...s...1...s...3...s..6....s..R....s..V....s..YW......K....@......A.......B.......C.......D...F...E...p...F......G.......H.......I.......P...i...Q......R......S.......T.......U...;...V...e...W......X......Y.......`...4...a...^...g......s...<...w.......x../N...}...2...}..Dw......Od....../~.......u.......%.......n..............D......./.......~X......j.......0>......~.......P.......0l......~....... .......D....... C......0.......D.......%K......~.......j....p..$....p...}.......1.......S..............{........E.......v..............P........X.......7.......,.......c......aB......sj......u.......'........;.......................:.......k.................../..s....;...o...;...j...;...I...;...j...>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-3TDU3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	729966
Entropy (8bit):	4.8378686736645475
Encrypted:	false
SSDEEP:	12288:tTcjC2OYAdGgeAchletPHpuBD0JXJTk4uL:KjC2EdGgeAchl6JdJTkd
MD5:	3F08031A1AE8058E16B7C43A6F799ADD
SHA1:	5B95A90F0AD983D99DD17B1E23ABDAD56AE441BD
SHA-256:	6CFC34CB01A81A1257EFAD9FD112C412543CF85AA45E18237C6AA7C3DA5482DF
SHA-512:	3400B364A805BD2B215F4E9E8B9F6CF26579605A21B0C3789A09CDB5AB9D2F8B30F21A50666E423C6397C1C25CCB64ECB7EECE815BC931DFC89B509FA7FEB340
Malicious:	false
Preview:	<.d....!..`...B......%.......%...Z...%.......%..U....*.......,..j....,...........L...........0......1.......1.......1.......2.......2.......3.......4.......5.......5...<...6...?...6...c...7......7.......8.......8.......9.......P..2....P..En...m...h...s.."....s.......s.......s...E...s.......s..%....s.......s.......s.../...s..............@...+...A...U...B.......C.......D.......E.......F...'...G...Q...H...{...I.......P.......Q... ...R...J...S...t...T.......U.......V.......W.......X...F...Y...p...`.......a.......g.......s.......w.......x..8f...}..%....}..R...............8........x.......6..............&:......R.......8........_......Kg......9h....................9..............&.......S%......&.......9.......SL......n...............L....p..,....p..>.......u[......u}.......5...............l......................7.......P.......................m.......0.......U.......................................J................................./..X....;...J...;...C...;...`...;.......>...g...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-452BR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	250219
Entropy (8bit):	4.661904577001558
Encrypted:	false
SSDEEP:	3072:1U80lV42Wr7BimRORiaGrh9zK4uMM8Ya/0z6nRiRa:1U80lwRaGrXzKAXHf
MD5:	45683D9E2E7FB8C23C6E309EB66F9A7E
SHA1:	683824690D55227C1848AA274FBA40ED76E44B50
SHA-256:	A83C107893CE1DBD85BC01520E132C78ADD21A2B33271661950CCECC2A04CD58
SHA-512:	4AE1A835F52742786B0888E352311313D0492E9FFBA6813317A48F37A93EAF829C40FE294DA7253A420E86BA22A78A3D13A93260265FC0AB743A5790BA1253AC
Malicious:	false
Preview:	<.d....!..`...B..=.......~...............,......(...+.......@.......A.......B.......C......D.......E......F.......G...v...H.......I...[...P.......Q......R...x...S.......T...f...U.......V...h...W.......X...S...Y.......]..n....t...j......................................%...;..J....;..am...;.......;...j...;...E...M..n....O..6....O..S....[..Qz......D....}..n....m..o...........(5...d..+;..4...+;......+;......+O..4...+O...b..1....b..E@......F....5..H4...j..HY...V..H...#...I.......I@...W..IA......IC..!...J...J!..J...!...J...!`..K...9...LD..#/..L...#...PS..)...R.......T....Z..Zr..A...[`...W..[`...]..\...F3..\...K..._...Gy.._...T...1........-.......E..........5...............7............................$...a...[.......,.......y..!.......L.......V.......v.......8.......!6...9...........P...E...k...E..Q....E..........".......QD...%..:....%..........${.............9...............5..%....0..J....0...&...0..g....0.......0..'....0...K...5..(...........+...0...,.......,...R...<U..g...<

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-4UA4S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	272162
Entropy (8bit):	4.7459161700235235
Encrypted:	false
SSDEEP:	3072:95UlcKkurNv0RHO9QAIDiOUi+E4V17/7dmdv/YX+7jAWACNZcrwaeIjWmjmvvAtD:95Ulczuwm7K7VEaLRi9CqIu
MD5:	4DB8350B485A3CC9FDDE9414B7A71D41
SHA1:	11A8BA80349EB4AE2F5B2E588D15319F46969A69
SHA-256:	5B9A8F5C43DF4EE6345A33706C530F6E508B00A70E87D7844230C594E614AE5D
SHA-512:	6A9D966BCB0564C1FE1C7C7FD54AD43F1BC81A74965480AB46368E492EA1E485CE7B53C8D62AE78DA8182589010B8E155E958FAF8F8B9136427F54C3A2B66FAD
Malicious:	false
Preview:	<.d....!..`...B..B....*..B....+.......@..\....A..]u...B..]....C..^c...D..^....E.._....F..`....G..`w...H..`....I..a\...P..b....Q..b....R..c{...S..c....T..di...U..d....V..e....W..f....X..fz...Y..f....]..h....t...................................e.......H...;..E....;..\@...;.......;.......;..m....M..h....O.......O.......[..............}..h....m..i...........(5..s7..+;..0...+;...`..+;...a..+O..0o..+O...0..1....-..E@..c...F...g\..H4...L..HY...I..H.......I...h...I@...B..IA...i..IC......J....Q..J....4..J.......J.......K...5`..LD......L.......PS......R....t..T.......Zr.....[`...}..[`..?...\....c..\......._......_......1....F...E...!......1................`......3u.......................Y...$...P...$.......[.......,...N...y.......y..........G........d.......9......4............9..............E..._...E...D...E..DM...............t...%..6?...%.................T......y......\|C......W...5.......0..E....0.......0.......0...2...0.......0..D....5...........}.. D...... D...?..+......,.......,

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-571RL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	76274
Entropy (8bit):	4.8578835738633614
Encrypted:	false
SSDEEP:	768:QpDShETEGhGqtur/O4jsWVd8iPHmiWe+GCK3/IlQt1E/6fkFr51VNfKLyOUiyeiw:Q/ztu7jm2fgrxmiw
MD5:	6EB92350141BB544C42DE28B93435502
SHA1:	D3246524C883462B60D882AD83B6185DCA10D267
SHA-256:	60C14C55DFAB55DCCCD8674BA3C48CFAFF0DC24F707E9B76C4122881ABDFAB85
SHA-512:	B9DE2F8E64EB67FC398B3732B20BEF33C12ABFABAA169FD2AC6A7BF433BC01367F656CEB478E1DE68E59494E3C4CF8F007ADB4DF3089830DEEBFD313DEC2B457
Malicious:	false
Preview:	<.d....!..`...B...x......Y...+...&...]..4....;.......;..,....;..:L...;...Z...;...o...M..5....O.......O..............}..5....m..5V..........+;......+;..79..+;..>@..+O......+O..7...H4...G..H.......J......K.......LD..."..L....v..PS..._..Zr...9..[`......[`.....\...l..._......._.... ..1...?5..............7...............Ex.......n...,...........2......t........................w......=}...E..6(...E...............%...i...%..GU.......+...0.......0..9....0..{....0..~....0......0...M...5...X...5...... D..<... D..N...+....5..,...=...,.......<U..\|...<U......<.......F...>...F.......H5...&..H5..<...H5..O$..H5......f.......f...0$..f...:w..f...I...f...~e..f.......f......l...................H......;...............<.......OU...........`......`..........i......0T...e.......e..="...e..O.................y......~.......^....i.(4...KL.(4...K..(5...K..(5...K...y......y..s ..y.....T..O...0..%..*.0....+F...{..+F......+f......+f...B..+.z...u.+.....\|.+....s..+.......+.z.....+.......+....7g.+.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-6KPC0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	172386
Entropy (8bit):	5.326083835954235
Encrypted:	false
SSDEEP:	1536:o3Du5wZmze/iYZE7st2b+hCE+PqDLlxnrcGrbs/wN43ZLSIVRJeMzKu0EY1WwKMM:o365wZB7E7xSh+GrgrRUMVtwjxnGNP
MD5:	67C53D7B506F7040FFFFCED9643DE288
SHA1:	76C288F80009C240DDE305A2FF3C78CECE03B3C0
SHA-256:	C261CD7865382EB7D7AAC077A72EAF20AC4CDF4D0E01AD810CC436C5D6304986
SHA-512:	BE092A9D97C26A8069071BBB4643E296765070FCBF4D61224709D158A219D3E991EAD7BB55F4E21FB7BDB4BA5C5994E0C34315F64FEB5E638856B39D747907AA
Malicious:	false
Preview:	<.d....!..`...B..,...........@.......A...K...B.......C...A...D.......E...s...F.......G...i...H.......I...V...P.......Q.......R.......S.......T.......U.......V.......W...0...X.......Y.......]..Lm......C.......C1......C[......>....;..+H...;..@P...;..Q....;.......;.......M..L....O..c....O..q....[..o....}..L....m..L.......x..(5...&..+;......+;..N...+;..U...+O......+O..N...1...*...E@......F.......HY..l...I....Z..I@..B...IA..B...J.......J.......K.......R...p{..T...?...[`..T...[`......\....d.._...f..._...r...1...V....E..X........4......O$..............`.......\....$..m#...$.......y..........,........Y......~!...........9..m.......U....E..M....E..o(...E..........o\...%.......%..b.......e.....$......&......+....0..+....0..Q"...0.......0...b...0..]N...0...... D..T).. D..k...,...Uq..,...p-..<U......<U..c...F...U...F...pZ..H5...;..H5..TQ..H5..k{..H5...D..H5..JY..H5..Kk..L...If..VE..'...f.......f...D...f...R...f...e3..f....!..f...1o..f...~...g...$.......................S.......".......Ty...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-75L1S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	119822
Entropy (8bit):	4.818787346123787
Encrypted:	false
SSDEEP:	1536:/9MHYT6dryoYFB2G7RvGL1zGr+BZtQFnZUkXU:/ZT6dryoYFB2G7VGL1zGreZuFnZU+U
MD5:	C3B7C06921CD596DE02EC1D9F6DD6F11
SHA1:	F088066428B184CBC7CDD9969BB47F63EF54DF2B
SHA-256:	0728999FFA1E9980586C59930207F231D74A600E28B1C46B27733CE8FA995D92
SHA-512:	5F903E0CDA8AEFECEB59CA0663C640D39997E117D06E76E75BB08339854B23608FE7D1D27F82DB29FCFAC32E27C1C4D6760E2BEAA370AE6DFD4B0FB4D1DB3F87
Malicious:	false
Preview:	<.d....!..`...B..&8...*..z....+..,5...@...k...A.......B.......C...k...D.......E...)...F...~...G.......H...'...I...z...P.......Q...h...R.......S...h...T.......U.......V...{...W.......X...$...Y...w...]..F....;..'H...;..</...;..K....;.......;.......M..F0...O..7V...O..F.......;....}..FT...m..Fx.......7..(5......+;......+;..H-..+;..N...+O......+O..G...1.......E@......F.......H4..,T..HY..b_..H...0,..I....f..J.../6..J..._T..K....?..LD../...L.../...PS..1...Q...d...R...f4..W...n...Zr..;:..[`..$...[`..y...\......._...<..._...GR..1...O....E..Q\..............H........t......XC......,u...$..cb...$..\m...,..-....y..^.......(a..............S.............../....9..c.......N....E..G....E..\|X....../{...%.......%..Z"......0t......'........................0..'....0..J]...0.......0...E...0..0....0..\|....5.......5..1'.. D..M4.. D..aQ..+...5...,...Nj..,...E...<U...i..<U..7...<...74..F...N...F...E7..H5......H5..M^..H5..a...H5......VE......f.......f...@L..f...K9..f...\>..f.......f.......f...S...g....T..l

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-75O3K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	25666
Entropy (8bit):	5.381958813501669
Encrypted:	false
SSDEEP:	384:X4Hoq2FErfRHMuktdYKBN8IgnEQ0P8ghbVruptRs6Mtu/hp2qfrnw:X0uE7RHMlrYKBN1gnEQ0P8gVk6uX2V
MD5:	D240F6D1578B001A16268F0A1C87BFA2
SHA1:	D9C381FB6DC853A491778FEF4F1FB18FC06AA314
SHA-256:	93C5D756EBEF1A96313F6C35E24FC944C3FF4E264D01D8EA52537654E88C4907
SHA-512:	A8E316B4A256E0F0F96DB1BE2478EF7E1A133D042FF647F07A0CCDE6EFC0FB54B31732D8DE12EABC9B925E15831B3A58536BA080B0C32333881043DB26A1DD78
Malicious:	false
Preview:	<.d....!..`...B.......+..@....;...o...;.......;.. ....;..2l...;..;....O..C....O..G.......F...+;......+;...v..+;.."...+O......+O...H..H4..@...H...B...J...A...K....2..LD..BM..L...B...PS..CC..Zr..E..._...F=.._...H>..............................#.......@.......................I#..............A.......B#...%.......%..$....0...C...0.. ....0..0u...0..2@...0..B....0..J....5..2....5..C...+...C...H5...k..H5..!f..H5..&...H5..3...f.......f.......f...!...f...&...f...2...f...?...f...I...l...Dv......I.......J6......!5..............!.......&............................e.......e..!....e..' .....J......Ja...y..5S..y......y..-...y..H^..T..'O.+F.../..+F...K..+f......+f..."..+.z.....+.......+.....Y.+....H..+.z...*.+.....q.+.......+....#+.+....'~.+....0..+....K..+....,.+......+...H..+.....`.Hw9.....Hw9.. ..J+....X.J6......J6....;.J6... r.J6...!..J6...0F.J6...1..J6...=..J6...LR.LZ...Bt.L.....,.L.....f.L.b.....O\|......PFE...A.PFE..1?.PFE..L..T.....W.V1...;..V1...>..Vl......V....D..W.T..;..W.T..>\|.W.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-7DNLJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	25666
Entropy (8bit):	5.381958813501669
Encrypted:	false
SSDEEP:	384:X4Hoq2FErfRHMuktdYKBN8IgnEQ0P8ghbVruptRs6Mtu/hp2qfrnw:X0uE7RHMlrYKBN1gnEQ0P8gVk6uX2V
MD5:	D240F6D1578B001A16268F0A1C87BFA2
SHA1:	D9C381FB6DC853A491778FEF4F1FB18FC06AA314
SHA-256:	93C5D756EBEF1A96313F6C35E24FC944C3FF4E264D01D8EA52537654E88C4907
SHA-512:	A8E316B4A256E0F0F96DB1BE2478EF7E1A133D042FF647F07A0CCDE6EFC0FB54B31732D8DE12EABC9B925E15831B3A58536BA080B0C32333881043DB26A1DD78
Malicious:	false
Preview:	<.d....!..`...B.......+..@....;...o...;.......;.. ....;..2l...;..;....O..C....O..G.......F...+;......+;...v..+;.."...+O......+O...H..H4..@...H...B...J...A...K....2..LD..BM..L...B...PS..CC..Zr..E..._...F=.._...H>..............................#.......@.......................I#..............A.......B#...%.......%..$....0...C...0.. ....0..0u...0..2@...0..B....0..J....5..2....5..C...+...C...H5...k..H5..!f..H5..&...H5..3...f.......f.......f...!...f...&...f...2...f...?...f...I...l...Dv......I.......J6......!5..............!.......&............................e.......e..!....e..' .....J......Ja...y..5S..y......y..-...y..H^..T..'O.+F.../..+F...K..+f......+f..."..+.z.....+.......+.....Y.+....H..+.z...*.+.....q.+.......+....#+.+....'~.+....0..+....K..+....,.+......+...H..+.....`.Hw9.....Hw9.. ..J+....X.J6......J6....;.J6... r.J6...!..J6...0F.J6...1..J6...=..J6...LR.LZ...Bt.L.....,.L.....f.L.b.....O\|......PFE...A.PFE..1?.PFE..L..T.....W.V1...;..V1...>..Vl......V....D..W.T..;..W.T..>\|.W.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-7O95O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	228388
Entropy (8bit):	4.7265515278997405
Encrypted:	false
SSDEEP:	3072:nQAgZItgmi/Zu0eeAEv+v49JnnSmICgr3n7jhCQUeimqyU5UggBRyGrL2LZO+YTZ:nQ7gDSbGrw6wsR
MD5:	4A259A2D7EA31E96229C06688CD4D193
SHA1:	D3B5EDB95036272835EB6E37B71E28F39E2A6661
SHA-256:	5671B5C74E8EFF607973CFD08C8AF159391555030E1C325095AE2BCEF2DE6630
SHA-512:	65EF091E47BB22B27FD697EA06F288C3B96E5E7974EBAC73ED17EF4518759E164A30D76C627B5AE594377A7C2EEAE5FDBECDAA81C1F416CCE62DFD2E5DFB15E1
Malicious:	false
Preview:	<.d....!..`...B..<....*.......+.......@..."...A.......B.......C.......D.......E.......F...C...G.......H...6...I.......P...b...Q.......R.......S...W...T.......U...M...V.......W.......X.......Y...l...]..g....t...5.......E.......o..........................;..G....;..\....;......;..i@...;.......M..g....O.......O.......[..,D...........}..h....m..h<.......0..(5......+;..2...+;.....+;.....+O..2...+O...n..1......E@...a..F.......H4......HY..._..H.......I.......I@......IA......IC......J...6...J.......J.......J...^u..K...7...LD......L....M..PS...4..R....U..T.......Zr......[`...5..[`......\...!...\...8R.._..."A.._.../G..1.......E...s......4...............5............................$...v...$..Z....[.......,.......y...+...y..].......H.......@.......J^......6........]...........E......E..+....E...]..............,....%..8r...%...........=.............}................5.......0..Gx...0.......0..P....0..h....0...c...0.......5...=.......h.. D...... D...E..+....?..,....G..,...,...<U..Q,..<

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-807T3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	320883
Entropy (8bit):	4.544804624700274
Encrypted:	false
SSDEEP:	3072:ED0sUhPf0ftz5orOV/kLW4AGFfR4xpuMXXEdniqgitW4hgoVLpCoaw+NgzXCTPna:EAs/ulpNY9ni
MD5:	58E3AAE4BE7F9D3018FD9EEA0C793255
SHA1:	77BF1E7D381A4129D4216063DF64577A353607C6
SHA-256:	893C6C6F8D6C7785AAF22432442C66901BFEE9F3FD35C45978215319A2843CAA
SHA-512:	FEB5F38A5C9CD3DEF8E74A93A7C64CE0EBC66AFB6AD585BF04736635CAA2D1B04B4D035C301850A3F66753027E6849E447A37DA94FAF051524F4782BF227F314
Malicious:	false
Preview:	<.d....!..`...B..F.......[...+..)I...@.......A...k...B.......C...a...D.......E...k...F.......G...a...H.......I...N...P.......Q......R...{...S.......T...q...U.......V...{...W.......X...n...Y.......]..r....t../........r..............................6....;..MZ...;..d....;.......;.......;......M..r....O..IH...O..i....[..f.......WR...}..r....m..s&.......G..(5......+;..7l..+;......+;......+O..7>..+O......1......E@......F....X..H4.....HY..'$..H...5...I...."..I@......IA...E..IC..3"..J...a...J...3I..J...2...J....]..K...<=..LD..4...L...5F..PS..<r..R...+...T....a..Zr..Tw..[`.. ...[`...h..\...X...\...cF.._...Z..._...i...1........E..........8........+......6.......:T..............,.......,z...$..(7...$...%...[.......,../_...y..2....y..........N.......m...............;.......2....9..(............E.......E..f/...E..........4.......fc...%..=2...%...4......62..............................5..6....0..M,...0...=...0.......0...>...0..:2...0...l...5..;.......,... D...<.. D..&...+...C...,.......,

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-80U87.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	759411
Entropy (8bit):	4.770448984570024
Encrypted:	false
SSDEEP:	6144:tls24pmBqwIObdm+j2dVZ6l6tya1HqV83c:fs2hbdm+j2dVZZya1HqV83c
MD5:	A979C3205D2006415222B3CB4EDBC4A2
SHA1:	8D7FEE8F85A2C56B08FE9433A71B8ECA6929B1BB
SHA-256:	8917EEC5E3B0F2A5EAC6CF8CB0C301FF67D1A5E9CC0A739B8A9AA662FC133A8B
SHA-512:	A7C32DF1F53215C609F297E83714A5B27BB7D8CC02C54F9812ED9A3E99E12A63DE05B5C34C50B67EF9FC674D408CBABC44B7BBA539E80FFDA19451B32F767285
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%.......%.......%.......*..8W...,.......,..................@a...0.......1.......1..@....1...%...2..Aj...2.......3.......4...6...5..D....5...]...6..D....6.......7..E;...7.......8..E....8.......9.......P..3....P..h....m.......s..$b...s.."....s......s...9...s..N....s..j....s...T...s.......s.......s..........@A...@...L...A...v...B.......C.......D.......E.......F...H...G...r...H.......I.......P.......Q...A...R...k...S.......T.......U.......V.......W...=...X...g...Y.......`.......a.......g..`1...s.......w..`X...x..:R...}..'j...}..T.......D.......:.......`.......`.......Q.......'.......U"......:........t......\|.......;L..............EZ......;\|..............(a......Uo......(.......;.......U.......{_..............}b...p..-....p..ao......................^r..............^.......^......._........P.............................V................\|.......6......$@.............._V......_......._.......`.......6.......6..../.......;..8....;..'....;..0+...;..T....>...,...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-95136.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	116789
Entropy (8bit):	5.84527706343641
Encrypted:	false
SSDEEP:	3072:1vWdvTIlpIuzeCSuXOFRu/i6OjYb4goYvcPezVhjvyfpnqsB:9WdFCSuXUQ/i6OjYb4goSeezVhvwR
MD5:	AB22DA97A53D7A008D6B44EF67955EFF
SHA1:	A4A726631512311159C60C001DF73A1AA03CFC68
SHA-256:	8E482D5779A30B661F2D34C1EB2CB048C35FF03B56F96BD8287EC810FCAA0C7D
SHA-512:	416A73272F7A9C39D15E7066CD1A58262778B8F8DFB2AF88C0ADE2E8AC7A5C03829549D98B99D8CBA719257E5DC3A181AF728A7F2DD466C21583BD48305EAF66
Malicious:	false
Preview:	<.d....!..`...B..+x...*.......+.......@...U...A.......B...N...C.......D...D...E.......F...n...G.......H...a...I.......P.......Q.......R.......S...v...T.......U...l...V.......W.......X.......Y.......]..2....;.......;..+k...;..7....;.......;...v...M..3....O.......O.............}..3B...m..3j.......7..(5......+;......+;..5+..+;..:...+O......+O..4...1......E@......F.......H4...#..HY..I...H.......I.......J.......J.......K.......LD...H..L......PS...;..Q....)..R...M...W....f..Zr......[`......[`...,..\...kR.._....9.._.......1...;...............5........N......A........J...$..J....$.......,...v...y..................q................"..........9..K.......:U...E..44...E..........."...%...f...%..B........I...............................0.......0..7-...0..\|....0.......0.......0.......5...y...5...... D..9... D..H...+.......,...:...,....I..<U..}_..<U...5..<....[..F...:...F....n..H5......H5..9...H5..IM..H5...>..VE...<..f.......f.../$..f...7...f...D...f....7..f......f....m..g...."..l........

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-9C767.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	738275
Entropy (8bit):	4.922996937127515
Encrypted:	false
SSDEEP:	3072:Wdde3SN8CdspnrHY7QudlOQ7yWpnXjKO2pv2op8RcyeNPlZuKA5rNtUimaLtnK2p:Wds3S9dspnbM12PlZuKA5RHt0bxceTrC
MD5:	0E25C47A06AD2E513D3D913B90C97331
SHA1:	AB55C173E5F13F063616AB4F6C9058C2178649C7
SHA-256:	380EA30DE25C543C8518DFDC5062DD6BD7D032F5BDFBEDECAC2C442D75AFFDD3
SHA-512:	D73DA7983481CF628DC23D592017CB4549E15D0D3592D65F56175B7A179AB1A51054EFC1D63B3866BF8444644245C9907F73E8A2CAFEFDE99A561CF2261ED108
Malicious:	false
Preview:	<.d....!..`...B...H...%...E...%.......%.......%..r....*..1c...,..yO...,...p...............-...0.......1.......1...L...1..2{...2...6...2..4F...3..6....4..6....5.......5..6....6...g...6..6....7.......7..7....8.......8..7(...9..7O...P..2....P..Q....m...!...s..#L...s.......s.../...s...%...s.......s..AO...s...D...s......s......s...y...........@..2....A..2....B..2....C..3 ...D..3J...E..3t...F..3....G..3....H..3....I..4....P..4m...Q..4....R..4....S..4....T..5....U..5?...V..5i...W..5....X..5....Y..5....`..68...a..6b...g..6....s...r...w..7....x..9T...}..&D...}..S!..............9.......6.......7.......#.......&.......SH......9..............`.......:V......................:...............';......S.......'m......:.......S.......r........7......at...p..,....p..Jw.......M.......o...............................P...............p............................6................ ...............................................4.......m.................../..m....;...C...;.......;.......;...f...>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-9GSMN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	708394
Entropy (8bit):	4.866425421224098
Encrypted:	false
SSDEEP:	6144:nwtfpfgMqv4xbFF0jyzQe0auZo4+WjeUJIUL:wbfgixbFF0jykei+WjeUJrL
MD5:	D6A4FD581AFA5D0A7C00C4FE0D8C0F7C
SHA1:	88EBB9BCEBADBB6DAD6530F75BA7D534299E9C59
SHA-256:	1E4646C3A1634C320BAEECEAC4AA0C67767297AEE03EDB222EBFFDBF3AA74C8E
SHA-512:	005B18A751DCFB50D5A9D4EDC64649E572116F672452382A306F386D00F055B85DCFA9AB83F6B66DDBA6451E2113E40F4FEFF5EDF8AA530F6E30DE00C3DFDBCF
Malicious:	false
Preview:	<.d....!..`...B......%...l...%.......%.......%.. ......%....,..S=...,..................w...0...X...1..h....1.......1...r...2.......2...=...3.......4......5...i...5......6.......6.......7.......7.......8.......8.......9...F...P..0....P.......m.......s.."....s.......s...b...s...#...s.......s...b...s..dn...s.......s.......s...c.......W...@.......A.......B.......C.......D...A...E...k...F.......G.......H.......I.......P...d...Q.......R.......S.......T.......U...6...V...`...W.......X.......Y.......`.../...a...Y...g...$...s...J...w...K...x..6....}..$....}..P...............7.............................%v......P.......7{..............a......7................8......8...............%.......Q3......&.......8B......QZ......d........4...........p..+....p..'!......6k......6........I.......!.......................................................b.......u.......................A.......n......E........-.......f.......................5.......W.../..:....;.......;..g....;..o....;...3...>...W...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-9IHSP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	746165
Entropy (8bit):	4.821907660654219
Encrypted:	false
SSDEEP:	3072:W96yXyBcOkDHyF9zyM4cv8x6N6pr2NBpC+WGXsrcZ5n0u2+21SqfqgK63wuUchlj:W961ca9zyMpn0u2+21TU/WfIvrN7k
MD5:	AB878B5A113CB336DEC2980DD5B29AA5
SHA1:	9FF2E7390F5AC8256E925347D019459FF72A2C08
SHA-256:	9AA99D5D001AB9A706E91770015BCD0887C89D3F47804C00476E17FF3C8A4CD6
SHA-512:	4964B7A97FF5507F8C49C857FD7E487E7815D7A8CD003D8055A21B9F0FDE64831F2B90D3A1AFDC593A1156C0BED2C66E76B9B8ABC7B12A92952F238B1F8EF9EE
Malicious:	false
Preview:	<.d....!..`...B...H...%...#...%...>...%.......%.........4....,.......,.................$k...0...>...1.......1..$....1..Q_...2..%t...2..S...3..T....4..Up...5..(_...5..U....6..(....6..U....7..)....7..U....8..){...8..V....9..V3...P..2....P.._T...m...W...s..#....s...V...s.......s...G...s..?....s..V....s......s...`...s.......s.........$K...@..Q....A..Q....B..Q....C..R....D..R....E..RX...F..R....G..R....H..R....I..S....P..SQ...Q..S{...R..S....S..S....T..S....U..T#...V..TM...W..Tw...X..T....Y..T....`..U....a..UF...g..LW...s.......w..L~...x..98...}..&....}..S.......(~......9l......L+......L.......<.......'2......S.......9...............o)......:B..............).......:v..............'.......TE......'.......:.......Tl......x........%......o....p..-4...p..W................5......,...............,.......-"......-[.......j.......T.......!..............G.......................................U......-.......-................E.......}.........../..{....;..%....;...:...;...U...;..#2...>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-9P312.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	82411
Entropy (8bit):	4.655370826193561
Encrypted:	false
SSDEEP:	768:MBPRwNbCU55EUhmSggY+OpHFK6VxAfo1yDgESILETBfv66z:YRwNeAEEm86vdES4ka6z
MD5:	2DB9055A56027C4D0A5A29A4161A97ED
SHA1:	C06C716ED01996E745EC883EF963E2725260E94F
SHA-256:	821C7F609C01435F38CC8E99B4EBCD9F2C4F52951E9E1051AD7927E745B62BA5
SHA-512:	874AEB92D6C3C77E5EE09B6F84917EF1B98638D90FC05CE9B371BDF4A783CB94FE5715617211480D5677885E9DFE066B31BCE670DEBF26E7D3EC6479CB91B490
Malicious:	false
Preview:	<.d....!..`...B..........G...+.......]..9....;.......;..0D...;..?....;.......;.......M..9....O.......O...H.......`...}..9....m..:...........+;...!..+;..<...+;..C:..+O......+O..;...H4......H.......J......K.......LD...&..L....z..PS.....Zr.....[`.....[`......\...v..._....W.._.......1...DA.......K......<s..............J........6...,...................s.......8.......a.......w......Bu...E..:....E...............%.......%..M........1...0...c...0..>i...0.......0...u...0.......0...9...5.......5...... D..A... D..T...+....'..,...B...,....~..<U...X..<U......<.......F...C...F......H5......H5..A...H5..Ul..H5...&..f....l..f...4...f...?M..f...O...f.......f....f..f.......l....................`......@...............A.......U............`.......`...W.......}......4....e.......e..B....e..U..................y......~.......^....O.(4...Qd.(4...Q..(5...Q..(5...R...y......y..~...y......T..V...0..)..*.0.....+F......+F......+f....U.+f...H..+.z..2..+.....$.+.......+.....X.+.z..3..+.......+....<9.+.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-A1R4J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	245782
Entropy (8bit):	4.744175123778099
Encrypted:	false
SSDEEP:	3072:paJuNFuNUJahLGrSWOyunang7zrBZinW1rQHLGnMXvg3zLNTPb0XJ8P1YUPfhpir:l2Gretn1pnk
MD5:	4846BFF2909876AEE69442D423767E9D
SHA1:	7789D78509F1D5433984A44A83C9A25221C2CAD3
SHA-256:	A8EABABA209526A964F46481C10AE36B6B6BCB35EB905E864FF25B463DEF1682
SHA-512:	7BCD77C6587A95E1181E010D4834D63D9A18E9612286AB7AD4F38209F717E779E5B734587B4E555EAAFA2D5730075C72C3DD701C71939D4669508FD049E2CB5F
Malicious:	false
Preview:	<.d....!..`...B..8P...*...)...+..jk...@...&...A.......B.......C.......D.......E.......F...E...G.......H...8...I.......P...h...Q.......R.......S...]...T.......U...S...V.......W.......X.......Y...n...]..Pt......P.......Q.......Q4......Lc...;..,....;..B....;..U....;.......;..%o...M..P....O..v....O.......[..........\|....}..P....m..P.......7...(5..+...+;......+;..R...+;..Y...+O...x..+O..R...1...7{..E@...g..F.......H4..j...HY..pg..H...n...I.......I@..P...IA..P...J....-..J...m...K....i..LD..n...L...nk..PS..pX..R...t...T...M...Zr..\|...[`..a...[`......\......._...}..._....9..1...Z....-......E..\...............S.......<...............d.......j....$..qv...,..k................\......................mf...9..q.......X....E..Q....E.......E..........m........J...%...B...%..f.......o ............1......3......7....0..,....0..U....0.......0...a...0..o....0...4...5..o...+...u&..,...YP..,.......<U...f..<U..v...<...v...F...Y...F....>..H5......H5..X...H5..o...H5......H5..X...H5..Y...L...W/..VE..4...f

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-A2SA8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	789115
Entropy (8bit):	4.738849366743149
Encrypted:	false
SSDEEP:	3072:D41zJKyDEA4sQqrwqT8ZyhR2A4+bbb9iBShVIe3JrlIX2934Pa6EbrhpX3uRpIuE:U1zkywtsQq1PIX2934P8Lakc6g9Cr
MD5:	DB030D81B701FE195934BD92BA5932D0
SHA1:	2E442724A6A2FBC6676BBDBA52D293C0B52BEC1A
SHA-256:	4A90B6BEA849B6FE3CFD08C76D9C5FAB1670403A9F61E822B65E02F909F59083
SHA-512:	F62C5BA1F1FBF0349FEC32830662C854E51904776A3567FDA8F816B1B6D244EE549C66FFC225FA7D4481F309BD1A75AB94CB46C2F1BEF56B54BFF3C86FE88A39
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%.......%..:....%.......*..Es...,...s...,..<....................0..V@...1..G....1.......1.......2.......2.......3.......4.......5.......5...-...6...u...6...T...7.......7...{...8...%...8.......9.......P..6....P.......m...3...s..%....s../,...s...9...s..A9...s...3...s.......s.."8...s..E6...s..IE...s..MU...........@.......A...F...B...p...C.......D.......E.......F.......G...B...H...l...I.......P.......Q.......R...;...S...e...T.......U.......V.......W.......X...7...Y...a...`.......a.......g.......s..:....w.......x..<....}..(....}..X?.......(......<........s......./..............)d......Xf......=[.......v..............=.......................=...............).......X.......).......>"......X........m...............0...p../....p...+......5C......5e.......X.....................................................2.......C...............<`......................K^......H-.......\........................................../...H...;..u....;.......;.......;...x...>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-AEFDI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	247853
Entropy (8bit):	5.798108239451114
Encrypted:	false
SSDEEP:	3072:NIXTvr0ldksJUFoSpYKM0vTfWnhhoHGrPh4RFYgI+hvleXaKWNfh4hcZqTa6nCbj:NGvr0ldrSNHGr54xlld
MD5:	44280D64462790DCAF670760324D15B2
SHA1:	BC9D0D77892BD016B5AE2504AF4F152D6693B496
SHA-256:	09EE3A79598B88540ED04F9FE5027E0BB8DF501798024B91A95A6D7B11154861
SHA-512:	3C50EBAEBC6BB95BBAD3F5D688B80C97156523262A425E5222CF7856183EC7F42ECADC5F7613728BD3BFB1F7ABA5066E43DF2E67F15186942359D9AEFF024EB0
Malicious:	false
Preview:	<.d....!..`...B..IX.....:....+...S......Z7...@..a`...A..a....B..bU...C..b....D..cG...E..c....F..dk...G..d....H..eZ...I..e....P..f~...Q..f....R..g....S..hk...T..h....U..i]...V..j....W..j....X..j....Y..kj...]..Wk...t...1.......E.......o...............V...........;..;....;..Mn...;...`...;../....;..q....;......M..W....O.......O.............}..W....m..W...........(5..v...+;..)...+;......+;.....+O..)...+O...w..1.......E@..gy..F...k...H4......HY...\..H.......I...l...I@......IA......IC......J....L..J.......J.......J.......K...-...LD...^..L.......PS...&..R....3..T.......Zr......[`......[`..8...\.......\....p.._......._....(..1....}...E.....................1...Y...1...Y........-......,Q...............$...........$...G...$.......[.......,.......y...[...y..........<................s......-?...........9..............E.......E...M...E..<................y...%.......%................Y......{......}.......>...5.......0..;_...0......0.......0../....0...L...0..<....5..._.......... D...6..

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-BF320.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	297997
Entropy (8bit):	4.731879893547073
Encrypted:	false
SSDEEP:	3072:Fd60ieujdEJ1SRPHLjDVNtaVoT8ROGrBJ09TKdGpmJuO6SWFS1eSwDdOFyJZzHO+:Fo0ihhDGr89TKgpFM9w
MD5:	DFACC951255AB47C9409202225758674
SHA1:	A83B523FE49FD673572C24293D2CA72E9BEA2D63
SHA-256:	7F3488A52C5710D45FC7BD3D688420562667A56868C8BF163053DD0296607C3D
SHA-512:	5778CF4D2FAA86599CB6A5FD1EEA43A8DEA0B9BCEB065BF615F7964419FDA2CC4D0A7F7F539277F3215EF0B81BE461B8AA4F8D0B8CEFFC28147F6E8CF5870CE5
Malicious:	false
Preview:	<.d....!..`...B..E...........+.......@.......A.......B...{...C.......D...q...E...$...F.......G.......H.......I.......P.......Q...=...R...6...S.......T...,...U.......V...Z...W.......X...M...Y.......]..i....t...........W................................;..G....;..]f...;.......;..f....;...a...M..i....O...p...O..3I...[..1.......#....}..j....m..j/..........(5...P..+;..2...+;.....+;......+O..2...+O.....1....D..E@......F....7..H4...z..HY...m..H.......I.......I@......IA.....IC...W..J...2q..J....~..J....*..J...h...K...7j..LD......L....m..PS......R.......T....4..Zr..!...[`...I..[`... ..\...$...\...3..._...&..._...3...1........E..........3........&..............5....................$.......$..d....[.......,...h...y.......y..g.......H.......=l......T.......6............9...............E......E..0....E...........I......0....%..8A...%...........U..........................n...5.......0..G....0... ...0..M?...0..e....0...O...0.......5.............. D...3.. D...W..+.......,....}..,...1...<

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-BQ4UV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	295903
Entropy (8bit):	5.534248389928892
Encrypted:	false
SSDEEP:	6144:Aep/qOM8ZKiEbRXLXEBT1Kd4c20ddWl/2WKd3yR:DVqOM8ZKiEbRXLXEBT1Kd4c20ddWl/2U
MD5:	A4938BC91E1105C09FDDC8DA6E42011A
SHA1:	BCE970786119C29AD4E440873C1091DB15D9C559
SHA-256:	60592D1F61BC2EBCAB980AB8FE3A0BC34377C06AE16C472A91CC48BAB917F395
SHA-512:	E3CDAE454813640EB3B97C5F049EC5E432A2A761E0B6181A54F4BABC379B6775D3D21CCCC611DF9A1F0AA7B659D61FFDCC0E9B621A0C0096AE8E0D86FC6BDC19
Malicious:	false
Preview:	<.d....!..`...B..p0...%...1...%.......%...y...%.......0..:....1..#....1..=W...1.......2..>A...2.......3.......4.......5..?....5...>...6..?l...6...e...7..?....7.......8..@....8.......9.......P.......P.......s.......s.._....s.......s...\|...s.......s..Z/...s...q...s.......s.......s...[...@...-...A...W...B.......C.......D.......E.......F...)...G...S...H...}...I.......P.......Q..."...R...L...S...v...T.......U.......V.......W.......X...H...Y...r...`.......a.......g..Y....s...>...w..Y?...x...B...}.......}...~......?........v......X.......Yf.......j...............................W......o........D..............?........v...............................J.............. .......................p....p.......p..........j.......j...............................7......................5!.......'......OQ......r[.../..r....;..B....;......;...l...;.......O.......O..6....O.......O.......O.......^..Ms...^..._...^..:"......P.......&k......_...4!......4!......4!..4\|..4!..\V..4!...6..4!......4"..%*..4$..%R..4

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-CF844.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	725069
Entropy (8bit):	4.860810087849136
Encrypted:	false
SSDEEP:	6144:dUBub5OaLkWxbFF0jyuslDa2FnJvUXsUVwl2:JtHwWxbFF0jyLlJvUXsUVi2
MD5:	D340CA199C6DC5270CDCE049A1CE8B42
SHA1:	A2CEE89BC44A7CBD2BFFD23800F5CBCA94ED42F7
SHA-256:	49C054EE30B11A8E5EAD6193D3305C5064996227E05C7F156C400F6AB90A7379
SHA-512:	1468217F454018DBEC7AD512F8395EBB9EC77D8F1019B956CC9C2095014049400F1821B88F28507F0F3889CBFAE271983901F0242C565B14DA23C53B4DA4C892
Malicious:	false
Preview:	<.d....!..`...B.......%...$...%.......%.......%..3....*..'4...,..aP...,...3...............D...0...a...1...$...1...c...1.......2...M...2...\...3...'...4.......5...6...5.......6......6.......7.......7.......8...R...8...>...9...e...P..0....P..;J...m.......s.."....s.......s.......s.......s...&...s...o...s..w....s...y...s...^...s...........$...@.......A.......B.......C...6...D...`...E.......F.......G.......H.......I...2...P.......Q.......R.......S.......T...+...U...U...V.......W.......X.......Y.......`...N...a...x...g...1...s...3...w...X...x..6....}..$....}..Q........U......7 .......................a......%~......R.......7........k......>.......7......................8...............%.......RU......&.......8J......R\|......n...............?\...p..+....p..43......V.......V........Z..............................................................M.............................................j........>.......w......................g.........../..J....;.......;.......;.......;...D...>...i...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-DGQNG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	700210
Entropy (8bit):	5.513511897062812
Encrypted:	false
SSDEEP:	3072:fP4QXHWTbBo8Sh6wmBtF/79HmAUQ7h2DH1h4o0wh7fWtuAd9yVXtfInTn66Ohih6:oQXHWXBo8SIvUQ7h2DHN0u/IB6C76
MD5:	764610C1F11CFC81A1908CE8D5CF9388
SHA1:	AA618E1DB8AB55EC875072935835C124B1CC0F7B
SHA-256:	7B364B60A4C49A9F5935EA9B85B3D1CD3A36E7EE63056610DE66C014D12F5B2C
SHA-512:	125C683F65B722C70C882F606021CB4595D228094E9ACF5C6D36E46C672075A87AED9A30EE412C5C2A27C92201D3AF6DBE13781CFB35F0F03F5DA769682C883C
Malicious:	false
Preview:	<.d....!..`...B...H...%......%...F...%......%...).....$....,..Q....,...........Z...........0.......1.._u...1.......1...7...2.......2.......3.......4...H...5...s...5...o...6.......6.......7...#...7.......8.......8.......9.......P..0....P..-V...m...a...s.."....s.......s.......s.......s...W...s.......s..X....s..y....s..\|....s...........e...@...^...A.......B.......C.......D.......E...0...F...Z...G.......H.......I.......P...)...Q...S...R...}...S.......T.......U.......V...%...W...O...X...y...Y.......`.......a.......g.......s.......w.......x..7....}..$....}..P...............7Z..............e.......P......%.......P.......7........8......+.......8>.......k.......B......8v.............%.......Q1......&+......8.......QX......b...............,l...p..+....p..&?......&.......&.......{........n......{.......{.......\|-..............."...............L..............................................5.......\|b......\|.......\|.......}.......wc......w..../..7h...;...K...;..HF...;..PS...;..rt...>...V...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-DJS6U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	292296
Entropy (8bit):	4.87518463434259
Encrypted:	false
SSDEEP:	1536:Q/ZOTMBG0oFA/GPB69+d6Rjo77BrT+1G97s43LmJyVaxvrL/5MPNTt5kcFScGk9T:Q/8iboFCEga77BmiAltmuefhPJu8
MD5:	81309BDBFB78B7A3625E827D56AAC1EB
SHA1:	5D8A858C03E09B9769A59A1ECCD74A19B3207E6B
SHA-256:	62387FE2CB5BC84DE514CE490CE777D97914768BE9F46CB8C71D4ACF2135FFF8
SHA-512:	B30E375CFEAB6FD48A665E39FAF501CC6C59C8885D83D7B832A5021168172B07CFFA87B2FC176E8203C53224F68F782F1C551A93C07AAC775DE87E96F080FB47
Malicious:	false
Preview:	<.d....!..`...B..f....%.......%...U...%...J...%...Y...0..(v...1...+...1..,....1...J...2..-t...2.......3.......4...[...5...3...5.......6.......6.......7.......7.......8../O...8.......9.......P.......P.......s.......s..[{...s...J...s.......s.......s..>R...s..{V...s.......s.......s.......@...q...A.......B.......C.......D.......E...C...F...m...G.......H.......I.......P...<...Q...f...R.......S.......T.......U.......V...8...W...b...X.......Y.......`.......a...1...g..<....s.......w..=....x.......}...$...}...B.......R..............<.......=B.......................i.......:.............._B...............A....../................j.......................G......................................_....p.......p..........^.......^........<......................I......................2...............=I......g..../..a....;../6...;......;.......;.......O...s...O..4....O...]...O..{....O.......^..H....^.......^..'.......K...............[...4!......4!...`..4!..!...4!..@...4!......4!...2..4"......4$......4

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-DMKH6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	76285
Entropy (8bit):	4.858169506650341
Encrypted:	false
SSDEEP:	768:QpDShETEGhGqtur/O4jsWVd8iPHmiWe+GCK3/IlQt1E/6fkFr51VNfKLyOUiyeiP:Q/ztu7jm2fgrxmiP
MD5:	5C736F0EC5565F134324C2E1DE43E703
SHA1:	A37A0E05F84E675F70A4A33CD97005D0D7944880
SHA-256:	47AF3B51B58C8C1FEF50F7DD5FD4C4E92D4B0ED673FBAF75ED95AC7DDD502197
SHA-512:	51B687642ACC7AFF22507888D25A931FE12C3F66F9CDB6FA5A70F76DD018A44DCCFBE7C98C7577D3097C05487354E137360046C8A7B3D81B6CF3FB8C7DD1D840
Malicious:	false
Preview:	<.d....!..`...B...x......Y...+...&...]..4....;.......;..,....;..:L...;...Z...;...o...M..5....O.......O..............}..5....m..5V..........+;......+;..79..+;..>@..+O......+O..7...H4...G..H.......J......K.......LD..."..L....v..PS..._..Zr...9..[`......[`.....\...l..._......._.... ..1...?5..............7...............Ex.......n...,...........2......t........................w......=}...E..6(...E...............%...i...%..GU.......+...0.......0..9....0..{....0..~....0......0...M...5...X...5...... D..<... D..N...+....5..,...=...,.......<U..\|...<U......<.......F...>...F.......H5...&..H5..<...H5..O$..H5......f.......f...0$..f...:w..f...I...f...~e..f.......f......l...................H......;...............<.......OU...........`......`..........i......0T...e.......e..="...e..O.................y......~.......^....i.(4...KL.(4...K..(5...K..(5...K...y......y..s ..y.....T..O...0..%..*.0....+F...{..+F......+f......+f...B..+.z...u.+.....\|.+....s..+.......+.z.....+.......+....7g.+.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-FGH5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	778715
Entropy (8bit):	4.736389856040223
Encrypted:	false
SSDEEP:	6144:vlnjquU1Q5Cn8LSz0lr1cLMWgPnHQuq8OV9v+k+QEtLEJsG8v:VGQAnuSz0lr1cL7gPHY1vqtLEJsG8v
MD5:	956A9F069A88BA100BF1A1CB45DE6BAF
SHA1:	EE01FDADE022EB3A3388147300D0D89E082EA705
SHA-256:	B409655B5E12613EB84D9270E2AC88F521DA16A92D329F918273C2768DA12E01
SHA-512:	8127E0BD07F778C4E81A9F772F3FB1DD4D5A176702F7E35B8F9D3E2B862966F27632F43971F7A3531C23CC6DE8D02F995D40191B437F2584F0BB7848A2721CAF
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%.......%..0....%........CC...,.......,...z......."......~....0..G....1.......1.......1.......2.......2......3...u...4.......5.......5.......6.......6...>...7.......7...e...8...7...8......9......P..5....P.......m.......s..%z...s..-....s.......s..4....s..u....s...u...s.......s..5\|...s..9w...s..=.......~....@.......A...0...B...Z...C......D......E.......F.......G...,...H...V...I......P.......Q.......R...%...S...O...T...y...U......V.......W.......X...!...Y...K...`......a.......g...'...s..-....w...N...x..<....}..(....}..X........:......<...............................)2......X@......=Q......................=.......................=...............).......X.......).......>.......X........Q...............R...p../V...p..w........K.......m.......R.......................................$.............%a......7.......~E......3".......\..............C.......!.......^.......................'......w.......w..../.......;..g#...;..p2...;..x....;.......>...D...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-FM5NA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	759267
Entropy (8bit):	4.757797736314198
Encrypted:	false
SSDEEP:	3072:O+fbwQcS3LCMcExbHsholNmPp6cTk2SdWiiR9eI8vzXIlA5cRpDFfXOsN0DKiQbH:LzwQXLCFmHsJPp6cTk2+TuOKiFFgQGG8
MD5:	7FEB7B92A642B02503E17397A5DF5F5A
SHA1:	998BF9F529170C25B767592611A729F0D953CDC3
SHA-256:	57FB249277574A178EF1AD434ACB86EE3F57C3153DE5A3D414C4641D27C22CA1
SHA-512:	ABDE544ACD20218CFE1525D027469A7A127B0531A181E3AD2AF51DC2A5DC5990B047EDFC2F6FCBC94CAF87EEF5483C66EBE8432EAF5E46B840DC61692ABBF651
Malicious:	false
Preview:	<.d....!..`...B...H...%.../...%...n...%.......%.........9....,...=...,..................C....0...p...1...I...1..C....1.......2..D....2.......3...g...4.......5..G....5.......6..H=...6...0...7..H....7...W...8..H....8...~...9.......P..3)...P..i....m...'...s..#....s..$f...s.......s...a...s..S....s..o....s.......s......s...C...s...G......C....@.......A..."...B...L...C...v...D.......E.......F.......G.......H...H...I...r...P.......Q.......R.......S...A...T...k...U.......V.......W.......X.......Y...=...`.......a.......g..e....s...H...w..e:...x..9....}..&....}..T.......G.......9.......d.......e.......X.......'~......T.......:................)......:...............H.......:........$......'.......UC......(.......:.......Uj......}3.......O...........p..-V...p..b_......................]...............^9......^z......^........................I..............[........................z......&...............^......._=......_~......_.......7.......7#.../.......;..=....;..'....;../k...;..T<...>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-FUVH4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	781251
Entropy (8bit):	5.465254846157274
Encrypted:	false
SSDEEP:	12288:dCDKWLHDZX3LGa4jospOLLXjtB5BhwrjqzeQefScF0l8Xg3:yKWLHDZX3LGa4jospOLLXBfBhwrqXefk
MD5:	43BB5BFCA7D0784DD378C9E33C76827D
SHA1:	38A49A5CC87A92BE13FE7362B9B76D266FD338F3
SHA-256:	282DD70DC8004A6C6D15E9A45B5A6EE1E45AD4ADED0F981D363041C9EFBEF185
SHA-512:	72021EBB6795147F1DB5F4565323ADE6B1BA451E2FA0BBB4BD5E59F6B2E5E246419D8D674F159101AF7FF977F2C5ADE6C30F7162085F7E4165BA1CFFBF342776
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%...h...%..2....%...W...*..De...,.......,..6n.............../...0..P....1..9....1...N...1.......2...8...2......3...{...4.......5...=...5.......6.......6...D...7.......7...k...8...Y...8......9......P..4....P.......m...O...s..$....s..-....s...G...s..:i...s..~=...s...G...s.......s..>....s..B....s..G............@.......A...6...B...`...C......D......E.......F.......G...2...H...\...I......P.......Q.......R...+...S...U...T.......U......V.......W.......X...'...Y...Q...`......a.......g...w...s..4....w.......x..;....}..'....}..W........\......;........K......................(V......W>......<[......................<........;..............<........f......(.......W.......(.......=&......W........................Z...p...$...p..y.......!.......!%...............z.......................C.......p.............+k......=...............5&......................E.......3/.......\|.......................!.................../.......;..q....;..y....;.......;...x...>...(...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-H1VK5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	722680
Entropy (8bit):	5.145697786446383
Encrypted:	false
SSDEEP:	3072:esZ66YfZ4R61vIMeeS35iYNl4kdkWlz54+GxiqklnRGLlflKo8+Z8iQYiB2yoTC6:hZIWDMeAfWlz54+G02F6tlv/qJJ2ogm
MD5:	0D03464BF2387B8730A25D9E40333990
SHA1:	2152B2FFF08D066AE616FDA31678DC0551E73C5E
SHA-256:	F6D8E728BAB858EB52DAF06F18F3405880916D5631FF1F23A1E32371BD869AF6
SHA-512:	D05833BB454FBEB0A005881D4E32D90444E14383A8AB0FECF516DD8F5512ACEC99F02BCBBD84B07A6234CF01C730BCCE2701D7050DE80D973F8C75F33C8C4588
Malicious:	false
Preview:	<.d....!..`...B...H...%......%.......%......%..Cg.....,....,..a....,...........D...........0.......1...o...1...8...1.......2..."...2...~...3...I...4.......5.......5.......6...]...6.......7......7...9...8.......8...`...9.......P..1....P..;....m......s.."v...s.......s......s......s...W...s...5...s.......s.......s.......s...[...........@.......A.......B.......C...X...D.......E.......F.......G.......H......I...T...P.......Q.......R.......S...#...T...M...U...w...V.......W.......X.......Y.......`...p...a.......g.......s......w.......x..7....}..%V...}..Q...............8 ...............y..............%.......Q.......8........"......@}......8........M..............9 .......x......&Q......R9......&.......9P......Rb......k..............A....p..+....p..4.......b.......b........J.......r.............................................=.......................................X.......T......r........&.......]................................../..L....;......;.......;.......;......>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-H6S5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	738686
Entropy (8bit):	4.83015606506478
Encrypted:	false
SSDEEP:	3072:b2Zvix8AgM8YrQupAFRYuf4kiFa2Aw3DR/t8wuEjRJEgMyGaO+/qrF1KgPtgWn00:SZ6xpgMPnK8DDR/t8wuW3EmQgc0wgDId
MD5:	A04B2F2EF3A10E6B661177BCF357E3B8
SHA1:	CF7A49F6C1254871604D957881103E06F70E732F
SHA-256:	56F132CBB926AA9FC4FE358EEC747888F4F7822607B2B6BC2EF81BDD72ACA50E
SHA-512:	D9108E8E88F42F2F27F13DA2CCB0325DF784932C0FD6CACAC2C7F151C64DDB65577BF90349A87463D2F9EB9999EE1E8AB6C97A23FBAB39640A6C85E8B547842C
Malicious:	false
Preview:	<.d....!..`...B......%......%.......%.......%..n......3x...,..u_...,..........z...........0.......1...{...1...$...1..3f...2.......2..51...3..6....4..7w...5.......5..7....6...}...6..7....7.......7..7....8...-...8..8....9..8:...P..2....P..Of...m...>...s..#....s.......s...T...s......s..$E...s..7....s.......s......s......s..............@..3....A..3....B..3....C..4....D..45...E..4_...F..4....G..4....H..4....I..5....P..5X...Q..5....R..5....S..5....T..6....U..6...V..6T...W..6~...X..6....Y..6....`..7#...a..7M...g..-....s...P...w..-U...x..9....}..%....}..Sw.......0......9D......-.......-...............&.......S.......9........E......Y.......:........p..............:>.............&.......S.......'!......:n......T.......tF..............Z^...p..,....p..G........y...............C.......W...............................!..............................,'...............U...............N...............?.......~.......................i........../..f"...;.......;.......;...&...;.......>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-ID65J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	272162
Entropy (8bit):	4.7459161700235235
Encrypted:	false
SSDEEP:	3072:95UlcKkurNv0RHO9QAIDiOUi+E4V17/7dmdv/YX+7jAWACNZcrwaeIjWmjmvvAtD:95Ulczuwm7K7VEaLRi9CqIu
MD5:	4DB8350B485A3CC9FDDE9414B7A71D41
SHA1:	11A8BA80349EB4AE2F5B2E588D15319F46969A69
SHA-256:	5B9A8F5C43DF4EE6345A33706C530F6E508B00A70E87D7844230C594E614AE5D
SHA-512:	6A9D966BCB0564C1FE1C7C7FD54AD43F1BC81A74965480AB46368E492EA1E485CE7B53C8D62AE78DA8182589010B8E155E958FAF8F8B9136427F54C3A2B66FAD
Malicious:	false
Preview:	<.d....!..`...B..B....*..B....+.......@..\....A..]u...B..]....C..^c...D..^....E.._....F..`....G..`w...H..`....I..a\...P..b....Q..b....R..c{...S..c....T..di...U..d....V..e....W..f....X..fz...Y..f....]..h....t...................................e.......H...;..E....;..\@...;.......;.......;..m....M..h....O.......O.......[..............}..h....m..i...........(5..s7..+;..0...+;...`..+;...a..+O..0o..+O...0..1....-..E@..c...F...g\..H4...L..HY...I..H.......I...h...I@...B..IA...i..IC......J....Q..J....4..J.......J.......K...5`..LD......L.......PS......R....t..T.......Zr.....[`...}..[`..?...\....c..\......._......_......1....F...E...!......1................`......3u.......................Y...$...P...$.......[.......,...N...y.......y..........G........d.......9......4............9..............E..._...E...D...E..DM...............t...%..6?...%.................T......y......\|C......W...5.......0..E....0.......0.......0...2...0.......0..D....5...........}.. D...... D...?..+......,.......,

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-IJ9CM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	739337
Entropy (8bit):	4.898881923540837
Encrypted:	false
SSDEEP:	6144:tR8XzOKlAaefO7NPZwCHXPagH5grMoFcii:tnah7NPZwCHXPagH5grMoFcii
MD5:	5A881F3A6D73EF9BD699B66A2C951736
SHA1:	B2FE402E4FFB60CCDB48A93A689F882A2E67EE94
SHA-256:	76308EBC5E685CEC3A72C16473D0730F2364AA421591BB9E41FA505A7915A74F
SHA-512:	5F02568D7F22AF88AA5CB4883A62ED89B9D7A091409FA0774F21A1375E67B407A924407A09E0673972B230DAF4C76178BDC484AF41BE8FDFF2A8FFD09BB41E61
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%......%.......%..o......4....,..v....,..................!...0...$...1.......1...@...1..6....2......2..8`...3..:+...4..:....5.......5..:....6...[...6..:....7.......7..;....8.......8..;B...9..;i...P..3i...P..OD...m.......s..#....s...N...s.......s......s..&/...s..8....s.......s...<...s...A...s...9...........@..6....A..6....B..7....C..7:...D..7d...E..7....F..7....G..7....H..8....I..86...P..8....Q..8....R..8....S..9....T..9/...U..9Y...V..9....W..9....X..9....Y..:....`..:R...a..:\|...g...c...s...@...w.......x..9....}..&....}..T-..............:........7......................'>......TT......:........*......Z+......:........U..............;..............'.......T.......'.......;H......T.......t..............Z....p..-$...p..G........................z..............................%.....................................-........................l.......$.......+.......^...............................U.......w.../..f....;.......;.......;.......;.......>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-JO8M6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	241938
Entropy (8bit):	5.870741054265434
Encrypted:	false
SSDEEP:	3072:BrVGgmV6UCbr6mRNhUulGrZ/grQOmyuUIUIwc4aiJcjqziGf7YWuGGXnKUFmb:BrV4K60lGrVgrnmyAnO
MD5:	DC46BA63A4BD2BEDE32CAE3E0074D8A4
SHA1:	F6755583A8E117D67CE26CE0397CCFC312C6AC4A
SHA-256:	3D91DC8C203830055387EE2883DCE051C097B1878BDED7B02DE9133A90AA4BD7
SHA-512:	F99CA81696D9539A2E4CD93608AF85AEC6078D7263B257F9D3973EEAC191D3CAE6D814D5FA5376C36E56EB1C59A6EE85113C69C1E410E9790187408E5F46DE93
Malicious:	false
Preview:	<.d....!..`...B..IX...*..!....+...b......@....@..MW...A..M....B..NP...C..N....D..OF...E..O....F..Pp...G..P....H..Qc...I..Q....P..R....Q..S....R..S....S..Tz...T..T....U..Up...V..V....W..V....X..W....Y..W....]..T....t..........~^......~.......~.......z............;..9....;..J....;...z...;.......;..]t...;......M..T....O.......O..............}..U....m..U1......l...(5..b7..+;..(...+;......+;......+O..(W..+O......1...lm..E@..S...F...W...H4......HY.....H.......I...X...I@..~...IA..~1..IC......J.......J.......J....Z..J.......K...,...LD......L....i..PS...]..R...."..T...{...Zr......[`...F..[`......\.......\......._......._....)..1........-.......E..........)........3..1...@-..1...@.......n>......+............................$...f...[.......,...J...y.......y...-......:........Y.......x......+........0...9..............E.......E...R...E..#w.......[.......~...%..-?...%...m.......?.....FQ.....gZ.....i[.....l....5.......0..9....0.......0.......0.......0...u...0..#....5.............. D...R..

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-LJE9V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	766259
Entropy (8bit):	4.869516867795244
Encrypted:	false
SSDEEP:	6144:5WGJXTCj7zWa32WQCwmPe4wiERFzSKo/P:5WGlTCj7zWa32WQCwmPe4wiERFzi/P
MD5:	82862C3EE9A4ED7778BAD49391CF317E
SHA1:	63111839774F804AFCEB13CA9E2C4639F3604322
SHA-256:	F45665B3864F190A3945ECA4C522A9F72497439C799841C53D6C556FBAD1097A
SHA-512:	F50CF370ED890A5B38EE7828A380A96BD37F1B286068E3CEE090B902B10FEC1D42E3EDA0228CD20C970453E702347F0B04FF5FC44A3334DDD810A948B90073D3
Malicious:	false
Preview:	<.d....!..`...B...H...%...C...%...D...%..&t...%...e...*..>....,.......,...^..............Z....0..2\|...1.......1..Z....1.......2..[....2.......3.......4.......5..^....5...1...6..^....6...X...7.._C...7.......8.._....8.......9.......P..4M...P..q....m.......s..$....s..)d...s.......s..&'...s..d....s.......s.......s...F...s..._...s.. e......Zu...@... ...A...J...B...t...C.......D.......E.......F.......G...F...H...p...I.......P.......Q.......R...?...S...i...T.......U.......V.......W.......X...;...Y...e...`.......a.......g..wq...s...t...w..w....x..:....}..'....}..U_......^.......:.......wE......x.......lr......( ......U.......;C..............._......;..............._b......;...............(.......U.......(.......<.......U........s.......1...........p...2...p..j5.....................x...............y-......yf......y..............................(.......mG......(........<..............2p..............y.......z.......zJ......z.......O.......P..../...z...;..P....;..A....;..J....;..n....>...8...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-LLG8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	325046
Entropy (8bit):	4.5429647161067175
Encrypted:	false
SSDEEP:	3072:3MHO3hPf0ytzkorOV/kfW4AGcfiTrOp2MQXEdnengTtW7JgNECpCoawTJgzXC9P5:ckUiw15YV1+
MD5:	2471F28AEC9437725CC1580FCE142037
SHA1:	94E6BAA94B48B189D7F53441C0BFB7C0C9D9A916
SHA-256:	10FA8DDE9F4C9762E6EC20F71F863DB44ACA435AA1D46215F98F2CF9E88D84F7
SHA-512:	D6F88E2FB5B1961385790862ACD8710178A4DCA176E443A5BAEDDB52DFD5CBCD5DDA193C5CEC9896F6A8A76E6E53043C3903139E827C8E247AE834578699A8D5
Malicious:	false
Preview:	<.d....!..`...B..F...........+..7....@...D...A.......B...=...C......D...3...E.......F...=...G......H...0...I......P...X...Q.......R.......S...M...T.......U...C...V.......W...M...X.......Y...:...]..tu...t..=........................G..............Eb...;..N....;..e....;.......;.......;.......M..t....O..W....O..w....[..ut......f....}..t....m..t...........(5...0..+;..8...+;......+;...$..+O..8...+O......1.......E@...W..F......H4..8...HY..3...H...D:..I....y..I@......IA......IC..A...J...n...J...A...J...A...J.......K...=...LD..C...L...C...PS..K%..R...7...T.......Zr..c ..[`......[`......\...g...\...p2.._...h..._...x...1........E..........9........c......F.......;.......%r......;I......;....$..4....$.......[..=E...,..=....y..A...y..........O.......{........k......<.......A\...9..5........Q...E.......E..u....E.........B.......u>...%..>....%..(.......D.......8.............N......,...5..E6...0..N....0...u...0...{...0.......0..H....0.......5..J4......9... D...t.. D..2...+...R...,.......,

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-M7P7E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	582207
Entropy (8bit):	5.864166880176526
Encrypted:	false
SSDEEP:	12288:LsX0ZYu4Jckvla1Pue0kA3GECfkc1J5oMbYBLSu6/:Li0ZYVJFla1Pue0kA3GvdsGYBLSuu
MD5:	5AE114C0869A646A09B4214C9AAF3621
SHA1:	7011929391153D2AB684D3DD609ACC3ADFDDCF4B
SHA-256:	1748AF38A6EB093DF24A1D3217B0F0C796FC3B8B7FB5FDD63D3412C3538B114A
SHA-512:	BA1E85AC7C519CA73C4C7F52F5A40204502156365DA94C9744048C42D6C2BDCEB14F00122EFF2F8C7B840D40E515E7B081C5EFAF803EA5A82AAA3AA363ABA91B
Malicious:	false
Preview:	<.d....!..`...B...p...%.......%..F....%..h....%.............,...E...,..................9=...0.......1.......1..9\...1.......2..:F...2.......3.......4...S...5..<....5...\|...6..<....6......7..==...7.......8..=....8.......9... ...E.......P..&....P.......c.......m.......s.......s...[...s.......s.......s.......s.......s..)....s..E)...s..Hv...s..K.......8.......9....@...9...A...e...B......C......D.......E.......F...A...G...m...H......I.......P.......Q...F...R...r...S......T.......U.......V..."...W...N...X...z...Y......`.......a...'...g.......s...7...w...9...x..,....}.......}..Ct......<.......,L....................................C.......,........`......k.......-...............=\......-<......................C........%......-j......D.......D%..............l....p.."...p..........K........................[......................................m-......)n......................p..............j.......s........z.......O.......................F.......u...............7...................

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-MGK4P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	729762
Entropy (8bit):	4.8459179946671656
Encrypted:	false
SSDEEP:	6144:Z3svhfiwQxru1mFaZgCRx0rw54OLmpfU5iUv:Z3c481mAZgCRx0rw54OLmpfU5iUv
MD5:	CDEC9AA6C8FE06AB42DAB47D81CCF0B8
SHA1:	E36A41698627DC3830B059DD3DF49C53BC32FEE9
SHA-256:	8DB2254A80AE3396CD86992CE9FF03E84E2257264DADE7A59024E3AB90FC9373
SHA-512:	36CCA160A63B5328C46C8A41ADE5B98FD63FEDDBC9781CBEDE94950712AD82E37185AF3FE916EEEF8A0D7B8F09AAD7D57A7B7971539410DFC0E5F50E87D9FF28
Malicious:	false
Preview:	<.d....!..`...B......%......%...l...%.......%..X....*..-T...,..m5...,...6.......@...........0...X...1.......1.......1...J...2.......2.......3.......4...[...5.......5.......6...y...6.......7......7.......8...)...8.......9.......P..1....P..G....m.......s.."f...s.......s...n...s.......s...q...s..'....s...l...s.......s...%...s...............@...q...A.......B.......C.......D.......E...C...F...m...G.......H.......I.......P...<...Q...f...R.......S.......T.......U.......V...8...W...b...X.......Y.......`.......a...1...g.......s.......w.......x..8....}..%D...}..R........,......8H.......^......."..............%.......RF......8...............O%......9.......................9B.......A......&;......R.......&m......9r......R.......mb.......l......O....p..+....p..@{......w.......w................A.......:.......q..............#....... ...............t...... ................Y.......!.......................................Q..............?.......a.../..[....;.......;.......;.......;.......>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-NB9JK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	316133
Entropy (8bit):	4.739570774791439
Encrypted:	false
SSDEEP:	3072:iE/7H8vmq53jlEJ1SuP6L6oDsZ5qfaoT8SqGr5J0kAzTzU4wAJsORSWFS1eSwDdp:37kDJ6y+GrEkAzTzexZM86
MD5:	2209B357B61FE3B58C2688F9F1BFA342
SHA1:	34606D38B5273776C49471CF36FEC1663BC3F4B4
SHA-256:	38228CB9A25D36D5D0BB9B78876B411717CE8BEAE4E22F94FFD3F919E53F808D
SHA-512:	7664BB1EA9BB27E23D862E04B735FCC389EA2627F73FF2A0BFCC59068742369E8F03CA9CDAA823101E7C40A2C8CE5167A789CCB86F01655A03864F5DC3C335BF
Malicious:	false
Preview:	<.d....!..`...B..Ix...*.......+...I...........@.......A...2...B.......C...(...D.......E...V...F.......G...L...H.......I...9...P.......Q...o...R...h...S.......T...^...U.......V......W.......X.......Y.......]..l<...t...........................9.......>......!....;..I....;.._....;.......;..\|....;......;..P....M..ld...O..5"...O..S.......C....}..l....m..l...........(5.....+;..4z..+;...Y..+;......+O..4N..+O...)..1....v..E@......F....i..H4......HY......H... ...I....-..I@......IA......IC...r..J...Gw..J.......J....E..J.......K...9...LD.. 4..L... ...PS..'...R....q..T.......Zr..?...[`......[`......\...D...\...H..._...E..._...S...1........E..........5...........1....A..1...........5.......7T.......x.......b...$.......$.......[...$...,.......y.......y..........J.......R...............8v...........9...u...........E...F...E..Pc...E..........d......P....%..9....%...\......!p.............Q...............5..!....0..I\...0.......0..c....0..{....0..%j...0.......5..&........... D...... D......+

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-OBUUV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	767981
Entropy (8bit):	4.778358118439606
Encrypted:	false
SSDEEP:	6144:F3j5ZWy7CAZqB/dFRkIrlAYME/Z9Z2ft9CFuZ8Un:Fj5rCNFRkIrlAYMEx9Z2ft9CFuZ8Un
MD5:	87CEB6D8343A3BE450EEDD7315AFF398
SHA1:	79BFC99370737D9D64666C7569C9BFBC8F02F05B
SHA-256:	38685C58FA945577F9A29A3AE8675E1C4D5533E323502A98E36DDF20FF10839C
SHA-512:	254803D600B27C892EB02668AEBEB8357315539612BE0CF95920AF1C7A2CDF0630EC0176B078C879AC19DBCBA13B634B6AC7813A5EBFE5357B73AB62E0B78D17
Malicious:	false
Preview:	<.d....!..`...B...H...%...W...%.......%......%.........B....,.......,...V..............a....0..7....1.......1..a&...1.......2..b....2...b...3...-...4.......5..e!...5.......6..e....6.......7..e....7.......8..f=...8...D...9...k...P..5)...P..y....m...A...s..%....s..,....s.......s..'5...s..h....s...?...s.......s..!....s..%....s..).......`....@.......A.......B.......C...<...D...f...E.......F.......G.......H.......I...8...P.......Q.......R.......S.......T...1...U...[...V.......W.......X.......Y.......`...T...a...~...g..~c...s.. ....w..~....x..;....}..("...}..V.......e@......<.......~7......~.......u.......(.......W.......<.......................<...............e.......=........:......).......W_......)K......=H......W........o.......e.......Z...p.......p..qm...............!.......\.......................................^......................).......o.......,.......................8t...............X..............................U.......U3.../...\|...;..V....;..H....;..Q....;..u....>...Z...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-PDBUG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	729158
Entropy (8bit):	4.854619257659071
Encrypted:	false
SSDEEP:	6144:9pIYVvU26c3sg/vV5XQT2DpxGTqNcPoXXRTYSLxooKI:9pXvUrctV5XQT2DpxoFoHR0S5KI
MD5:	2F7BF4D51EF873B82DABB4E48A3128CE
SHA1:	2EB05F6157A2B503A6B1DF1051DBBDA045C52299
SHA-256:	0B676AFAD22414F56E7FCE88C2FD45105125D2E1834A9EE6E18F6C725BB3DA88
SHA-512:	197AB28EC792530646D8B04292806BD23A3E1BB02A0A3C1D9EA3C639D23DAC927F99ADAFE2DFE1CDC199002C798DB0B32ADC34EE54ECB0F547E39A6B87E6F934
Malicious:	false
Preview:	<.d....!..`...B......%...L...%...N...%...Z...%..W......,....,..l;...,...........0.......}...0.......1.......1......1.......2......2.......3...n...4.......5...{...5.......6.......6...7...7...+...7...^...8......8.......9.......P..1....P..F...m.......s.."R...s.......s.......s.......s.......s..%....s.......s.......s.......s...........]...@.......A...)...B...S...C...}...D.......E.......F.......G...%...H...O...I...y...P.......Q.......R.......S...H...T...r...U.......V.......W.......X.......Y...D...`.......a.......g...4...s......w...[...x..8,...}..%>...}..Q..............8\..............................%.......R.......8...............M]......9&.......4.......J......9V......._......&5......Rk......&g......9.......R.......l..............M....p..+....p..>.......w.......w;......................................<.......C.......Z..............................r.......................................s.............................._........../..Y....;...H...;.......;...P...;...k...>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-Q19TN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	769028
Entropy (8bit):	4.798193754177343
Encrypted:	false
SSDEEP:	6144:npAuEpc+4BNkBG88eMZc9ZBVN785Ws3DpvmApeKR:pAu7+4BNkBG88eMZc9ZJ78QgDpvMKR
MD5:	149127D37AAB0D4613279555077D2DA0
SHA1:	07C50B1D8ECBD8C49D800A93031D64EBED5D1432
SHA-256:	3263E105DE5EFE06CB3A2317585C3A0B7675F9186088EF59F32F8C8AB862D7D5
SHA-512:	EB327D12AE26B1879EC26382EC47C7ABF5BA49131DE6AFF52ADBB0BCC1EB78EF5D18F51CFF8107AB085D487492FCF0A72AFB01A2E8CEEC0A5EE9CC399F6B8E3C
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%.......%..'....%...c...*..@....,.......,..................^A...0..0....1.......1..^`...1.......2.._J...2.......3.......4...(...5..bG...5...O...6..b....6...v...7..b....7.......8..cc...8.......9.......P..4....P..s....m...}...s..$....s..+>...s.......s.."....s..c+...s...-...s.......s.......s.......s.. .......^!...@...>...A...h...B.......C.......D.......E.......F...:...G...d...H.......I.......P.......Q...3...R...]...S.......T.......U.......V.......W.../...X...Y...Y.......`.......a.......g..vq...s.......w..v....x..;....}..'....}..VO......bf......;.......vE......w.......m.......(H......Vv......<5.......p..............<...............c.......<...............(.......V.......(.......<.......V........................H...p...L...p..kW.......!.......C.......................U.......................P.......P.......E......%.......ks......)X...............z......0........................?.......x..............Va......V..../...:...;..O....;..J....;..S+...;..x....>...X...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-QP4OO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	716770
Entropy (8bit):	4.975781833595291
Encrypted:	false
SSDEEP:	12288:jhuHMS7eCPyi6Hv0L+P5ufwARBUNpGSfv9iYc:eMaeCPyi6H9yUNpHNe
MD5:	94B21B5BF369946448E57B0AB5FC837B
SHA1:	485EEA32EC2130E607B3D8DF49CA6A34A77FAC26
SHA-256:	C4CC34B47137FD310D7C3B1CFD0ED07AA7FABA8EFB02E2CAAD833D9178CF14E1
SHA-512:	4C1A84B08F6E0DA2A9AE64980E0072274D990AAF081579B641DB6B85DDBFC5A312FED7B770B63B17A19884F6E151C88B95FE239406C6DE459FC54E8C0D20C980
Malicious:	false
Preview:	<.d....!..`...B...H...%...;...%.......%......%..6e.....,....,..^=...,...........v.......A...0.......1.......1...`...1...%...2...J...2.......3......4...6...5...)...5...]...6......6......7.......7......8...E...8.......9.......P..2....P..7....m.......s..#X...s.......s...]...s...?...s.......s...]...s..xz...s...n...s...e...s.../.......!...@...L...A...v...B......C.......D.......E.......F...H...G...r...H.......I.......P.......Q...A...R...k...S......T......U.......V.......W...=...X...g...Y......`.......a.......g.......s...,...w.......x..8T...}..&4...}..Q........H......8................Y.............&.......Q.......8...............;+......9Z.....................9...............'+......R.......']......9.......R2......j...............;....p..,l...p..0y......Po......P........................................M.....................................k...................... .......`......`)...............................!.................../..G....;.......;.......;.......;.......>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-RFHBA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	596192
Entropy (8bit):	5.7773979726902756
Encrypted:	false
SSDEEP:	6144:9nMlJI/xOEOAQfB/A3bOfmVAma91gIktvhE:ClysAQfB/A3bOfIa91gbvhE
MD5:	DAEF57EE94CD826F09265F463128A37B
SHA1:	772E73EA7E2C9E4EDD0AB264D6592F7EE2E1DB5E
SHA-256:	29188DB31832FCEF0AA7C5F721081C76C6B10872ADC63A5943BE4E9C5D338C08
SHA-512:	56BD116D79BF7152C0F6D46E1687DAD6F0B65D5043DA59BFB13B439AB6BA40B44C27635113C4569B5E8A6274E99997D7F1DF908EB3E43D7064984F71C0036498
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%..J....%..nj...%..............,.......,...........(......uO...0.......1..8....1..un...1...m...2..vX...2...8...3.......4...~...5..x....5.......6..y/...6.......7..ys...7.......8..y....8.......9...A...P..,....P...~...m...G...s...N...s......s.......s......s..#1...s...!...s..[V...s..w....s..{....s..~A......u/...@.......A.......B.......C.......D...<...E...f...F.......G.......H.......I.......P..._...Q.......R.......S.......T.......U...1...V...[...W.......X.......Y.......`......a...T...g.......s......w.......x..1....}..!....}..GY......x.......1........W......................"V......Gz......2K......................2...............y.......2...............".......G.......".......3.......G............................p..'6...p..........................................................;......\(......*........U..............).......p.......w...............:........].......j..............................3.......U.../.......;...a...;.......;.......;......>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-RSB7O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	754415
Entropy (8bit):	4.818278055468074
Encrypted:	false
SSDEEP:	6144:7YKnUHlEdFmdFUknGBK7QtVOh5GmRCrJlkNBexel7GsZ15nY:22dYvUknGBK7QtobkrQNBexcrm
MD5:	3501FFC2E81C6CE9ADA078F1726AA5C9
SHA1:	33717EE922B2DE5608E3F494D60C72A22EEF9136
SHA-256:	4551006E9D4C577E619E1AA1213362FF930ABC29AB1DC0D06473A0BA29338717
SHA-512:	1D61E06CECB36578BA42AD38D978D6955E30CE67D766A9B4781324222A6C6BD2548ECAA6A462D2BF6F3D45D7C1D6508DB2A031ED6459F2F0C69BA452DA0B5F0E
Malicious:	false
Preview:	<.d....!..`...B......%.......%.......%...F...%.........9r...,.......,..................1+...0.......1.......1..1J...1..p....2..24...2..rm...3..t8...4..t....5..5Y...5..t....6..5....6..u....7..6....7..u(...8..6u...8..uO...9..uv...P..3....P..`(...m...z...s..$....s..$u...s.......s...u...s..D....s..^....s...j...s......s...C...s...5......1....@..p....A..p....B..q....C..qG...D..qq...E..q....F..q....G..q....H..r....I..rC...P..r....Q..r....R..r....S..s....T..s<...U..sf...V..s....W..s....X..s....Y..t....`..t_...a..t....g..T....s.......w..T9...x..:<...}..'....}..T.......5x......:l......S.......T.......F.......'.......U.......:........I......r.......;6.......t......6(......;f..............(.......U[......(9......;.......U.......{j..............s....p..-~...p..X.......................K-.............Kd......K.......K........u...............[..............L................W.......Y.......f..............L.......L@......Lw......L.......#.......#..../...L...;..-....;...y...;.......;..AY...>...O...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-SG47E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	116873
Entropy (8bit):	5.857267722602321
Encrypted:	false
SSDEEP:	1536:cUlil8W89nhEFu54ahkvOzHHSVuf8j2+/xc3lhnbsfdAoz/w:cU029hEFeLhkvOznSVHJG3lhn+djY
MD5:	CD8A1B786321B5C9A64B297EECA21585
SHA1:	FA96EC1E3AEB34F25E216BE88473F94528F75D87
SHA-256:	60A994185B605ADCC85FE02FD52C8475FDAF2B94D5387F08B379A34FDA7C40DD
SHA-512:	C7AA72BB62536101A92B60ED68905C69529DE9E728F861B29EBB73EA6708155836317C9AC3632AA230FAB8ECC47B6A17383BB234C6CFD5B1F851BCB43715F8CD
Malicious:	false
Preview:	<.d....!..`...B..+x...*...$...+...f...@.......A.......B.......C.......D.......E.......F...6...G.......H...)...I.......P...I...Q.......R.......S...>...T.......U...4...V.......W...\...X.......Y...I...]..2....;.......;..+=...;..7....;..~....;.......M..2....O...9...O...C..........}..3....m..3:..........(5...h..+;......+;..4...+;..:...+O......+O..4...1.......E@...H..F.......H4.....HY..I...H....o..I....l..J....C..J.......K.......LD......L.......PS.....Q.......R...ME..W.......Zr......[`...#..[`...,..\...j..._....9.._......1...;}..............5e.......4......AD..........$..J}...$.......,.......y..................q........@...................9..J.......:....E..4....E..............%...P...%..B......................s......#......?...0...r...0..6....0..{....0..~....0...<...0.......5...%...5...f.. D..9X.. D..H...+......,...:j..,.......<U..\|q..<U......<.......F...:...F.......H5......H5..9~..H5..I...H5......VE......f.......f.......f...7...f...Du..f...~I..f....;..f.......g.......l........

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-TT5E5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	781657
Entropy (8bit):	5.356208924748881
Encrypted:	false
SSDEEP:	3072:JmFdoVZ9YguXptvHzQXik+5VxFUcaZO1PbkWNeytBv0umWZFp7QBagLzf1eNRpDs:JmFi+5SeITWNeytBvCknpYn3l7x
MD5:	8FDDFF9559AB69D2D7019D50DD4DC303
SHA1:	9C7FB734B4B334285DE288CA3613DB49A2EF7129
SHA-256:	17BA9D80F25F1AF33FA2A613AFCEFBC345E9DBE7610300D418CD715BDABD7F86
SHA-512:	5C6AD38D0718061D8144C47C68EDF5AB09F4C25FCD05D7D25ADAEF9306B6781875CD1D4E9312BCE9AAD1C79862AB6C7255671B73423137993708E5EE25504409
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%.......%..8....%...c...*..E....,.......,..5................7...0..Of...1..6....1...V...1.......2...@...2.......3......4..."...5...Y...5...I...6.......6...p...7.......7......8...u...8......9.......P..4....P.......m.......s..$6...s../....s.......s..<-...s..}....s...W...s...j...s..<....s..@3...s..DK...........@...8...A...b...B......C......D.......E.......F...4...G...^...H......I......P.......Q...-...R...W...S......T......U.......V.......W...)...X...S...Y...}...`.......a.......g.......s..5<...w.......x..;....}..'\...}..V........x......;........q.......7.......n......'.......W.......<-...............9......<................(......<...............(_......W[......(.......=.......W........m.......#...........p..-....p..~.......!a......!........................!.......Z.............................-)......>z..............;........2..............I.......3........................>.......w.................../...n...;..oW...;..\|....;.......;...N...>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-UN1R5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	549524
Entropy (8bit):	5.80467059209665
Encrypted:	false
SSDEEP:	12288:CJCNex6Wu5h9A3aIiQJRyzesiBjC/aGNfgE:CIFWu5h9A3aIfJRyz/iBjQaGNfv
MD5:	BFF5742CBC7640E7769C7EDEEFB98BA0
SHA1:	FB8DF1A9EEAD0A7A6D548B619CE6B2B6FD7938A3
SHA-256:	FCDB9E4AE61AD82306DC97F9138A6C6A17AC6DCB218CE2126D37EB916B88CEA2
SHA-512:	79444D57EDEBE9363C1A0531F41C320DE11AB25D6EA4B2482C9C67939138CA12B31F5C4B42684051F34DF43D1BB12C9519E37531DF096CEE23F71D513553CCB2
Malicious:	false
Preview:	<.d....!..`...B...H...%..dY...%...v...%..=....%..~.......i...,.......,..H................7...0..Z....1...%...1...V...1..X....2...@...2..Zl...3..\7...4..\....5......5..\....6.......6..]....7...7...7..]'...8.......8..]N...9..]u...P..'....P..u....m...U...s.......s......s..a]...s.......s......s...]...s......s...f...s.......s...............@..X....A..X....B..Y....C..YF...D..Yp...E..Y....F..Y....G..Y....H..Z....I..ZB...P..Z....Q..Z....R..Z....S..[....T..[;...U..[e...V..[....W..[....X..[....Y..\....`..\^...a..\....g.......s... ...w.......x..-@...}.......}..A...............-p.......y.......)......C...............A.......-.......g.......6Y.......2......g........V.......`......h...............B5.......1..............BX..............h/......6....p..#6...p..n.......KO......Kq......;.......e.......;.......<.......<M......<6.......2.......e.....................?......n2......_...............V;......<\|......<.......<.......=..................../..?....;..oi...;...R...;.......;..4....>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-USII4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	70321
Entropy (8bit):	4.732298792495987
Encrypted:	false
SSDEEP:	768:DUdNA/xCFfW+WHAS0gMBd483+Y7bDPs4RQBloLUIltlzAJnx4nnliM1OPlOibLG:YdNAJCFP9SgmHJn+n4Mhj
MD5:	6E81C9DDF21A28DCAAC72ADF87C8BC31
SHA1:	698FA4F5D9482961CAF5022C03770A500F1F47CE
SHA-256:	47415191558C4EE4F61010D15EDE7BF46F9515DB685F1E8858C12FD06E900083
SHA-512:	85B1767E50BEF0B9D6E71B1D040E553B7534E6244C1C81158ED2F78C5E30A367BFDF8594FEE22AB59909C87A96D8F001BCC27DAE3D7B2765FA76669713B1491B
Malicious:	false
Preview:	<.d....!..`...B...(......6...+...b...]..7....;.......;..-....;..;....;..}8...;.......M..7,...O.......O...t...........}..7T...m..7\|..........+;......+;..8...+;..?9..+O......+O..8]..H4......H.......J......K.......LD...&..L....z..PS...i..Zr...?..[`...8..[`.....\...kR.._......._.......1...@4..............8...............E............,..................p........-...............s...........%...O...%..G........1...0.......0..:....0..y....0..\|....0.......0...U...5...\|...5...... D..=... D..K...+....I..,...>...,......<U..z...<U......<.......F...?...F.......H5...4..H5..>$..H5..L)..H5......f....p..f...2...f...;...f...I...f...\|E..f.......f.......l...................._......<...............>N......LZ...........`......`...\.......A......2D...e...g...e..>~...e..L.................y...)..y......y..o...y......T..L...0..'..*.0....+F...y..+F......+f......+f...C<.+.z..0U.+.....d.+....p-.+.....O.+.z..0..+.....u.+....8..+....C..+....M..+....y..+.....W.+......+...p`.+.....+....0..F0i.....G.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-UV0VL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	757139
Entropy (8bit):	4.8169732177115865
Encrypted:	false
SSDEEP:	3072:VQzfAcikS0NnOHCBTYwEEcOfPAi4j/9EblSxzReO1iUfR0ojVy0QJPU8cKlNpFTB:VQS7ClblSxzReTl9eSKrWKVTtvW
MD5:	27F7F23116E75240B4524FC4B32B7D9A
SHA1:	75FF53C06019C229C8084E18CBD23EA53E687672
SHA-256:	35E33400C17CB0D442468C4BB68F38A8B0E18DDAFBAC42034F6CEAE70E7DC842
SHA-512:	60B11682F9BD1CE02D30255E5A383812B17172EF782F90F99C5C43314C73142EED69BC02E41E50808F7CCAA706127674A167CA2358795FFC1E12BB88F637CEF2
Malicious:	false
Preview:	<.d....!..`...B......%.......%.......%...&...%.........<H...,.......,...z..............>9...0.......1.../...1..>X...1..{....2..?B...2..}Y...3...$...4.......5..B7...5.......6..B....6.......7..B....7.......8..CS...8...;...9...b...P..3/...P..c....m......s..#....s..''...s......s.......s..Io...s..b....s.......s.......s.......s..........>....@..{....A..{....B..\|....C..\|3...D..\|]...E..\|....F..\|....G..\|....H..}....I..}/...P..}....Q..}....R..}....S..}....T..~(...U..~R...V..~\|...W..~....X..~....Y..~....`...K...a...u...g..X6...s.......w..X]...x..9....}..&....}..U.......BV......9.......X.......X.......O.......' ......U:......:W.......w......u.......:...............C.......:...............'.......U.......'.......;.......U.......~...............vV...p..,....p..[.....................V[.......g......V.......V.......W.......................................Qa.......`...............I.......<.............WO......W.......W.......X......./......./..../.......;..2r...;.......;..(....;..Ls...>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-V7M5O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	736621
Entropy (8bit):	4.838981048693214
Encrypted:	false
SSDEEP:	3072:WsI7QblqDPtEInygks2Qm7BMtmbVLeYjl7IupQfmgoOubMe4lgNiWeOLycW9mD/q:W/KlutEQygk74lgNiWeE4mJlyRg6aQ
MD5:	910B8EEF9698812FD0061F075CDB0C5B
SHA1:	1290E166789B6A0544E454280EAC5229D731A6CB
SHA-256:	A3E94E40DE4E84E70A3AD8196D5C6C916AF591BF0340FC8651EA77D35D4411E9
SHA-512:	1FD81EAA5BC44541BE28294A4E971C780F9345AF54D99D27ACFAC2F9A2BF97C1BB81CEBFF7A943087AF7B724F9ADF3A49E6E5EC3C66E91C7ED8C4ED98A563FB0
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%...N...%...P...%..m....*..0....,..o....,...>.......j...........0.......1...!...1.......1..+....2.......2..-....3../K...4../....5.......5../....6.......6..0....7...M...7..0;...8.......8..0b...9..0....P..3]...P..I,...m...i...s..#....s.......s......s...3...s..$;...s..7....s.......s.......s...%...s...'...........@..+....A..,....B..,0...C..,Z...D..,....E..,....F..,....G..-....H..-,...I..-V...P..-....Q..-....R..-....S...%...T...O...U...y...V.......W.......X.......Y../!...`../r...a../....g..,....s.......w..-....x..9....}..&....}..S...............:"......,.......-........x......'8......S.......:........^......X.......:...............l......;..............'.......T.......'.......;L......T.......q...............X....p..-4...p..A................-.......z......................................^.......r.....................+........^.......\|.......j...............G.......N........................................../..d....;.......;.......;...3...;.......>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\is-VK7NB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	717598
Entropy (8bit):	5.446853092138487
Encrypted:	false
SSDEEP:	3072:DyRSPNZ1yv7lLOQRRABLE9jqlM79P6+WlP9gyI6tuTCTWgObD2HBviGp/BM5lOU7:GRkZCzRURi9P6+WlPiSIC9BuOUun2
MD5:	494CC6C2A9DD25258FFD581CB3BEC0B9
SHA1:	0349C46E380F00E958446D5A5EC95B18CC121050
SHA-256:	DCCC231D1A6FF0C404D3663DD5A48DA1E99001A63E7AE46D066675269AB8324B
SHA-512:	2351B4E6F9349DC85BAEE004E4E66A6A9B6DF2EEAD19A9C4F119457E88F20C0FFECFF78C755008F9CF7E473DEE66CF39754F1563046A387F60C23B5E8A3541B7
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%...l...%.......%..Ba...*.......,..^....,.......................0.......1.......1.......1.......2.......2.......3......4.......5.......5...=...6...7...6...d...7...{...7......8.......8......9.......P..2....P..8j...m.......s..#l...s.......s.......s.......s.......s...y...s..{l...s...T...s...q...s...]...........@...,...A...V...B......C......D.......E.......F...(...G...R...H...\|...I......P.......Q...!...R...K...S...u...T......U.......V.......W.......X...G...Y...q...`.......a.......g.......s.......w.......x..9>...}..&v...}..Sq..............9n.......................2......'.......S.......9...............9.......:8.......E.............:h.......p......'m......S.......'.......:.......T.......l[.............:\|...p..,....p..0......._K......_m.......`......................................P.......$.......g.......Z.......%.......".............................o........D.......{.................................../..G....;......;.......;.......;.......>...z...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_cs.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	319892
Entropy (8bit):	4.767219587801568
Encrypted:	false
SSDEEP:	3072:RLZTvkvfY+urkt7a62NLX378PVyUGrB9tLyOjCn+exsWy7zXBuonW1rkHoaL0lMO:lZ7k37tnGrfjCnGIE6
MD5:	ACAFCF356E7B47FC4C208C374C5DE162
SHA1:	A8002F2B3F81B83CB4B3BDA9BD04B899B58084E9
SHA-256:	BF5CAEF62F0AC62C30C3EA71D85AB487C608C2EBF64882661C72AC89B93A0C85
SHA-512:	43BA5C5DA13E68FEC2C8833735BF5E0C8B4DAC2189F1AE7B6F2437E3412A2123FF9DCF2C51067D0C4448FC60D1F122F746EDF4C864DB57E092382AE431EE7451
Malicious:	false
Preview:	<.d....!..`...B..I...........+...............@.......A.......B.......C...u...D.......E......F... ...G......H.......I......P...C...Q.......R......S...8...T......U.......V.......W...\...X.......Y...I...]..n=...t..".......................................:...;..J....;..`....;...S...;...[...;...>...;..X....M..ne...O..=+...O..Z.......J....}..n....m..n..........(5...#..+;..5...+;...N..+;...G..+O..5s..+O... ..1.......E@...B..F......H4......HY...u..H...)...I......I@...,..IA...Y..IC..&...J...Mb..J...&...J...&v..K...:d..LD..(s..L...(...PS..0...R.......T....]..Zr..G...[`......[`......\...LY..\...N..._...M..._...[y..1....D...-......E...'......6...........1.......1....w......GK......8........Q...... A...... ....$.......[.."+...,.."....y..&.......L.......X........w......9.......&L...9...........v...E...C...E..XV...E..........'.......X....%..;=...%..........).......k.............u......E...5..*....0..J....0.......0..ie...0.......0..-....0...9...5../...........+...7...,.......,...YU..<

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_cz.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	245782
Entropy (8bit):	4.744175123778099
Encrypted:	false
SSDEEP:	3072:paJuNFuNUJahLGrSWOyunang7zrBZinW1rQHLGnMXvg3zLNTPb0XJ8P1YUPfhpir:l2Gretn1pnk
MD5:	4846BFF2909876AEE69442D423767E9D
SHA1:	7789D78509F1D5433984A44A83C9A25221C2CAD3
SHA-256:	A8EABABA209526A964F46481C10AE36B6B6BCB35EB905E864FF25B463DEF1682
SHA-512:	7BCD77C6587A95E1181E010D4834D63D9A18E9612286AB7AD4F38209F717E779E5B734587B4E555EAAFA2D5730075C72C3DD701C71939D4669508FD049E2CB5F
Malicious:	false
Preview:	<.d....!..`...B..8P...*...)...+..jk...@...&...A.......B.......C.......D.......E.......F...E...G.......H...8...I.......P...h...Q.......R.......S...]...T.......U...S...V.......W.......X.......Y...n...]..Pt......P.......Q.......Q4......Lc...;..,....;..B....;..U....;.......;..%o...M..P....O..v....O.......[..........\|....}..P....m..P.......7...(5..+...+;......+;..R...+;..Y...+O...x..+O..R...1...7{..E@...g..F.......H4..j...HY..pg..H...n...I.......I@..P...IA..P...J....-..J...m...K....i..LD..n...L...nk..PS..pX..R...t...T...M...Zr..\|...[`..a...[`......\......._...}..._....9..1...Z....-......E..\...............S.......<...............d.......j....$..qv...,..k................\......................mf...9..q.......X....E..Q....E.......E..........m........J...%...B...%..f.......o ............1......3......7....0..,....0..U....0.......0...a...0..o....0...4...5..o...+...u&..,...YP..,.......<U...f..<U..v...<...v...F...Y...F....>..H5......H5..X...H5..o...H5......H5..X...H5..Y...L...W/..VE..4...f

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_da.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	119822
Entropy (8bit):	4.818787346123787
Encrypted:	false
SSDEEP:	1536:/9MHYT6dryoYFB2G7RvGL1zGr+BZtQFnZUkXU:/ZT6dryoYFB2G7VGL1zGreZuFnZU+U
MD5:	C3B7C06921CD596DE02EC1D9F6DD6F11
SHA1:	F088066428B184CBC7CDD9969BB47F63EF54DF2B
SHA-256:	0728999FFA1E9980586C59930207F231D74A600E28B1C46B27733CE8FA995D92
SHA-512:	5F903E0CDA8AEFECEB59CA0663C640D39997E117D06E76E75BB08339854B23608FE7D1D27F82DB29FCFAC32E27C1C4D6760E2BEAA370AE6DFD4B0FB4D1DB3F87
Malicious:	false
Preview:	<.d....!..`...B..&8...*..z....+..,5...@...k...A.......B.......C...k...D.......E...)...F...~...G.......H...'...I...z...P.......Q...h...R.......S...h...T.......U.......V...{...W.......X...$...Y...w...]..F....;..'H...;..</...;..K....;.......;.......M..F0...O..7V...O..F.......;....}..FT...m..Fx.......7..(5......+;......+;..H-..+;..N...+O......+O..G...1.......E@......F.......H4..,T..HY..b_..H...0,..I....f..J.../6..J..._T..K....?..LD../...L.../...PS..1...Q...d...R...f4..W...n...Zr..;:..[`..$...[`..y...\......._...<..._...GR..1...O....E..Q\..............H........t......XC......,u...$..cb...$..\m...,..-....y..^.......(a..............S.............../....9..c.......N....E..G....E..\|X....../{...%.......%..Z"......0t......'........................0..'....0..J]...0.......0...E...0..0....0..\|....5.......5..1'.. D..M4.. D..aQ..+...5...,...Nj..,...E...<U...i..<U..7...<...74..F...N...F...E7..H5......H5..M^..H5..a...H5......VE......f.......f...@L..f...K9..f...\>..f.......f.......f...S...g....T..l

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_de.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	325046
Entropy (8bit):	4.5429647161067175
Encrypted:	false
SSDEEP:	3072:3MHO3hPf0ytzkorOV/kfW4AGcfiTrOp2MQXEdnengTtW7JgNECpCoawTJgzXC9P5:ckUiw15YV1+
MD5:	2471F28AEC9437725CC1580FCE142037
SHA1:	94E6BAA94B48B189D7F53441C0BFB7C0C9D9A916
SHA-256:	10FA8DDE9F4C9762E6EC20F71F863DB44ACA435AA1D46215F98F2CF9E88D84F7
SHA-512:	D6F88E2FB5B1961385790862ACD8710178A4DCA176E443A5BAEDDB52DFD5CBCD5DDA193C5CEC9896F6A8A76E6E53043C3903139E827C8E247AE834578699A8D5
Malicious:	false
Preview:	<.d....!..`...B..F...........+..7....@...D...A.......B...=...C......D...3...E.......F...=...G......H...0...I......P...X...Q.......R.......S...M...T.......U...C...V.......W...M...X.......Y...:...]..tu...t..=........................G..............Eb...;..N....;..e....;.......;.......;.......M..t....O..W....O..w....[..ut......f....}..t....m..t...........(5...0..+;..8...+;......+;...$..+O..8...+O......1.......E@...W..F......H4..8...HY..3...H...D:..I....y..I@......IA......IC..A...J...n...J...A...J...A...J.......K...=...LD..C...L...C...PS..K%..R...7...T.......Zr..c ..[`......[`......\...g...\...p2.._...h..._...x...1........E..........9........c......F.......;.......%r......;I......;....$..4....$.......[..=E...,..=....y..A...y..........O.......{........k......<.......A\...9..5........Q...E.......E..u....E.........B.......u>...%..>....%..(.......D.......8.............N......,...5..E6...0..N....0...u...0...{...0.......0..H....0.......5..J4......9... D...t.. D..2...+...R...,.......,

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_es.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	82411
Entropy (8bit):	4.655370826193561
Encrypted:	false
SSDEEP:	768:MBPRwNbCU55EUhmSggY+OpHFK6VxAfo1yDgESILETBfv66z:YRwNeAEEm86vdES4ka6z
MD5:	2DB9055A56027C4D0A5A29A4161A97ED
SHA1:	C06C716ED01996E745EC883EF963E2725260E94F
SHA-256:	821C7F609C01435F38CC8E99B4EBCD9F2C4F52951E9E1051AD7927E745B62BA5
SHA-512:	874AEB92D6C3C77E5EE09B6F84917EF1B98638D90FC05CE9B371BDF4A783CB94FE5715617211480D5677885E9DFE066B31BCE670DEBF26E7D3EC6479CB91B490
Malicious:	false
Preview:	<.d....!..`...B..........G...+.......]..9....;.......;..0D...;..?....;.......;.......M..9....O.......O...H.......`...}..9....m..:...........+;...!..+;..<...+;..C:..+O......+O..;...H4......H.......J......K.......LD...&..L....z..PS.....Zr.....[`.....[`......\...v..._....W.._.......1...DA.......K......<s..............J........6...,...................s.......8.......a.......w......Bu...E..:....E...............%.......%..M........1...0...c...0..>i...0.......0...u...0.......0...9...5.......5...... D..A... D..T...+....'..,...B...,....~..<U...X..<U......<.......F...C...F......H5......H5..A...H5..Ul..H5...&..f....l..f...4...f...?M..f...O...f.......f....f..f.......l....................`......@...............A.......U............`.......`...W.......}......4....e.......e..B....e..U..................y......~.......^....O.(4...Qd.(4...Q..(5...Q..(5...R...y......y..~...y......T..V...0..)..*.0.....+F......+F......+f....U.+f...H..+.z..2..+.....$.+.......+.....X.+.z..3..+.......+....<9.+.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_fr.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	250219
Entropy (8bit):	4.661904577001558
Encrypted:	false
SSDEEP:	3072:1U80lV42Wr7BimRORiaGrh9zK4uMM8Ya/0z6nRiRa:1U80lwRaGrXzKAXHf
MD5:	45683D9E2E7FB8C23C6E309EB66F9A7E
SHA1:	683824690D55227C1848AA274FBA40ED76E44B50
SHA-256:	A83C107893CE1DBD85BC01520E132C78ADD21A2B33271661950CCECC2A04CD58
SHA-512:	4AE1A835F52742786B0888E352311313D0492E9FFBA6813317A48F37A93EAF829C40FE294DA7253A420E86BA22A78A3D13A93260265FC0AB743A5790BA1253AC
Malicious:	false
Preview:	<.d....!..`...B..=.......~...............,......(...+.......@.......A.......B.......C......D.......E......F.......G...v...H.......I...[...P.......Q......R...x...S.......T...f...U.......V...h...W.......X...S...Y.......]..n....t...j......................................%...;..J....;..am...;.......;...j...;...E...M..n....O..6....O..S....[..Qz......D....}..n....m..o...........(5...d..+;..4...+;......+;......+O..4...+O...b..1....b..E@......F....5..H4...j..HY...V..H...#...I.......I@...W..IA......IC..!...J...J!..J...!...J...!`..K...9...LD..#/..L...#...PS..)...R.......T....Z..Zr..A...[`...W..[`...]..\...F3..\...K..._...Gy.._...T...1........-.......E..........5...............7............................$...a...[.......,.......y..!.......L.......V.......v.......8.......!6...9...........P...E...k...E..Q....E..........".......QD...%..:....%..........${.............9...............5..%....0..J....0...&...0..g....0.......0..'....0...K...5..(...........+...0...,.......,...R...<U..g...<

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_gm.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	320883
Entropy (8bit):	4.544804624700274
Encrypted:	false
SSDEEP:	3072:ED0sUhPf0ftz5orOV/kLW4AGFfR4xpuMXXEdniqgitW4hgoVLpCoaw+NgzXCTPna:EAs/ulpNY9ni
MD5:	58E3AAE4BE7F9D3018FD9EEA0C793255
SHA1:	77BF1E7D381A4129D4216063DF64577A353607C6
SHA-256:	893C6C6F8D6C7785AAF22432442C66901BFEE9F3FD35C45978215319A2843CAA
SHA-512:	FEB5F38A5C9CD3DEF8E74A93A7C64CE0EBC66AFB6AD585BF04736635CAA2D1B04B4D035C301850A3F66753027E6849E447A37DA94FAF051524F4782BF227F314
Malicious:	false
Preview:	<.d....!..`...B..F.......[...+..)I...@.......A...k...B.......C...a...D.......E...k...F.......G...a...H.......I...N...P.......Q......R...{...S.......T...q...U.......V...{...W.......X...n...Y.......]..r....t../........r..............................6....;..MZ...;..d....;.......;.......;......M..r....O..IH...O..i....[..f.......WR...}..r....m..s&.......G..(5......+;..7l..+;......+;......+O..7>..+O......1......E@......F....X..H4.....HY..'$..H...5...I...."..I@......IA...E..IC..3"..J...a...J...3I..J...2...J....]..K...<=..LD..4...L...5F..PS..<r..R...+...T....a..Zr..Tw..[`.. ...[`...h..\...X...\...cF.._...Z..._...i...1........E..........8........+......6.......:T..............,.......,z...$..(7...$...%...[.......,../_...y..2....y..........N.......m...............;.......2....9..(............E.......E..f/...E..........4.......fc...%..=2...%...4......62..............................5..6....0..M,...0...=...0.......0...>...0..:2...0...l...5..;.......,... D...<.. D..&...+...C...,.......,

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_hb.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	25666
Entropy (8bit):	5.381958813501669
Encrypted:	false
SSDEEP:	384:X4Hoq2FErfRHMuktdYKBN8IgnEQ0P8ghbVruptRs6Mtu/hp2qfrnw:X0uE7RHMlrYKBN1gnEQ0P8gVk6uX2V
MD5:	D240F6D1578B001A16268F0A1C87BFA2
SHA1:	D9C381FB6DC853A491778FEF4F1FB18FC06AA314
SHA-256:	93C5D756EBEF1A96313F6C35E24FC944C3FF4E264D01D8EA52537654E88C4907
SHA-512:	A8E316B4A256E0F0F96DB1BE2478EF7E1A133D042FF647F07A0CCDE6EFC0FB54B31732D8DE12EABC9B925E15831B3A58536BA080B0C32333881043DB26A1DD78
Malicious:	false
Preview:	<.d....!..`...B.......+..@....;...o...;.......;.. ....;..2l...;..;....O..C....O..G.......F...+;......+;...v..+;.."...+O......+O...H..H4..@...H...B...J...A...K....2..LD..BM..L...B...PS..CC..Zr..E..._...F=.._...H>..............................#.......@.......................I#..............A.......B#...%.......%..$....0...C...0.. ....0..0u...0..2@...0..B....0..J....5..2....5..C...+...C...H5...k..H5..!f..H5..&...H5..3...f.......f.......f...!...f...&...f...2...f...?...f...I...l...Dv......I.......J6......!5..............!.......&............................e.......e..!....e..' .....J......Ja...y..5S..y......y..-...y..H^..T..'O.+F.../..+F...K..+f......+f..."..+.z.....+.......+.....Y.+....H..+.z...*.+.....q.+.......+....#+.+....'~.+....0..+....K..+....,.+......+...H..+.....`.Hw9.....Hw9.. ..J+....X.J6......J6....;.J6... r.J6...!..J6...0F.J6...1..J6...=..J6...LR.LZ...Bt.L.....,.L.....f.L.b.....O\|......PFE...A.PFE..1?.PFE..L..T.....W.V1...;..V1...>..Vl......V....D..W.T..;..W.T..>\|.W.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_he.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	25666
Entropy (8bit):	5.381958813501669
Encrypted:	false
SSDEEP:	384:X4Hoq2FErfRHMuktdYKBN8IgnEQ0P8ghbVruptRs6Mtu/hp2qfrnw:X0uE7RHMlrYKBN1gnEQ0P8gVk6uX2V
MD5:	D240F6D1578B001A16268F0A1C87BFA2
SHA1:	D9C381FB6DC853A491778FEF4F1FB18FC06AA314
SHA-256:	93C5D756EBEF1A96313F6C35E24FC944C3FF4E264D01D8EA52537654E88C4907
SHA-512:	A8E316B4A256E0F0F96DB1BE2478EF7E1A133D042FF647F07A0CCDE6EFC0FB54B31732D8DE12EABC9B925E15831B3A58536BA080B0C32333881043DB26A1DD78
Malicious:	false
Preview:	<.d....!..`...B.......+..@....;...o...;.......;.. ....;..2l...;..;....O..C....O..G.......F...+;......+;...v..+;.."...+O......+O...H..H4..@...H...B...J...A...K....2..LD..BM..L...B...PS..CC..Zr..E..._...F=.._...H>..............................#.......@.......................I#..............A.......B#...%.......%..$....0...C...0.. ....0..0u...0..2@...0..B....0..J....5..2....5..C...+...C...H5...k..H5..!f..H5..&...H5..3...f.......f.......f...!...f...&...f...2...f...?...f...I...l...Dv......I.......J6......!5..............!.......&............................e.......e..!....e..' .....J......Ja...y..5S..y......y..-...y..H^..T..'O.+F.../..+F...K..+f......+f..."..+.z.....+.......+.....Y.+....H..+.z...*.+.....q.+.......+....#+.+....'~.+....0..+....K..+....,.+......+...H..+.....`.Hw9.....Hw9.. ..J+....X.J6......J6....;.J6... r.J6...!..J6...0F.J6...1..J6...=..J6...LR.LZ...Bt.L.....,.L.....f.L.b.....O\|......PFE...A.PFE..1?.PFE..L..T.....W.V1...;..V1...>..Vl......V....D..W.T..;..W.T..>\|.W.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_hg.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	272162
Entropy (8bit):	4.7459161700235235
Encrypted:	false
SSDEEP:	3072:95UlcKkurNv0RHO9QAIDiOUi+E4V17/7dmdv/YX+7jAWACNZcrwaeIjWmjmvvAtD:95Ulczuwm7K7VEaLRi9CqIu
MD5:	4DB8350B485A3CC9FDDE9414B7A71D41
SHA1:	11A8BA80349EB4AE2F5B2E588D15319F46969A69
SHA-256:	5B9A8F5C43DF4EE6345A33706C530F6E508B00A70E87D7844230C594E614AE5D
SHA-512:	6A9D966BCB0564C1FE1C7C7FD54AD43F1BC81A74965480AB46368E492EA1E485CE7B53C8D62AE78DA8182589010B8E155E958FAF8F8B9136427F54C3A2B66FAD
Malicious:	false
Preview:	<.d....!..`...B..B....*..B....+.......@..\....A..]u...B..]....C..^c...D..^....E.._....F..`....G..`w...H..`....I..a\...P..b....Q..b....R..c{...S..c....T..di...U..d....V..e....W..f....X..fz...Y..f....]..h....t...................................e.......H...;..E....;..\@...;.......;.......;..m....M..h....O.......O.......[..............}..h....m..i...........(5..s7..+;..0...+;...`..+;...a..+O..0o..+O...0..1....-..E@..c...F...g\..H4...L..HY...I..H.......I...h...I@...B..IA...i..IC......J....Q..J....4..J.......J.......K...5`..LD......L.......PS......R....t..T.......Zr.....[`...}..[`..?...\....c..\......._......_......1....F...E...!......1................`......3u.......................Y...$...P...$.......[.......,...N...y.......y..........G........d.......9......4............9..............E..._...E...D...E..DM...............t...%..6?...%.................T......y......\|C......W...5.......0..E....0.......0.......0...2...0.......0..D....5...........}.. D...... D...?..+......,.......,

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_hu.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	272162
Entropy (8bit):	4.7459161700235235
Encrypted:	false
SSDEEP:	3072:95UlcKkurNv0RHO9QAIDiOUi+E4V17/7dmdv/YX+7jAWACNZcrwaeIjWmjmvvAtD:95Ulczuwm7K7VEaLRi9CqIu
MD5:	4DB8350B485A3CC9FDDE9414B7A71D41
SHA1:	11A8BA80349EB4AE2F5B2E588D15319F46969A69
SHA-256:	5B9A8F5C43DF4EE6345A33706C530F6E508B00A70E87D7844230C594E614AE5D
SHA-512:	6A9D966BCB0564C1FE1C7C7FD54AD43F1BC81A74965480AB46368E492EA1E485CE7B53C8D62AE78DA8182589010B8E155E958FAF8F8B9136427F54C3A2B66FAD
Malicious:	false
Preview:	<.d....!..`...B..B....*..B....+.......@..\....A..]u...B..]....C..^c...D..^....E.._....F..`....G..`w...H..`....I..a\...P..b....Q..b....R..c{...S..c....T..di...U..d....V..e....W..f....X..fz...Y..f....]..h....t...................................e.......H...;..E....;..\@...;.......;.......;..m....M..h....O.......O.......[..............}..h....m..i...........(5..s7..+;..0...+;...`..+;...a..+O..0o..+O...0..1....-..E@..c...F...g\..H4...L..HY...I..H.......I...h...I@...B..IA...i..IC......J....Q..J....4..J.......J.......K...5`..LD......L.......PS......R....t..T.......Zr.....[`...}..[`..?...\....c..\......._......_......1....F...E...!......1................`......3u.......................Y...$...P...$.......[.......,...N...y.......y..........G........d.......9......4............9..............E..._...E...D...E..DM...............t...%..6?...%.................T......y......\|C......W...5.......0..E....0.......0.......0...2...0.......0..D....5...........}.. D...... D...?..+......,.......,

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_ja.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	247853
Entropy (8bit):	5.798108239451114
Encrypted:	false
SSDEEP:	3072:NIXTvr0ldksJUFoSpYKM0vTfWnhhoHGrPh4RFYgI+hvleXaKWNfh4hcZqTa6nCbj:NGvr0ldrSNHGr54xlld
MD5:	44280D64462790DCAF670760324D15B2
SHA1:	BC9D0D77892BD016B5AE2504AF4F152D6693B496
SHA-256:	09EE3A79598B88540ED04F9FE5027E0BB8DF501798024B91A95A6D7B11154861
SHA-512:	3C50EBAEBC6BB95BBAD3F5D688B80C97156523262A425E5222CF7856183EC7F42ECADC5F7613728BD3BFB1F7ABA5066E43DF2E67F15186942359D9AEFF024EB0
Malicious:	false
Preview:	<.d....!..`...B..IX.....:....+...S......Z7...@..a`...A..a....B..bU...C..b....D..cG...E..c....F..dk...G..d....H..eZ...I..e....P..f~...Q..f....R..g....S..hk...T..h....U..i]...V..j....W..j....X..j....Y..kj...]..Wk...t...1.......E.......o...............V...........;..;....;..Mn...;...`...;../....;..q....;......M..W....O.......O.............}..W....m..W...........(5..v...+;..)...+;......+;.....+O..)...+O...w..1.......E@..gy..F...k...H4......HY...\..H.......I...l...I@......IA......IC......J....L..J.......J.......J.......K...-...LD...^..L.......PS...&..R....3..T.......Zr......[`......[`..8...\.......\....p.._......._....(..1....}...E.....................1...Y...1...Y........-......,Q...............$...........$...G...$.......[.......,.......y...[...y..........<................s......-?...........9..............E.......E...M...E..<................y...%.......%................Y......{......}.......>...5.......0..;_...0......0.......0../....0...L...0..<....5..._.......... D...6..

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_ko.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	241938
Entropy (8bit):	5.870741054265434
Encrypted:	false
SSDEEP:	3072:BrVGgmV6UCbr6mRNhUulGrZ/grQOmyuUIUIwc4aiJcjqziGf7YWuGGXnKUFmb:BrV4K60lGrVgrnmyAnO
MD5:	DC46BA63A4BD2BEDE32CAE3E0074D8A4
SHA1:	F6755583A8E117D67CE26CE0397CCFC312C6AC4A
SHA-256:	3D91DC8C203830055387EE2883DCE051C097B1878BDED7B02DE9133A90AA4BD7
SHA-512:	F99CA81696D9539A2E4CD93608AF85AEC6078D7263B257F9D3973EEAC191D3CAE6D814D5FA5376C36E56EB1C59A6EE85113C69C1E410E9790187408E5F46DE93
Malicious:	false
Preview:	<.d....!..`...B..IX...*..!....+...b......@....@..MW...A..M....B..NP...C..N....D..OF...E..O....F..Pp...G..P....H..Qc...I..Q....P..R....Q..S....R..S....S..Tz...T..T....U..Up...V..V....W..V....X..W....Y..W....]..T....t..........~^......~.......~.......z............;..9....;..J....;...z...;.......;..]t...;......M..T....O.......O..............}..U....m..U1......l...(5..b7..+;..(...+;......+;......+O..(W..+O......1...lm..E@..S...F...W...H4......HY.....H.......I...X...I@..~...IA..~1..IC......J.......J.......J....Z..J.......K...,...LD......L....i..PS...]..R...."..T...{...Zr......[`...F..[`......\.......\......._......._....)..1........-.......E..........)........3..1...@-..1...@.......n>......+............................$...f...[.......,...J...y.......y...-......:........Y.......x......+........0...9..............E.......E...R...E..#w.......[.......~...%..-?...%...m.......?.....FQ.....gZ.....i[.....l....5.......0..9....0.......0.......0.......0...u...0..#....5.............. D...R..

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_pl.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	316133
Entropy (8bit):	4.739570774791439
Encrypted:	false
SSDEEP:	3072:iE/7H8vmq53jlEJ1SuP6L6oDsZ5qfaoT8SqGr5J0kAzTzU4wAJsORSWFS1eSwDdp:37kDJ6y+GrEkAzTzexZM86
MD5:	2209B357B61FE3B58C2688F9F1BFA342
SHA1:	34606D38B5273776C49471CF36FEC1663BC3F4B4
SHA-256:	38228CB9A25D36D5D0BB9B78876B411717CE8BEAE4E22F94FFD3F919E53F808D
SHA-512:	7664BB1EA9BB27E23D862E04B735FCC389EA2627F73FF2A0BFCC59068742369E8F03CA9CDAA823101E7C40A2C8CE5167A789CCB86F01655A03864F5DC3C335BF
Malicious:	false
Preview:	<.d....!..`...B..Ix...*.......+...I...........@.......A...2...B.......C...(...D.......E...V...F.......G...L...H.......I...9...P.......Q...o...R...h...S.......T...^...U.......V......W.......X.......Y.......]..l<...t...........................9.......>......!....;..I....;.._....;.......;..\|....;......;..P....M..ld...O..5"...O..S.......C....}..l....m..l...........(5.....+;..4z..+;...Y..+;......+O..4N..+O...)..1....v..E@......F....i..H4......HY......H... ...I....-..I@......IA......IC...r..J...Gw..J.......J....E..J.......K...9...LD.. 4..L... ...PS..'...R....q..T.......Zr..?...[`......[`......\...D...\...H..._...E..._...S...1........E..........5...........1....A..1...........5.......7T.......x.......b...$.......$.......[...$...,.......y.......y..........J.......R...............8v...........9...u...........E...F...E..Pc...E..........d......P....%..9....%...\......!p.............Q...............5..!....0..I\...0.......0..c....0..{....0..%j...0.......5..&........... D...... D......+

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_po.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	297997
Entropy (8bit):	4.731879893547073
Encrypted:	false
SSDEEP:	3072:Fd60ieujdEJ1SRPHLjDVNtaVoT8ROGrBJ09TKdGpmJuO6SWFS1eSwDdOFyJZzHO+:Fo0ihhDGr89TKgpFM9w
MD5:	DFACC951255AB47C9409202225758674
SHA1:	A83B523FE49FD673572C24293D2CA72E9BEA2D63
SHA-256:	7F3488A52C5710D45FC7BD3D688420562667A56868C8BF163053DD0296607C3D
SHA-512:	5778CF4D2FAA86599CB6A5FD1EEA43A8DEA0B9BCEB065BF615F7964419FDA2CC4D0A7F7F539277F3215EF0B81BE461B8AA4F8D0B8CEFFC28147F6E8CF5870CE5
Malicious:	false
Preview:	<.d....!..`...B..E...........+.......@.......A.......B...{...C.......D...q...E...$...F.......G.......H.......I.......P.......Q...=...R...6...S.......T...,...U.......V...Z...W.......X...M...Y.......]..i....t...........W................................;..G....;..]f...;.......;..f....;...a...M..i....O...p...O..3I...[..1.......#....}..j....m..j/..........(5...P..+;..2...+;.....+;......+O..2...+O.....1....D..E@......F....7..H4...z..HY...m..H.......I.......I@......IA.....IC...W..J...2q..J....~..J....*..J...h...K...7j..LD......L....m..PS......R.......T....4..Zr..!...[`...I..[`... ..\...$...\...3..._...&..._...3...1........E..........3........&..............5....................$.......$..d....[.......,...h...y.......y..g.......H.......=l......T.......6............9...............E......E..0....E...........I......0....%..8A...%...........U..........................n...5.......0..G....0... ...0..M?...0..e....0...O...0.......5.............. D...3.. D...W..+.......,....}..,...1...<

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_pt.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	70321
Entropy (8bit):	4.732298792495987
Encrypted:	false
SSDEEP:	768:DUdNA/xCFfW+WHAS0gMBd483+Y7bDPs4RQBloLUIltlzAJnx4nnliM1OPlOibLG:YdNAJCFP9SgmHJn+n4Mhj
MD5:	6E81C9DDF21A28DCAAC72ADF87C8BC31
SHA1:	698FA4F5D9482961CAF5022C03770A500F1F47CE
SHA-256:	47415191558C4EE4F61010D15EDE7BF46F9515DB685F1E8858C12FD06E900083
SHA-512:	85B1767E50BEF0B9D6E71B1D040E553B7534E6244C1C81158ED2F78C5E30A367BFDF8594FEE22AB59909C87A96D8F001BCC27DAE3D7B2765FA76669713B1491B
Malicious:	false
Preview:	<.d....!..`...B...(......6...+...b...]..7....;.......;..-....;..;....;..}8...;.......M..7,...O.......O...t...........}..7T...m..7\|..........+;......+;..8...+;..?9..+O......+O..8]..H4......H.......J......K.......LD...&..L....z..PS...i..Zr...?..[`...8..[`.....\...kR.._......._.......1...@4..............8...............E............,..................p........-...............s...........%...O...%..G........1...0.......0..:....0..y....0..\|....0.......0...U...5...\|...5...... D..=... D..K...+....I..,...>...,......<U..z...<U......<.......F...?...F.......H5...4..H5..>$..H5..L)..H5......f....p..f...2...f...;...f...I...f...\|E..f.......f.......l...................._......<...............>N......LZ...........`......`...\.......A......2D...e...g...e..>~...e..L.................y...)..y......y..o...y......T..L...0..'..*.0....+F...y..+F......+f......+f...C<.+.z..0U.+.....d.+....p-.+.....O.+.z..0..+.....u.+....8..+....C..+....M..+....y..+.....W.+......+...p`.+.....+....0..F0i.....G.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_ru.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	172386
Entropy (8bit):	5.326083835954235
Encrypted:	false
SSDEEP:	1536:o3Du5wZmze/iYZE7st2b+hCE+PqDLlxnrcGrbs/wN43ZLSIVRJeMzKu0EY1WwKMM:o365wZB7E7xSh+GrgrRUMVtwjxnGNP
MD5:	67C53D7B506F7040FFFFCED9643DE288
SHA1:	76C288F80009C240DDE305A2FF3C78CECE03B3C0
SHA-256:	C261CD7865382EB7D7AAC077A72EAF20AC4CDF4D0E01AD810CC436C5D6304986
SHA-512:	BE092A9D97C26A8069071BBB4643E296765070FCBF4D61224709D158A219D3E991EAD7BB55F4E21FB7BDB4BA5C5994E0C34315F64FEB5E638856B39D747907AA
Malicious:	false
Preview:	<.d....!..`...B..,...........@.......A...K...B.......C...A...D.......E...s...F.......G...i...H.......I...V...P.......Q.......R.......S.......T.......U.......V.......W...0...X.......Y.......]..Lm......C.......C1......C[......>....;..+H...;..@P...;..Q....;.......;.......M..L....O..c....O..q....[..o....}..L....m..L.......x..(5...&..+;......+;..N...+;..U...+O......+O..N...1...*...E@......F.......HY..l...I....Z..I@..B...IA..B...J.......J.......K.......R...p{..T...?...[`..T...[`......\....d.._...f..._...r...1...V....E..X........4......O$..............`.......\....$..m#...$.......y..........,........Y......~!...........9..m.......U....E..M....E..o(...E..........o\...%.......%..b.......e.....$......&......+....0..+....0..Q"...0.......0...b...0..]N...0...... D..T).. D..k...,...Uq..,...p-..<U......<U..c...F...U...F...pZ..H5...;..H5..TQ..H5..k{..H5...D..H5..JY..H5..Kk..L...If..VE..'...f.......f...D...f...R...f...e3..f....!..f...1o..f...~...g...$.......................S.......".......Ty...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_sk.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	76274
Entropy (8bit):	4.8578835738633614
Encrypted:	false
SSDEEP:	768:QpDShETEGhGqtur/O4jsWVd8iPHmiWe+GCK3/IlQt1E/6fkFr51VNfKLyOUiyeiw:Q/ztu7jm2fgrxmiw
MD5:	6EB92350141BB544C42DE28B93435502
SHA1:	D3246524C883462B60D882AD83B6185DCA10D267
SHA-256:	60C14C55DFAB55DCCCD8674BA3C48CFAFF0DC24F707E9B76C4122881ABDFAB85
SHA-512:	B9DE2F8E64EB67FC398B3732B20BEF33C12ABFABAA169FD2AC6A7BF433BC01367F656CEB478E1DE68E59494E3C4CF8F007ADB4DF3089830DEEBFD313DEC2B457
Malicious:	false
Preview:	<.d....!..`...B...x......Y...+...&...]..4....;.......;..,....;..:L...;...Z...;...o...M..5....O.......O..............}..5....m..5V..........+;......+;..79..+;..>@..+O......+O..7...H4...G..H.......J......K.......LD..."..L....v..PS..._..Zr...9..[`......[`.....\...l..._......._.... ..1...?5..............7...............Ex.......n...,...........2......t........................w......=}...E..6(...E...............%...i...%..GU.......+...0.......0..9....0..{....0..~....0......0...M...5...X...5...... D..<... D..N...+....5..,...=...,.......<U..\|...<U......<.......F...>...F.......H5...&..H5..<...H5..O$..H5......f.......f...0$..f...:w..f...I...f...~e..f.......f......l...................H......;...............<.......OU...........`......`..........i......0T...e.......e..="...e..O.................y......~.......^....i.(4...KL.(4...K..(5...K..(5...K...y......y..s ..y.....T..O...0..%..*.0....+F...{..+F......+f......+f...B..+.z...u.+.....\|.+....s..+.......+.z.....+.......+....7g.+.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_sl.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	76285
Entropy (8bit):	4.858169506650341
Encrypted:	false
SSDEEP:	768:QpDShETEGhGqtur/O4jsWVd8iPHmiWe+GCK3/IlQt1E/6fkFr51VNfKLyOUiyeiP:Q/ztu7jm2fgrxmiP
MD5:	5C736F0EC5565F134324C2E1DE43E703
SHA1:	A37A0E05F84E675F70A4A33CD97005D0D7944880
SHA-256:	47AF3B51B58C8C1FEF50F7DD5FD4C4E92D4B0ED673FBAF75ED95AC7DDD502197
SHA-512:	51B687642ACC7AFF22507888D25A931FE12C3F66F9CDB6FA5A70F76DD018A44DCCFBE7C98C7577D3097C05487354E137360046C8A7B3D81B6CF3FB8C7DD1D840
Malicious:	false
Preview:	<.d....!..`...B...x......Y...+...&...]..4....;.......;..,....;..:L...;...Z...;...o...M..5....O.......O..............}..5....m..5V..........+;......+;..79..+;..>@..+O......+O..7...H4...G..H.......J......K.......LD..."..L....v..PS..._..Zr...9..[`......[`.....\...l..._......._.... ..1...?5..............7...............Ex.......n...,...........2......t........................w......=}...E..6(...E...............%...i...%..GU.......+...0.......0..9....0..{....0..~....0......0...M...5...X...5...... D..<... D..N...+....5..,...=...,.......<U..\|...<U......<.......F...>...F.......H5...&..H5..<...H5..O$..H5......f.......f...0$..f...:w..f...I...f...~e..f.......f......l...................H......;...............<.......OU...........`......`..........i......0T...e.......e..="...e..O.................y......~.......^....i.(4...KL.(4...K..(5...K..(5...K...y......y..s ..y.....T..O...0..%..*.0....+F...{..+F......+f......+f...B..+.z...u.+.....\|.+....s..+.......+.z.....+.......+....7g.+.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_sp.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	82411
Entropy (8bit):	4.655370826193561
Encrypted:	false
SSDEEP:	768:MBPRwNbCU55EUhmSggY+OpHFK6VxAfo1yDgESILETBfv66z:YRwNeAEEm86vdES4ka6z
MD5:	2DB9055A56027C4D0A5A29A4161A97ED
SHA1:	C06C716ED01996E745EC883EF963E2725260E94F
SHA-256:	821C7F609C01435F38CC8E99B4EBCD9F2C4F52951E9E1051AD7927E745B62BA5
SHA-512:	874AEB92D6C3C77E5EE09B6F84917EF1B98638D90FC05CE9B371BDF4A783CB94FE5715617211480D5677885E9DFE066B31BCE670DEBF26E7D3EC6479CB91B490
Malicious:	false
Preview:	<.d....!..`...B..........G...+.......]..9....;.......;..0D...;..?....;.......;.......M..9....O.......O...H.......`...}..9....m..:...........+;...!..+;..<...+;..C:..+O......+O..;...H4......H.......J......K.......LD...&..L....z..PS.....Zr.....[`.....[`......\...v..._....W.._.......1...DA.......K......<s..............J........6...,...................s.......8.......a.......w......Bu...E..:....E...............%.......%..M........1...0...c...0..>i...0.......0...u...0.......0...9...5.......5...... D..A... D..T...+....'..,...B...,....~..<U...X..<U......<.......F...C...F......H5......H5..A...H5..Ul..H5...&..f....l..f...4...f...?M..f...O...f.......f....f..f.......l....................`......@...............A.......U............`.......`...W.......}......4....e.......e..B....e..U..................y......~.......^....O.(4...Qd.(4...Q..(5...Q..(5...R...y......y..~...y......T..V...0..)..*.0.....+F......+F......+f....U.+f...H..+.z..2..+.....$.+.......+.....X.+.z..3..+.......+....<9.+.

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_sv.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	228388
Entropy (8bit):	4.7265515278997405
Encrypted:	false
SSDEEP:	3072:nQAgZItgmi/Zu0eeAEv+v49JnnSmICgr3n7jhCQUeimqyU5UggBRyGrL2LZO+YTZ:nQ7gDSbGrw6wsR
MD5:	4A259A2D7EA31E96229C06688CD4D193
SHA1:	D3B5EDB95036272835EB6E37B71E28F39E2A6661
SHA-256:	5671B5C74E8EFF607973CFD08C8AF159391555030E1C325095AE2BCEF2DE6630
SHA-512:	65EF091E47BB22B27FD697EA06F288C3B96E5E7974EBAC73ED17EF4518759E164A30D76C627B5AE594377A7C2EEAE5FDBECDAA81C1F416CCE62DFD2E5DFB15E1
Malicious:	false
Preview:	<.d....!..`...B..<....*.......+.......@..."...A.......B.......C.......D.......E.......F...C...G.......H...6...I.......P...b...Q.......R.......S...W...T.......U...M...V.......W.......X.......Y...l...]..g....t...5.......E.......o..........................;..G....;..\....;......;..i@...;.......M..g....O.......O.......[..,D...........}..h....m..h<.......0..(5......+;..2...+;.....+;.....+O..2...+O...n..1......E@...a..F.......H4......HY..._..H.......I.......I@......IA......IC......J...6...J.......J.......J...^u..K...7...LD......L....M..PS...4..R....U..T.......Zr......[`...5..[`......\...!...\...8R.._..."A.._.../G..1.......E...s......4...............5............................$...v...$..Z....[.......,.......y...+...y..].......H.......@.......J^......6........]...........E......E..+....E...]..............,....%..8r...%...........=.............}................5.......0..Gx...0.......0..P....0..h....0...c...0.......5...=.......h.. D...... D...E..+....?..,....G..,...,...<U..Q,..<

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_zh_CN.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	116873
Entropy (8bit):	5.857267722602321
Encrypted:	false
SSDEEP:	1536:cUlil8W89nhEFu54ahkvOzHHSVuf8j2+/xc3lhnbsfdAoz/w:cU029hEFeLhkvOznSVHJG3lhn+djY
MD5:	CD8A1B786321B5C9A64B297EECA21585
SHA1:	FA96EC1E3AEB34F25E216BE88473F94528F75D87
SHA-256:	60A994185B605ADCC85FE02FD52C8475FDAF2B94D5387F08B379A34FDA7C40DD
SHA-512:	C7AA72BB62536101A92B60ED68905C69529DE9E728F861B29EBB73EA6708155836317C9AC3632AA230FAB8ECC47B6A17383BB234C6CFD5B1F851BCB43715F8CD
Malicious:	false
Preview:	<.d....!..`...B..+x...*...$...+...f...@.......A.......B.......C.......D.......E.......F...6...G.......H...)...I.......P...I...Q.......R.......S...>...T.......U...4...V.......W...\...X.......Y...I...]..2....;.......;..+=...;..7....;..~....;.......M..2....O...9...O...C..........}..3....m..3:..........(5...h..+;......+;..4...+;..:...+O......+O..4...1.......E@...H..F.......H4.....HY..I...H....o..I....l..J....C..J.......K.......LD......L.......PS.....Q.......R...ME..W.......Zr......[`...#..[`...,..\...j..._....9.._......1...;}..............5e.......4......AD..........$..J}...$.......,.......y..................q........@...................9..J.......:....E..4....E..............%...P...%..B......................s......#......?...0...r...0..6....0..{....0..~....0...<...0.......5...%...5...f.. D..9X.. D..H...+......,...:j..,.......<U..\|q..<U......<.......F...:...F.......H5......H5..9~..H5..I...H5......VE......f.......f.......f...7...f...Du..f...~I..f....;..f.......g.......l........

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\qt_zh_TW.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	116789
Entropy (8bit):	5.84527706343641
Encrypted:	false
SSDEEP:	3072:1vWdvTIlpIuzeCSuXOFRu/i6OjYb4goYvcPezVhjvyfpnqsB:9WdFCSuXUQ/i6OjYb4goSeezVhvwR
MD5:	AB22DA97A53D7A008D6B44EF67955EFF
SHA1:	A4A726631512311159C60C001DF73A1AA03CFC68
SHA-256:	8E482D5779A30B661F2D34C1EB2CB048C35FF03B56F96BD8287EC810FCAA0C7D
SHA-512:	416A73272F7A9C39D15E7066CD1A58262778B8F8DFB2AF88C0ADE2E8AC7A5C03829549D98B99D8CBA719257E5DC3A181AF728A7F2DD466C21583BD48305EAF66
Malicious:	false
Preview:	<.d....!..`...B..+x...*.......+.......@...U...A.......B...N...C.......D...D...E.......F...n...G.......H...a...I.......P.......Q.......R.......S...v...T.......U...l...V.......W.......X.......Y.......]..2....;.......;..+k...;..7....;.......;...v...M..3....O.......O.............}..3B...m..3j.......7..(5......+;......+;..5+..+;..:...+O......+O..4...1......E@......F.......H4...#..HY..I...H.......I.......J.......J.......K.......LD...H..L......PS...;..Q....)..R...M...W....f..Zr......[`......[`...,..\...kR.._....9.._.......1...;...............5........N......A........J...$..J....$.......,...v...y..................q................"..........9..K.......:U...E..44...E..........."...%...f...%..B........I...............................0.......0..7-...0..\|....0.......0.......0.......5...y...5...... D..9... D..H...+.......,...:...,....I..<U..}_..<U...5..<....[..F...:...F....n..H5......H5..9...H5..IM..H5...>..VE...<..f.......f.../$..f...7...f...D...f....7..f......f....m..g...."..l........

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_bg.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	781657
Entropy (8bit):	5.356208924748881
Encrypted:	false
SSDEEP:	3072:JmFdoVZ9YguXptvHzQXik+5VxFUcaZO1PbkWNeytBv0umWZFp7QBagLzf1eNRpDs:JmFi+5SeITWNeytBvCknpYn3l7x
MD5:	8FDDFF9559AB69D2D7019D50DD4DC303
SHA1:	9C7FB734B4B334285DE288CA3613DB49A2EF7129
SHA-256:	17BA9D80F25F1AF33FA2A613AFCEFBC345E9DBE7610300D418CD715BDABD7F86
SHA-512:	5C6AD38D0718061D8144C47C68EDF5AB09F4C25FCD05D7D25ADAEF9306B6781875CD1D4E9312BCE9AAD1C79862AB6C7255671B73423137993708E5EE25504409
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%.......%..8....%...c...*..E....,.......,..5................7...0..Of...1..6....1...V...1.......2...@...2.......3......4..."...5...Y...5...I...6.......6...p...7.......7......8...u...8......9.......P..4....P.......m.......s..$6...s../....s.......s..<-...s..}....s...W...s...j...s..<....s..@3...s..DK...........@...8...A...b...B......C......D.......E.......F...4...G...^...H......I......P.......Q...-...R...W...S......T......U.......V.......W...)...X...S...Y...}...`.......a.......g.......s..5<...w.......x..;....}..'\...}..V........x......;........q.......7.......n......'.......W.......<-...............9......<................(......<...............(_......W[......(.......=.......W........m.......#...........p..-....p..~.......!a......!........................!.......Z.............................-)......>z..............;........2..............I.......3........................>.......w.................../...n...;..oW...;..\|....;.......;...N...>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_cs.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	738275
Entropy (8bit):	4.922996937127515
Encrypted:	false
SSDEEP:	3072:Wdde3SN8CdspnrHY7QudlOQ7yWpnXjKO2pv2op8RcyeNPlZuKA5rNtUimaLtnK2p:Wds3S9dspnbM12PlZuKA5RHt0bxceTrC
MD5:	0E25C47A06AD2E513D3D913B90C97331
SHA1:	AB55C173E5F13F063616AB4F6C9058C2178649C7
SHA-256:	380EA30DE25C543C8518DFDC5062DD6BD7D032F5BDFBEDECAC2C442D75AFFDD3
SHA-512:	D73DA7983481CF628DC23D592017CB4549E15D0D3592D65F56175B7A179AB1A51054EFC1D63B3866BF8444644245C9907F73E8A2CAFEFDE99A561CF2261ED108
Malicious:	false
Preview:	<.d....!..`...B...H...%...E...%.......%.......%..r....*..1c...,..yO...,...p...............-...0.......1.......1...L...1..2{...2...6...2..4F...3..6....4..6....5.......5..6....6...g...6..6....7.......7..7....8.......8..7(...9..7O...P..2....P..Q....m...!...s..#L...s.......s.../...s...%...s.......s..AO...s...D...s......s......s...y...........@..2....A..2....B..2....C..3 ...D..3J...E..3t...F..3....G..3....H..3....I..4....P..4m...Q..4....R..4....S..4....T..5....U..5?...V..5i...W..5....X..5....Y..5....`..68...a..6b...g..6....s...r...w..7....x..9T...}..&D...}..S!..............9.......6.......7.......#.......&.......SH......9..............`.......:V......................:...............';......S.......'m......:.......S.......r........7......at...p..,....p..Jw.......M.......o...............................P...............p............................6................ ...............................................4.......m.................../..m....;...C...;.......;.......;...f...>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_da.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	729762
Entropy (8bit):	4.8459179946671656
Encrypted:	false
SSDEEP:	6144:Z3svhfiwQxru1mFaZgCRx0rw54OLmpfU5iUv:Z3c481mAZgCRx0rw54OLmpfU5iUv
MD5:	CDEC9AA6C8FE06AB42DAB47D81CCF0B8
SHA1:	E36A41698627DC3830B059DD3DF49C53BC32FEE9
SHA-256:	8DB2254A80AE3396CD86992CE9FF03E84E2257264DADE7A59024E3AB90FC9373
SHA-512:	36CCA160A63B5328C46C8A41ADE5B98FD63FEDDBC9781CBEDE94950712AD82E37185AF3FE916EEEF8A0D7B8F09AAD7D57A7B7971539410DFC0E5F50E87D9FF28
Malicious:	false
Preview:	<.d....!..`...B......%......%...l...%.......%..X....*..-T...,..m5...,...6.......@...........0...X...1.......1.......1...J...2.......2.......3.......4...[...5.......5.......6...y...6.......7......7.......8...)...8.......9.......P..1....P..G....m.......s.."f...s.......s...n...s.......s...q...s..'....s...l...s.......s...%...s...............@...q...A.......B.......C.......D.......E...C...F...m...G.......H.......I.......P...<...Q...f...R.......S.......T.......U.......V...8...W...b...X.......Y.......`.......a...1...g.......s.......w.......x..8....}..%D...}..R........,......8H.......^......."..............%.......RF......8...............O%......9.......................9B.......A......&;......R.......&m......9r......R.......mb.......l......O....p..+....p..@{......w.......w................A.......:.......q..............#....... ...............t...... ................Y.......!.......................................Q..............?.......a.../..[....;.......;.......;.......;.......>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_de.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	746165
Entropy (8bit):	4.821907660654219
Encrypted:	false
SSDEEP:	3072:W96yXyBcOkDHyF9zyM4cv8x6N6pr2NBpC+WGXsrcZ5n0u2+21SqfqgK63wuUchlj:W961ca9zyMpn0u2+21TU/WfIvrN7k
MD5:	AB878B5A113CB336DEC2980DD5B29AA5
SHA1:	9FF2E7390F5AC8256E925347D019459FF72A2C08
SHA-256:	9AA99D5D001AB9A706E91770015BCD0887C89D3F47804C00476E17FF3C8A4CD6
SHA-512:	4964B7A97FF5507F8C49C857FD7E487E7815D7A8CD003D8055A21B9F0FDE64831F2B90D3A1AFDC593A1156C0BED2C66E76B9B8ABC7B12A92952F238B1F8EF9EE
Malicious:	false
Preview:	<.d....!..`...B...H...%...#...%...>...%.......%.........4....,.......,.................$k...0...>...1.......1..$....1..Q_...2..%t...2..S...3..T....4..Up...5..(_...5..U....6..(....6..U....7..)....7..U....8..){...8..V....9..V3...P..2....P.._T...m...W...s..#....s...V...s.......s...G...s..?....s..V....s......s...`...s.......s.........$K...@..Q....A..Q....B..Q....C..R....D..R....E..RX...F..R....G..R....H..R....I..S....P..SQ...Q..S{...R..S....S..S....T..S....U..T#...V..TM...W..Tw...X..T....Y..T....`..U....a..UF...g..LW...s.......w..L~...x..98...}..&....}..S.......(~......9l......L+......L.......<.......'2......S.......9...............o)......:B..............).......:v..............'.......TE......'.......:.......Tl......x........%......o....p..-4...p..W................5......,...............,.......-"......-[.......j.......T.......!..............G.......................................U......-.......-................E.......}.........../..{....;..%....;...:...;...U...;..#2...>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_el.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	781251
Entropy (8bit):	5.465254846157274
Encrypted:	false
SSDEEP:	12288:dCDKWLHDZX3LGa4jospOLLXjtB5BhwrjqzeQefScF0l8Xg3:yKWLHDZX3LGa4jospOLLXBfBhwrqXefk
MD5:	43BB5BFCA7D0784DD378C9E33C76827D
SHA1:	38A49A5CC87A92BE13FE7362B9B76D266FD338F3
SHA-256:	282DD70DC8004A6C6D15E9A45B5A6EE1E45AD4ADED0F981D363041C9EFBEF185
SHA-512:	72021EBB6795147F1DB5F4565323ADE6B1BA451E2FA0BBB4BD5E59F6B2E5E246419D8D674F159101AF7FF977F2C5ADE6C30F7162085F7E4165BA1CFFBF342776
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%...h...%..2....%...W...*..De...,.......,..6n.............../...0..P....1..9....1...N...1.......2...8...2......3...{...4.......5...=...5.......6.......6...D...7.......7...k...8...Y...8......9......P..4....P.......m...O...s..$....s..-....s...G...s..:i...s..~=...s...G...s.......s..>....s..B....s..G............@.......A...6...B...`...C......D......E.......F.......G...2...H...\...I......P.......Q.......R...+...S...U...T.......U......V.......W.......X...'...Y...Q...`......a.......g...w...s..4....w.......x..;....}..'....}..W........\......;........K......................(V......W>......<[......................<........;..............<........f......(.......W.......(.......=&......W........................Z...p...$...p..y.......!.......!%...............z.......................C.......p.............+k......=...............5&......................E.......3/.......\|.......................!.................../.......;..q....;..y....;.......;...x...>...(...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_en.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	725069
Entropy (8bit):	4.860810087849136
Encrypted:	false
SSDEEP:	6144:dUBub5OaLkWxbFF0jyuslDa2FnJvUXsUVwl2:JtHwWxbFF0jyLlJvUXsUVi2
MD5:	D340CA199C6DC5270CDCE049A1CE8B42
SHA1:	A2CEE89BC44A7CBD2BFFD23800F5CBCA94ED42F7
SHA-256:	49C054EE30B11A8E5EAD6193D3305C5064996227E05C7F156C400F6AB90A7379
SHA-512:	1468217F454018DBEC7AD512F8395EBB9EC77D8F1019B956CC9C2095014049400F1821B88F28507F0F3889CBFAE271983901F0242C565B14DA23C53B4DA4C892
Malicious:	false
Preview:	<.d....!..`...B.......%...$...%.......%.......%..3....*..'4...,..aP...,...3...............D...0...a...1...$...1...c...1.......2...M...2...\...3...'...4.......5...6...5.......6......6.......7.......7.......8...R...8...>...9...e...P..0....P..;J...m.......s.."....s.......s.......s.......s...&...s...o...s..w....s...y...s...^...s...........$...@.......A.......B.......C...6...D...`...E.......F.......G.......H.......I...2...P.......Q.......R.......S.......T...+...U...U...V.......W.......X.......Y.......`...N...a...x...g...1...s...3...w...X...x..6....}..$....}..Q........U......7 .......................a......%~......R.......7........k......>.......7......................8...............%.......RU......&.......8J......R\|......n...............?\...p..+....p..43......V.......V........Z..............................................................M.............................................j........>.......w......................g.........../..J....;.......;.......;.......;...D...>...i...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_es.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	778715
Entropy (8bit):	4.736389856040223
Encrypted:	false
SSDEEP:	6144:vlnjquU1Q5Cn8LSz0lr1cLMWgPnHQuq8OV9v+k+QEtLEJsG8v:VGQAnuSz0lr1cL7gPHY1vqtLEJsG8v
MD5:	956A9F069A88BA100BF1A1CB45DE6BAF
SHA1:	EE01FDADE022EB3A3388147300D0D89E082EA705
SHA-256:	B409655B5E12613EB84D9270E2AC88F521DA16A92D329F918273C2768DA12E01
SHA-512:	8127E0BD07F778C4E81A9F772F3FB1DD4D5A176702F7E35B8F9D3E2B862966F27632F43971F7A3531C23CC6DE8D02F995D40191B437F2584F0BB7848A2721CAF
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%.......%..0....%........CC...,.......,...z......."......~....0..G....1.......1.......1.......2.......2......3...u...4.......5.......5.......6.......6...>...7.......7...e...8...7...8......9......P..5....P.......m.......s..%z...s..-....s.......s..4....s..u....s...u...s.......s..5\|...s..9w...s..=.......~....@.......A...0...B...Z...C......D......E.......F.......G...,...H...V...I......P.......Q.......R...%...S...O...T...y...U......V.......W.......X...!...Y...K...`......a.......g...'...s..-....w...N...x..<....}..(....}..X........:......<...............................)2......X@......=Q......................=.......................=...............).......X.......).......>.......X........Q...............R...p../V...p..w........K.......m.......R.......................................$.............%a......7.......~E......3".......\..............C.......!.......^.......................'......w.......w..../.......;..g#...;..p2...;..x....;.......>...D...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_et.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	708394
Entropy (8bit):	4.866425421224098
Encrypted:	false
SSDEEP:	6144:nwtfpfgMqv4xbFF0jyzQe0auZo4+WjeUJIUL:wbfgixbFF0jykei+WjeUJrL
MD5:	D6A4FD581AFA5D0A7C00C4FE0D8C0F7C
SHA1:	88EBB9BCEBADBB6DAD6530F75BA7D534299E9C59
SHA-256:	1E4646C3A1634C320BAEECEAC4AA0C67767297AEE03EDB222EBFFDBF3AA74C8E
SHA-512:	005B18A751DCFB50D5A9D4EDC64649E572116F672452382A306F386D00F055B85DCFA9AB83F6B66DDBA6451E2113E40F4FEFF5EDF8AA530F6E30DE00C3DFDBCF
Malicious:	false
Preview:	<.d....!..`...B......%...l...%.......%.......%.. ......%....,..S=...,..................w...0...X...1..h....1.......1...r...2.......2...=...3.......4......5...i...5......6.......6.......7.......7.......8.......8.......9...F...P..0....P.......m.......s.."....s.......s...b...s...#...s.......s...b...s..dn...s.......s.......s...c.......W...@.......A.......B.......C.......D...A...E...k...F.......G.......H.......I.......P...d...Q.......R.......S.......T.......U...6...V...`...W.......X.......Y.......`.../...a...Y...g...$...s...J...w...K...x..6....}..$....}..P...............7.............................%v......P.......7{..............a......7................8......8...............%.......Q3......&.......8B......QZ......d........4...........p..+....p..'!......6k......6........I.......!.......................................................b.......u.......................A.......n......E........-.......f.......................5.......W.../..:....;.......;..g....;..o....;...3...>...W...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_fi.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	736621
Entropy (8bit):	4.838981048693214
Encrypted:	false
SSDEEP:	3072:WsI7QblqDPtEInygks2Qm7BMtmbVLeYjl7IupQfmgoOubMe4lgNiWeOLycW9mD/q:W/KlutEQygk74lgNiWeE4mJlyRg6aQ
MD5:	910B8EEF9698812FD0061F075CDB0C5B
SHA1:	1290E166789B6A0544E454280EAC5229D731A6CB
SHA-256:	A3E94E40DE4E84E70A3AD8196D5C6C916AF591BF0340FC8651EA77D35D4411E9
SHA-512:	1FD81EAA5BC44541BE28294A4E971C780F9345AF54D99D27ACFAC2F9A2BF97C1BB81CEBFF7A943087AF7B724F9ADF3A49E6E5EC3C66E91C7ED8C4ED98A563FB0
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%...N...%...P...%..m....*..0....,..o....,...>.......j...........0.......1...!...1.......1..+....2.......2..-....3../K...4../....5.......5../....6.......6..0....7...M...7..0;...8.......8..0b...9..0....P..3]...P..I,...m...i...s..#....s.......s......s...3...s..$;...s..7....s.......s.......s...%...s...'...........@..+....A..,....B..,0...C..,Z...D..,....E..,....F..,....G..-....H..-,...I..-V...P..-....Q..-....R..-....S...%...T...O...U...y...V.......W.......X.......Y../!...`../r...a../....g..,....s.......w..-....x..9....}..&....}..S...............:"......,.......-........x......'8......S.......:........^......X.......:...............l......;..............'.......T.......'.......;L......T.......q...............X....p..-4...p..A................-.......z......................................^.......r.....................+........^.......\|.......j...............G.......N........................................../..d....;.......;.......;...3...;.......>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_fr.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	789115
Entropy (8bit):	4.738849366743149
Encrypted:	false
SSDEEP:	3072:D41zJKyDEA4sQqrwqT8ZyhR2A4+bbb9iBShVIe3JrlIX2934Pa6EbrhpX3uRpIuE:U1zkywtsQq1PIX2934P8Lakc6g9Cr
MD5:	DB030D81B701FE195934BD92BA5932D0
SHA1:	2E442724A6A2FBC6676BBDBA52D293C0B52BEC1A
SHA-256:	4A90B6BEA849B6FE3CFD08C76D9C5FAB1670403A9F61E822B65E02F909F59083
SHA-512:	F62C5BA1F1FBF0349FEC32830662C854E51904776A3567FDA8F816B1B6D244EE549C66FFC225FA7D4481F309BD1A75AB94CB46C2F1BEF56B54BFF3C86FE88A39
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%.......%..:....%.......*..Es...,...s...,..<....................0..V@...1..G....1.......1.......2.......2.......3.......4.......5.......5...-...6...u...6...T...7.......7...{...8...%...8.......9.......P..6....P.......m...3...s..%....s../,...s...9...s..A9...s...3...s.......s.."8...s..E6...s..IE...s..MU...........@.......A...F...B...p...C.......D.......E.......F.......G...B...H...l...I.......P.......Q.......R...;...S...e...T.......U.......V.......W.......X...7...Y...a...`.......a.......g.......s..:....w.......x..<....}..(....}..X?.......(......<........s......./..............)d......Xf......=[.......v..............=.......................=...............).......X.......).......>"......X........m...............0...p../....p...+......5C......5e.......X.....................................................2.......C...............<`......................K^......H-.......\........................................../...H...;..u....;.......;.......;...x...>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_he.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	295903
Entropy (8bit):	5.534248389928892
Encrypted:	false
SSDEEP:	6144:Aep/qOM8ZKiEbRXLXEBT1Kd4c20ddWl/2WKd3yR:DVqOM8ZKiEbRXLXEBT1Kd4c20ddWl/2U
MD5:	A4938BC91E1105C09FDDC8DA6E42011A
SHA1:	BCE970786119C29AD4E440873C1091DB15D9C559
SHA-256:	60592D1F61BC2EBCAB980AB8FE3A0BC34377C06AE16C472A91CC48BAB917F395
SHA-512:	E3CDAE454813640EB3B97C5F049EC5E432A2A761E0B6181A54F4BABC379B6775D3D21CCCC611DF9A1F0AA7B659D61FFDCC0E9B621A0C0096AE8E0D86FC6BDC19
Malicious:	false
Preview:	<.d....!..`...B..p0...%...1...%.......%...y...%.......0..:....1..#....1..=W...1.......2..>A...2.......3.......4.......5..?....5...>...6..?l...6...e...7..?....7.......8..@....8.......9.......P.......P.......s.......s.._....s.......s...\|...s.......s..Z/...s...q...s.......s.......s...[...@...-...A...W...B.......C.......D.......E.......F...)...G...S...H...}...I.......P.......Q..."...R...L...S...v...T.......U.......V.......W.......X...H...Y...r...`.......a.......g..Y....s...>...w..Y?...x...B...}.......}...~......?........v......X.......Yf.......j...............................W......o........D..............?........v...............................J.............. .......................p....p.......p..........j.......j...............................7......................5!.......'......OQ......r[.../..r....;..B....;......;...l...;.......O.......O..6....O.......O.......O.......^..Ms...^..._...^..:"......P.......&k......_...4!......4!......4!..4\|..4!..\V..4!...6..4!......4"..%*..4$..%R..4

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_hr.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	769028
Entropy (8bit):	4.798193754177343
Encrypted:	false
SSDEEP:	6144:npAuEpc+4BNkBG88eMZc9ZBVN785Ws3DpvmApeKR:pAu7+4BNkBG88eMZc9ZJ78QgDpvMKR
MD5:	149127D37AAB0D4613279555077D2DA0
SHA1:	07C50B1D8ECBD8C49D800A93031D64EBED5D1432
SHA-256:	3263E105DE5EFE06CB3A2317585C3A0B7675F9186088EF59F32F8C8AB862D7D5
SHA-512:	EB327D12AE26B1879EC26382EC47C7ABF5BA49131DE6AFF52ADBB0BCC1EB78EF5D18F51CFF8107AB085D487492FCF0A72AFB01A2E8CEEC0A5EE9CC399F6B8E3C
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%.......%..'....%...c...*..@....,.......,..................^A...0..0....1.......1..^`...1.......2.._J...2.......3.......4...(...5..bG...5...O...6..b....6...v...7..b....7.......8..cc...8.......9.......P..4....P..s....m...}...s..$....s..+>...s.......s.."....s..c+...s...-...s.......s.......s.......s.. .......^!...@...>...A...h...B.......C.......D.......E.......F...:...G...d...H.......I.......P.......Q...3...R...]...S.......T.......U.......V.......W.../...X...Y...Y.......`.......a.......g..vq...s.......w..v....x..;....}..'....}..VO......bf......;.......vE......w.......m.......(H......Vv......<5.......p..............<...............c.......<...............(.......V.......(.......<.......V........................H...p...L...p..kW.......!.......C.......................U.......................P.......P.......E......%.......ks......)X...............z......0........................?.......x..............Va......V..../...:...;..O....;..J....;..S+...;..x....>...X...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_hu.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	743354
Entropy (8bit):	4.91144017928325
Encrypted:	false
SSDEEP:	6144:kXKY1cYMIfQRO6U43xDV2cK3qCRZpVPmeOHJ/9oj6Xp5fuYWY:IJeYXoRO6U43xDVXGXVPmCjtY
MD5:	19087505226CC366E64E82271F0B2529
SHA1:	0E39AE92CAD830C0381053802835124171839779
SHA-256:	85E9C12C3E74F34E84E5E910F2F0F7A8C24F5C31CBAEB7ABCD52514B4D102C7F
SHA-512:	89C3B54B33EF9BBB9EDCA17614F4C2072D7B6DEDA4C5B191C3D9C0D8278EE9FFDA7EE9300C38EBCCB8C1DAB3AB90DAC19669F70B4FBB1CE1EF6018205940ABD2
Malicious:	false
Preview:	<.d....!..`...B...H...%...;...%......%.......%.../.....5{...,.../...,...^...............y...0.......1......1.......1..E....2.......2..G....3..Ia...4..I....5...o...5..J....6.......6..J...7.......7..JQ...8.......8..Jx...9..J....P..3....P..Z ...m...9...s..#....s.. <...s.......s.......s..3....s..H....s.......s......s.......s...........Y...@..E....A..F....B..FF...C..Fp...D..F....E..F....F..F....G..G....H..GB...I..Gl...P..G....Q..G....R..H....S..H;...T..He...U..H....V..H....W..H....X..I....Y..I7...`..I....a..I....g..=....s......w..=....x..:....}..'....}..T...............:.......=U......>.......-.......'.......U.......;........x......f.......;...............>......;...............(.......Ug......(5......;.......U.......w...............gJ...p..-....p..Rs.......5.......W......!:..............!s......!.......!........r.......^.....................;]......................................Q......"......."U......"......."..................../..s....;.......;...p...;......;.......>...B...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_it.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	759267
Entropy (8bit):	4.757797736314198
Encrypted:	false
SSDEEP:	3072:O+fbwQcS3LCMcExbHsholNmPp6cTk2SdWiiR9eI8vzXIlA5cRpDFfXOsN0DKiQbH:LzwQXLCFmHsJPp6cTk2+TuOKiFFgQGG8
MD5:	7FEB7B92A642B02503E17397A5DF5F5A
SHA1:	998BF9F529170C25B767592611A729F0D953CDC3
SHA-256:	57FB249277574A178EF1AD434ACB86EE3F57C3153DE5A3D414C4641D27C22CA1
SHA-512:	ABDE544ACD20218CFE1525D027469A7A127B0531A181E3AD2AF51DC2A5DC5990B047EDFC2F6FCBC94CAF87EEF5483C66EBE8432EAF5E46B840DC61692ABBF651
Malicious:	false
Preview:	<.d....!..`...B...H...%.../...%...n...%.......%.........9....,...=...,..................C....0...p...1...I...1..C....1.......2..D....2.......3...g...4.......5..G....5.......6..H=...6...0...7..H....7...W...8..H....8...~...9.......P..3)...P..i....m...'...s..#....s..$f...s.......s...a...s..S....s..o....s.......s......s...C...s...G......C....@.......A..."...B...L...C...v...D.......E.......F.......G.......H...H...I...r...P.......Q.......R.......S...A...T...k...U.......V.......W.......X.......Y...=...`.......a.......g..e....s...H...w..e:...x..9....}..&....}..T.......G.......9.......d.......e.......X.......'~......T.......:................)......:...............H.......:........$......'.......UC......(.......:.......Uj......}3.......O...........p..-V...p..b_......................]...............^9......^z......^........................I..............[........................z......&...............^......._=......_~......_.......7.......7#.../.......;..=....;..'....;../k...;..T<...>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_ja.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	596192
Entropy (8bit):	5.7773979726902756
Encrypted:	false
SSDEEP:	6144:9nMlJI/xOEOAQfB/A3bOfmVAma91gIktvhE:ClysAQfB/A3bOfIa91gbvhE
MD5:	DAEF57EE94CD826F09265F463128A37B
SHA1:	772E73EA7E2C9E4EDD0AB264D6592F7EE2E1DB5E
SHA-256:	29188DB31832FCEF0AA7C5F721081C76C6B10872ADC63A5943BE4E9C5D338C08
SHA-512:	56BD116D79BF7152C0F6D46E1687DAD6F0B65D5043DA59BFB13B439AB6BA40B44C27635113C4569B5E8A6274E99997D7F1DF908EB3E43D7064984F71C0036498
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%..J....%..nj...%..............,.......,...........(......uO...0.......1..8....1..un...1...m...2..vX...2...8...3.......4...~...5..x....5.......6..y/...6.......7..ys...7.......8..y....8.......9...A...P..,....P...~...m...G...s...N...s......s.......s......s..#1...s...!...s..[V...s..w....s..{....s..~A......u/...@.......A.......B.......C.......D...<...E...f...F.......G.......H.......I.......P..._...Q.......R.......S.......T.......U...1...V...[...W.......X.......Y.......`......a...T...g.......s......w.......x..1....}..!....}..GY......x.......1........W......................"V......Gz......2K......................2...............y.......2...............".......G.......".......3.......G............................p..'6...p..........................................................;......\(......*........U..............).......p.......w...............:........].......j..............................3.......U.../.......;...a...;.......;.......;......>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_ko.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	582582
Entropy (8bit):	5.8277847176962565
Encrypted:	false
SSDEEP:	6144:K1TFRa2yuGvOY8vA0ubNF+livjLnvkR3CQ7+:0yEY8vA0ubL+lMfvkR3CQ7+
MD5:	036DA3279D29375502E150D1BB4C88E9
SHA1:	9C37ACAAE85B80A505270B252A82F93D6C3FC968
SHA-256:	8E97C44DC83FB5E5DD362B2FD9559ACBC86DC742A7532E2DAE87E6FD45748D60
SHA-512:	3811AD50998D2DD37CCF9EEC3C45B9A854044D5CD3ACD4405679ABA529FBA77BB7D5C764665DC2E190BD01C01F57C5841C841B9194AEFB23A29B731079305D4C
Malicious:	false
Preview:	<.d....!..`...B...H...%..z....%..=....%.._....%.......*...A...,...c...,...........4......K....0.......1.......1..K....1...w...2..L....2...B...3.......4......5..OE...5......6..O....6.......7..O....7.......8..Pa...8...$...9...K...P..)....P.......m.......s.......s......s..w....s...C...s...1...s...3...s..6....s..R....s..V....s..YW......K....@......A.......B.......C.......D...F...E...p...F......G.......H.......I.......P...i...Q......R......S.......T.......U...;...V...e...W......X......Y.......`...4...a...^...g......s...<...w.......x../N...}...2...}..Dw......Od....../~.......u.......%.......n..............D......./.......~X......j.......0>......~.......P.......0l......~....... .......D....... C......0.......D.......%K......~.......j....p..$....p...}.......1.......S..............{........E.......v..............P........X.......7.......,.......c......aB......sj......u.......'........;.......................:.......k.................../..s....;...o...;...j...;...I...;...j...>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_ms.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	292296
Entropy (8bit):	4.87518463434259
Encrypted:	false
SSDEEP:	1536:Q/ZOTMBG0oFA/GPB69+d6Rjo77BrT+1G97s43LmJyVaxvrL/5MPNTt5kcFScGk9T:Q/8iboFCEga77BmiAltmuefhPJu8
MD5:	81309BDBFB78B7A3625E827D56AAC1EB
SHA1:	5D8A858C03E09B9769A59A1ECCD74A19B3207E6B
SHA-256:	62387FE2CB5BC84DE514CE490CE777D97914768BE9F46CB8C71D4ACF2135FFF8
SHA-512:	B30E375CFEAB6FD48A665E39FAF501CC6C59C8885D83D7B832A5021168172B07CFFA87B2FC176E8203C53224F68F782F1C551A93C07AAC775DE87E96F080FB47
Malicious:	false
Preview:	<.d....!..`...B..f....%.......%...U...%...J...%...Y...0..(v...1...+...1..,....1...J...2..-t...2.......3.......4...[...5...3...5.......6.......6.......7.......7.......8../O...8.......9.......P.......P.......s.......s..[{...s...J...s.......s.......s..>R...s..{V...s.......s.......s.......@...q...A.......B.......C.......D.......E...C...F...m...G.......H.......I.......P...<...Q...f...R.......S.......T.......U.......V...8...W...b...X.......Y.......`.......a...1...g..<....s.......w..=....x.......}...$...}...B.......R..............<.......=B.......................i.......:.............._B...............A....../................j.......................G......................................_....p.......p..........^.......^........<......................I......................2...............=I......g..../..a....;../6...;......;.......;.......O...s...O..4....O...]...O..{....O.......^..H....^.......^..'.......K...............[...4!......4!...`..4!..!...4!..@...4!......4!...2..4"......4$......4

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_nb.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	729966
Entropy (8bit):	4.8378686736645475
Encrypted:	false
SSDEEP:	12288:tTcjC2OYAdGgeAchletPHpuBD0JXJTk4uL:KjC2EdGgeAchl6JdJTkd
MD5:	3F08031A1AE8058E16B7C43A6F799ADD
SHA1:	5B95A90F0AD983D99DD17B1E23ABDAD56AE441BD
SHA-256:	6CFC34CB01A81A1257EFAD9FD112C412543CF85AA45E18237C6AA7C3DA5482DF
SHA-512:	3400B364A805BD2B215F4E9E8B9F6CF26579605A21B0C3789A09CDB5AB9D2F8B30F21A50666E423C6397C1C25CCB64ECB7EECE815BC931DFC89B509FA7FEB340
Malicious:	false
Preview:	<.d....!..`...B......%.......%...Z...%.......%..U....*.......,..j....,...........L...........0......1.......1.......1.......2.......2.......3.......4.......5.......5...<...6...?...6...c...7......7.......8.......8.......9.......P..2....P..En...m...h...s.."....s.......s.......s...E...s.......s..%....s.......s.......s.../...s..............@...+...A...U...B.......C.......D.......E.......F...'...G...Q...H...{...I.......P.......Q... ...R...J...S...t...T.......U.......V.......W.......X...F...Y...p...`.......a.......g.......s.......w.......x..8f...}..%....}..R...............8........x.......6..............&:......R.......8........_......Kg......9h....................9..............&.......S%......&.......9.......SL......n...............L....p..,....p..>.......u[......u}.......5...............l......................7.......P.......................m.......0.......U.......................................J................................./..X....;...J...;...C...;...`...;.......>...g...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_nl.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	759411
Entropy (8bit):	4.770448984570024
Encrypted:	false
SSDEEP:	6144:tls24pmBqwIObdm+j2dVZ6l6tya1HqV83c:fs2hbdm+j2dVZZya1HqV83c
MD5:	A979C3205D2006415222B3CB4EDBC4A2
SHA1:	8D7FEE8F85A2C56B08FE9433A71B8ECA6929B1BB
SHA-256:	8917EEC5E3B0F2A5EAC6CF8CB0C301FF67D1A5E9CC0A739B8A9AA662FC133A8B
SHA-512:	A7C32DF1F53215C609F297E83714A5B27BB7D8CC02C54F9812ED9A3E99E12A63DE05B5C34C50B67EF9FC674D408CBABC44B7BBA539E80FFDA19451B32F767285
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%.......%.......%.......*..8W...,.......,..................@a...0.......1.......1..@....1...%...2..Aj...2.......3.......4...6...5..D....5...]...6..D....6.......7..E;...7.......8..E....8.......9.......P..3....P..h....m.......s..$b...s.."....s......s...9...s..N....s..j....s...T...s.......s.......s..........@A...@...L...A...v...B.......C.......D.......E.......F...H...G...r...H.......I.......P.......Q...A...R...k...S.......T.......U.......V.......W...=...X...g...Y.......`.......a.......g..`1...s.......w..`X...x..:R...}..'j...}..T.......D.......:.......`.......`.......Q.......'.......U"......:........t......\|.......;L..............EZ......;\|..............(a......Uo......(.......;.......U.......{_..............}b...p..-....p..ao......................^r..............^.......^......._........P.............................V................\|.......6......$@.............._V......_......._.......`.......6.......6..../.......;..8....;..'....;..0+...;..T....>...,...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_pl.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	766259
Entropy (8bit):	4.869516867795244
Encrypted:	false
SSDEEP:	6144:5WGJXTCj7zWa32WQCwmPe4wiERFzSKo/P:5WGlTCj7zWa32WQCwmPe4wiERFzi/P
MD5:	82862C3EE9A4ED7778BAD49391CF317E
SHA1:	63111839774F804AFCEB13CA9E2C4639F3604322
SHA-256:	F45665B3864F190A3945ECA4C522A9F72497439C799841C53D6C556FBAD1097A
SHA-512:	F50CF370ED890A5B38EE7828A380A96BD37F1B286068E3CEE090B902B10FEC1D42E3EDA0228CD20C970453E702347F0B04FF5FC44A3334DDD810A948B90073D3
Malicious:	false
Preview:	<.d....!..`...B...H...%...C...%...D...%..&t...%...e...*..>....,.......,...^..............Z....0..2\|...1.......1..Z....1.......2..[....2.......3.......4.......5..^....5...1...6..^....6...X...7.._C...7.......8.._....8.......9.......P..4M...P..q....m.......s..$....s..)d...s.......s..&'...s..d....s.......s.......s...F...s..._...s.. e......Zu...@... ...A...J...B...t...C.......D.......E.......F.......G...F...H...p...I.......P.......Q.......R...?...S...i...T.......U.......V.......W.......X...;...Y...e...`.......a.......g..wq...s...t...w..w....x..:....}..'....}..U_......^.......:.......wE......x.......lr......( ......U.......;C..............._......;..............._b......;...............(.......U.......(.......<.......U........s.......1...........p...2...p..j5.....................x...............y-......yf......y..............................(.......mG......(........<..............2p..............y.......z.......zJ......z.......O.......P..../...z...;..P....;..A....;..J....;..n....>...8...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_pt.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	767981
Entropy (8bit):	4.778358118439606
Encrypted:	false
SSDEEP:	6144:F3j5ZWy7CAZqB/dFRkIrlAYME/Z9Z2ft9CFuZ8Un:Fj5rCNFRkIrlAYMEx9Z2ft9CFuZ8Un
MD5:	87CEB6D8343A3BE450EEDD7315AFF398
SHA1:	79BFC99370737D9D64666C7569C9BFBC8F02F05B
SHA-256:	38685C58FA945577F9A29A3AE8675E1C4D5533E323502A98E36DDF20FF10839C
SHA-512:	254803D600B27C892EB02668AEBEB8357315539612BE0CF95920AF1C7A2CDF0630EC0176B078C879AC19DBCBA13B634B6AC7813A5EBFE5357B73AB62E0B78D17
Malicious:	false
Preview:	<.d....!..`...B...H...%...W...%.......%......%.........B....,.......,...V..............a....0..7....1.......1..a&...1.......2..b....2...b...3...-...4.......5..e!...5.......6..e....6.......7..e....7.......8..f=...8...D...9...k...P..5)...P..y....m...A...s..%....s..,....s.......s..'5...s..h....s...?...s.......s..!....s..%....s..).......`....@.......A.......B.......C...<...D...f...E.......F.......G.......H.......I...8...P.......Q.......R.......S.......T...1...U...[...V.......W.......X.......Y.......`...T...a...~...g..~c...s.. ....w..~....x..;....}..("...}..V.......e@......<.......~7......~.......u.......(.......W.......<.......................<...............e.......=........:......).......W_......)K......=H......W........o.......e.......Z...p.......p..qm...............!.......\.......................................^......................).......o.......,.......................8t...............X..............................U.......U3.../...\|...;..V....;..H....;..Q....;..u....>...Z...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_ro.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	738686
Entropy (8bit):	4.83015606506478
Encrypted:	false
SSDEEP:	3072:b2Zvix8AgM8YrQupAFRYuf4kiFa2Aw3DR/t8wuEjRJEgMyGaO+/qrF1KgPtgWn00:SZ6xpgMPnK8DDR/t8wuW3EmQgc0wgDId
MD5:	A04B2F2EF3A10E6B661177BCF357E3B8
SHA1:	CF7A49F6C1254871604D957881103E06F70E732F
SHA-256:	56F132CBB926AA9FC4FE358EEC747888F4F7822607B2B6BC2EF81BDD72ACA50E
SHA-512:	D9108E8E88F42F2F27F13DA2CCB0325DF784932C0FD6CACAC2C7F151C64DDB65577BF90349A87463D2F9EB9999EE1E8AB6C97A23FBAB39640A6C85E8B547842C
Malicious:	false
Preview:	<.d....!..`...B......%......%.......%.......%..n......3x...,..u_...,..........z...........0.......1...{...1...$...1..3f...2.......2..51...3..6....4..7w...5.......5..7....6...}...6..7....7.......7..7....8...-...8..8....9..8:...P..2....P..Of...m...>...s..#....s.......s...T...s......s..$E...s..7....s.......s......s......s..............@..3....A..3....B..3....C..4....D..45...E..4_...F..4....G..4....H..4....I..5....P..5X...Q..5....R..5....S..5....T..6....U..6...V..6T...W..6~...X..6....Y..6....`..7#...a..7M...g..-....s...P...w..-U...x..9....}..%....}..Sw.......0......9D......-.......-...............&.......S.......9........E......Y.......:........p..............:>.............&.......S.......'!......:n......T.......tF..............Z^...p..,....p..G........y...............C.......W...............................!..............................,'...............U...............N...............?.......~.......................i........../..f"...;.......;.......;...&...;.......>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_ru.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	717598
Entropy (8bit):	5.446853092138487
Encrypted:	false
SSDEEP:	3072:DyRSPNZ1yv7lLOQRRABLE9jqlM79P6+WlP9gyI6tuTCTWgObD2HBviGp/BM5lOU7:GRkZCzRURi9P6+WlPiSIC9BuOUun2
MD5:	494CC6C2A9DD25258FFD581CB3BEC0B9
SHA1:	0349C46E380F00E958446D5A5EC95B18CC121050
SHA-256:	DCCC231D1A6FF0C404D3663DD5A48DA1E99001A63E7AE46D066675269AB8324B
SHA-512:	2351B4E6F9349DC85BAEE004E4E66A6A9B6DF2EEAD19A9C4F119457E88F20C0FFECFF78C755008F9CF7E473DEE66CF39754F1563046A387F60C23B5E8A3541B7
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%...l...%.......%..Ba...*.......,..^....,.......................0.......1.......1.......1.......2.......2.......3......4.......5.......5...=...6...7...6...d...7...{...7......8.......8......9.......P..2....P..8j...m.......s..#l...s.......s.......s.......s.......s...y...s..{l...s...T...s...q...s...]...........@...,...A...V...B......C......D.......E.......F...(...G...R...H...\|...I......P.......Q...!...R...K...S...u...T......U.......V.......W.......X...G...Y...q...`.......a.......g.......s.......w.......x..9>...}..&v...}..Sq..............9n.......................2......'.......S.......9...............9.......:8.......E.............:h.......p......'m......S.......'.......:.......T.......l[.............:\|...p..,....p..0......._K......_m.......`......................................P.......$.......g.......Z.......%.......".............................o........D.......{.................................../..G....;......;.......;.......;.......>...z...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_sk.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	739337
Entropy (8bit):	4.898881923540837
Encrypted:	false
SSDEEP:	6144:tR8XzOKlAaefO7NPZwCHXPagH5grMoFcii:tnah7NPZwCHXPagH5grMoFcii
MD5:	5A881F3A6D73EF9BD699B66A2C951736
SHA1:	B2FE402E4FFB60CCDB48A93A689F882A2E67EE94
SHA-256:	76308EBC5E685CEC3A72C16473D0730F2364AA421591BB9E41FA505A7915A74F
SHA-512:	5F02568D7F22AF88AA5CB4883A62ED89B9D7A091409FA0774F21A1375E67B407A924407A09E0673972B230DAF4C76178BDC484AF41BE8FDFF2A8FFD09BB41E61
Malicious:	false
Preview:	<.d....!..`...B...H...%.......%......%.......%..o......4....,..v....,..................!...0...$...1.......1...@...1..6....2......2..8`...3..:+...4..:....5.......5..:....6...[...6..:....7.......7..;....8.......8..;B...9..;i...P..3i...P..OD...m.......s..#....s...N...s.......s......s..&/...s..8....s.......s...<...s...A...s...9...........@..6....A..6....B..7....C..7:...D..7d...E..7....F..7....G..7....H..8....I..86...P..8....Q..8....R..8....S..9....T..9/...U..9Y...V..9....W..9....X..9....Y..:....`..:R...a..:\|...g...c...s...@...w.......x..9....}..&....}..T-..............:........7......................'>......TT......:........*......Z+......:........U..............;..............'.......T.......'.......;H......T.......t..............Z....p..-$...p..G........................z..............................%.....................................-........................l.......$.......+.......^...............................U.......w.../..f....;.......;.......;.......;.......>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_sl.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	757139
Entropy (8bit):	4.8169732177115865
Encrypted:	false
SSDEEP:	3072:VQzfAcikS0NnOHCBTYwEEcOfPAi4j/9EblSxzReO1iUfR0ojVy0QJPU8cKlNpFTB:VQS7ClblSxzReTl9eSKrWKVTtvW
MD5:	27F7F23116E75240B4524FC4B32B7D9A
SHA1:	75FF53C06019C229C8084E18CBD23EA53E687672
SHA-256:	35E33400C17CB0D442468C4BB68F38A8B0E18DDAFBAC42034F6CEAE70E7DC842
SHA-512:	60B11682F9BD1CE02D30255E5A383812B17172EF782F90F99C5C43314C73142EED69BC02E41E50808F7CCAA706127674A167CA2358795FFC1E12BB88F637CEF2
Malicious:	false
Preview:	<.d....!..`...B......%.......%.......%...&...%.........<H...,.......,...z..............>9...0.......1.../...1..>X...1..{....2..?B...2..}Y...3...$...4.......5..B7...5.......6..B....6.......7..B....7.......8..CS...8...;...9...b...P..3/...P..c....m......s..#....s..''...s......s.......s..Io...s..b....s.......s.......s.......s..........>....@..{....A..{....B..\|....C..\|3...D..\|]...E..\|....F..\|....G..\|....H..}....I..}/...P..}....Q..}....R..}....S..}....T..~(...U..~R...V..~\|...W..~....X..~....Y..~....`...K...a...u...g..X6...s.......w..X]...x..9....}..&....}..U.......BV......9.......X.......X.......O.......' ......U:......:W.......w......u.......:...............C.......:...............'.......U.......'.......;.......U.......~...............vV...p..,....p..[.....................V[.......g......V.......V.......W.......................................Qa.......`...............I.......<.............WO......W.......W.......X......./......./..../.......;..2r...;.......;..(....;..Ls...>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_sr.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	754415
Entropy (8bit):	4.818278055468074
Encrypted:	false
SSDEEP:	6144:7YKnUHlEdFmdFUknGBK7QtVOh5GmRCrJlkNBexel7GsZ15nY:22dYvUknGBK7QtobkrQNBexcrm
MD5:	3501FFC2E81C6CE9ADA078F1726AA5C9
SHA1:	33717EE922B2DE5608E3F494D60C72A22EEF9136
SHA-256:	4551006E9D4C577E619E1AA1213362FF930ABC29AB1DC0D06473A0BA29338717
SHA-512:	1D61E06CECB36578BA42AD38D978D6955E30CE67D766A9B4781324222A6C6BD2548ECAA6A462D2BF6F3D45D7C1D6508DB2A031ED6459F2F0C69BA452DA0B5F0E
Malicious:	false
Preview:	<.d....!..`...B......%.......%.......%...F...%.........9r...,.......,..................1+...0.......1.......1..1J...1..p....2..24...2..rm...3..t8...4..t....5..5Y...5..t....6..5....6..u....7..6....7..u(...8..6u...8..uO...9..uv...P..3....P..`(...m...z...s..$....s..$u...s.......s...u...s..D....s..^....s...j...s......s...C...s...5......1....@..p....A..p....B..q....C..qG...D..qq...E..q....F..q....G..q....H..r....I..rC...P..r....Q..r....R..r....S..s....T..s<...U..sf...V..s....W..s....X..s....Y..t....`..t_...a..t....g..T....s.......w..T9...x..:<...}..'....}..T.......5x......:l......S.......T.......F.......'.......U.......:........I......r.......;6.......t......6(......;f..............(.......U[......(9......;.......U.......{j..............s....p..-~...p..X.......................K-.............Kd......K.......K........u...............[..............L................W.......Y.......f..............L.......L@......Lw......L.......#.......#..../...L...;..-....;...y...;.......;..AY...>...O...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_sv.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	729158
Entropy (8bit):	4.854619257659071
Encrypted:	false
SSDEEP:	6144:9pIYVvU26c3sg/vV5XQT2DpxGTqNcPoXXRTYSLxooKI:9pXvUrctV5XQT2DpxoFoHR0S5KI
MD5:	2F7BF4D51EF873B82DABB4E48A3128CE
SHA1:	2EB05F6157A2B503A6B1DF1051DBBDA045C52299
SHA-256:	0B676AFAD22414F56E7FCE88C2FD45105125D2E1834A9EE6E18F6C725BB3DA88
SHA-512:	197AB28EC792530646D8B04292806BD23A3E1BB02A0A3C1D9EA3C639D23DAC927F99ADAFE2DFE1CDC199002C798DB0B32ADC34EE54ECB0F547E39A6B87E6F934
Malicious:	false
Preview:	<.d....!..`...B......%...L...%...N...%...Z...%..W......,....,..l;...,...........0.......}...0.......1.......1......1.......2......2.......3...n...4.......5...{...5.......6.......6...7...7...+...7...^...8......8.......9.......P..1....P..F...m.......s.."R...s.......s.......s.......s.......s..%....s.......s.......s.......s...........]...@.......A...)...B...S...C...}...D.......E.......F.......G...%...H...O...I...y...P.......Q.......R.......S...H...T...r...U.......V.......W.......X.......Y...D...`.......a.......g...4...s......w...[...x..8,...}..%>...}..Q..............8\..............................%.......R.......8...............M]......9&.......4.......J......9V......._......&5......Rk......&g......9.......R.......l..............M....p..+....p..>.......w.......w;......................................<.......C.......Z..............................r.......................................s.............................._........../..Y....;...H...;.......;...P...;...k...>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_th.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	700210
Entropy (8bit):	5.513511897062812
Encrypted:	false
SSDEEP:	3072:fP4QXHWTbBo8Sh6wmBtF/79HmAUQ7h2DH1h4o0wh7fWtuAd9yVXtfInTn66Ohih6:oQXHWXBo8SIvUQ7h2DHN0u/IB6C76
MD5:	764610C1F11CFC81A1908CE8D5CF9388
SHA1:	AA618E1DB8AB55EC875072935835C124B1CC0F7B
SHA-256:	7B364B60A4C49A9F5935EA9B85B3D1CD3A36E7EE63056610DE66C014D12F5B2C
SHA-512:	125C683F65B722C70C882F606021CB4595D228094E9ACF5C6D36E46C672075A87AED9A30EE412C5C2A27C92201D3AF6DBE13781CFB35F0F03F5DA769682C883C
Malicious:	false
Preview:	<.d....!..`...B...H...%......%...F...%......%...).....$....,..Q....,...........Z...........0.......1.._u...1.......1...7...2.......2.......3.......4...H...5...s...5...o...6.......6.......7...#...7.......8.......8.......9.......P..0....P..-V...m...a...s.."....s.......s.......s.......s...W...s.......s..X....s..y....s..\|....s...........e...@...^...A.......B.......C.......D.......E...0...F...Z...G.......H.......I.......P...)...Q...S...R...}...S.......T.......U.......V...%...W...O...X...y...Y.......`.......a.......g.......s.......w.......x..7....}..$....}..P...............7Z..............e.......P......%.......P.......7........8......+.......8>.......k.......B......8v.............%.......Q1......&+......8.......QX......b...............,l...p..+....p..&?......&.......&.......{........n......{.......{.......\|-..............."...............L..............................................5.......\|b......\|.......\|.......}.......wc......w..../..7h...;...K...;..HF...;..PS...;..rt...>...V...

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_tr.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	716770
Entropy (8bit):	4.975781833595291
Encrypted:	false
SSDEEP:	12288:jhuHMS7eCPyi6Hv0L+P5ufwARBUNpGSfv9iYc:eMaeCPyi6H9yUNpHNe
MD5:	94B21B5BF369946448E57B0AB5FC837B
SHA1:	485EEA32EC2130E607B3D8DF49CA6A34A77FAC26
SHA-256:	C4CC34B47137FD310D7C3B1CFD0ED07AA7FABA8EFB02E2CAAD833D9178CF14E1
SHA-512:	4C1A84B08F6E0DA2A9AE64980E0072274D990AAF081579B641DB6B85DDBFC5A312FED7B770B63B17A19884F6E151C88B95FE239406C6DE459FC54E8C0D20C980
Malicious:	false
Preview:	<.d....!..`...B...H...%...;...%.......%......%..6e.....,....,..^=...,...........v.......A...0.......1.......1...`...1...%...2...J...2.......3......4...6...5...)...5...]...6......6......7.......7......8...E...8.......9.......P..2....P..7....m.......s..#X...s.......s...]...s...?...s.......s...]...s..xz...s...n...s...e...s.../.......!...@...L...A...v...B......C.......D.......E.......F...H...G...r...H.......I.......P.......Q...A...R...k...S......T......U.......V.......W...=...X...g...Y......`.......a.......g.......s...,...w.......x..8T...}..&4...}..Q........H......8................Y.............&.......Q.......8...............;+......9Z.....................9...............'+......R.......']......9.......R2......j...............;....p..,l...p..0y......Po......P........................................M.....................................k...................... .......`......`)...............................!.................../..G....;.......;.......;.......;.......>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_vi.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	722680
Entropy (8bit):	5.145697786446383
Encrypted:	false
SSDEEP:	3072:esZ66YfZ4R61vIMeeS35iYNl4kdkWlz54+GxiqklnRGLlflKo8+Z8iQYiB2yoTC6:hZIWDMeAfWlz54+G02F6tlv/qJJ2ogm
MD5:	0D03464BF2387B8730A25D9E40333990
SHA1:	2152B2FFF08D066AE616FDA31678DC0551E73C5E
SHA-256:	F6D8E728BAB858EB52DAF06F18F3405880916D5631FF1F23A1E32371BD869AF6
SHA-512:	D05833BB454FBEB0A005881D4E32D90444E14383A8AB0FECF516DD8F5512ACEC99F02BCBBD84B07A6234CF01C730BCCE2701D7050DE80D973F8C75F33C8C4588
Malicious:	false
Preview:	<.d....!..`...B...H...%......%.......%......%..Cg.....,....,..a....,...........D...........0.......1...o...1...8...1.......2..."...2...~...3...I...4.......5.......5.......6...]...6.......7......7...9...8.......8...`...9.......P..1....P..;....m......s.."v...s.......s......s......s...W...s...5...s.......s.......s.......s...[...........@.......A.......B.......C...X...D.......E.......F.......G.......H......I...T...P.......Q.......R.......S...#...T...M...U...w...V.......W.......X.......Y.......`...p...a.......g.......s......w.......x..7....}..%V...}..Q...............8 ...............y..............%.......Q.......8........"......@}......8........M..............9 .......x......&Q......R9......&.......9P......Rb......k..............A....p..+....p..4.......b.......b........J.......r.............................................=.......................................X.......T......r........&.......]................................../..L....;......;.......;.......;......>......

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_zh.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	582207
Entropy (8bit):	5.864166880176526
Encrypted:	false
SSDEEP:	12288:LsX0ZYu4Jckvla1Pue0kA3GECfkc1J5oMbYBLSu6/:Li0ZYVJFla1Pue0kA3GvdsGYBLSuu
MD5:	5AE114C0869A646A09B4214C9AAF3621
SHA1:	7011929391153D2AB684D3DD609ACC3ADFDDCF4B
SHA-256:	1748AF38A6EB093DF24A1D3217B0F0C796FC3B8B7FB5FDD63D3412C3538B114A
SHA-512:	BA1E85AC7C519CA73C4C7F52F5A40204502156365DA94C9744048C42D6C2BDCEB14F00122EFF2F8C7B840D40E515E7B081C5EFAF803EA5A82AAA3AA363ABA91B
Malicious:	false
Preview:	<.d....!..`...B...p...%.......%..F....%..h....%.............,...E...,..................9=...0.......1.......1..9\...1.......2..:F...2.......3.......4...S...5..<....5...\|...6..<....6......7..==...7.......8..=....8.......9... ...E.......P..&....P.......c.......m.......s.......s...[...s.......s.......s.......s.......s..)....s..E)...s..Hv...s..K.......8.......9....@...9...A...e...B......C......D.......E.......F...A...G...m...H......I.......P.......Q...F...R...r...S......T.......U.......V..."...W...N...X...z...Y......`.......a...'...g.......s...7...w...9...x..,....}.......}..Ct......<.......,L....................................C.......,........`......k.......-...............=\......-<......................C........%......-j......D.......D%..............l....p.."...p..........K........................[......................................m-......)n......................p..............j.......s........z.......O.......................F.......u...............7...................

C:\Program Files (x86)\Ezviz Studio\RemConfig\translations\showremconfig_zh_TW.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	549524
Entropy (8bit):	5.80467059209665
Encrypted:	false
SSDEEP:	12288:CJCNex6Wu5h9A3aIiQJRyzesiBjC/aGNfgE:CIFWu5h9A3aIfJRyz/iBjQaGNfv
MD5:	BFF5742CBC7640E7769C7EDEEFB98BA0
SHA1:	FB8DF1A9EEAD0A7A6D548B619CE6B2B6FD7938A3
SHA-256:	FCDB9E4AE61AD82306DC97F9138A6C6A17AC6DCB218CE2126D37EB916B88CEA2
SHA-512:	79444D57EDEBE9363C1A0531F41C320DE11AB25D6EA4B2482C9C67939138CA12B31F5C4B42684051F34DF43D1BB12C9519E37531DF096CEE23F71D513553CCB2
Malicious:	false
Preview:	<.d....!..`...B...H...%..dY...%...v...%..=....%..~.......i...,.......,..H................7...0..Z....1...%...1...V...1..X....2...@...2..Zl...3..\7...4..\....5......5..\....6.......6..]....7...7...7..]'...8.......8..]N...9..]u...P..'....P..u....m...U...s.......s......s..a]...s.......s......s...]...s......s...f...s.......s...............@..X....A..X....B..Y....C..YF...D..Yp...E..Y....F..Y....G..Y....H..Z....I..ZB...P..Z....Q..Z....R..Z....S..[....T..[;...U..[e...V..[....W..[....X..[....Y..\....`..\^...a..\....g.......s... ...w.......x..-@...}.......}..A...............-p.......y.......)......C...............A.......-.......g.......6Y.......2......g........V.......`......h...............B5.......1..............BX..............h/......6....p..#6...p..n.......KO......Kq......;.......e.......;.......<.......<M......<6.......2.......e.....................?......n2......_...............V;......<\|......<.......<.......=..................../..?....;..oi...;...R...;.......;..4....>.......

C:\Program Files (x86)\Ezviz Studio\RemConfig\zlib1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	5.8489695835244095
Encrypted:	false
SSDEEP:	768:bw6vENCUvhLcSCE/StC0KuFLRO5ZikoHBc1m7s4wixE+XwVY/nToIf18IOsIOIiy:bDvENBhA+WjPLAVY/nToIfCIOsIOIip
MD5:	72E87AD407BB28F5B471C3396296B377
SHA1:	15CD01170FF8D8531FB16F4F7A1C5FBE810A1057
SHA-256:	91EC6085E862E1EEDC254BF88EFECD4FA67F486216AB3B1473915D15462E71BB
SHA-512:	1569939514C0E30E2FBF7D81586ADA53931AC36B11F306B95B5E0741C6B32C45D88D33271223C99CD4FBD585F0675D5188557E5DFE6901F9FBB2E3E8EC98A698
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2.@.2.@.2.@.:.@.2.@.:.@.2.@.2.@.2.@.:.@.2.@.>.@.2.@.>.@.2.@`9.@.2.@.>.@.2.@Rich.2.@........................PE..L......L...........!................3.............LZ.........................0..................................................<............................ ......`...................................................H............................text............................... ..`.rdata...H.......P..................@..@.data...P...........................@....rsrc...............................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\SPUpDateClientLib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.744133942517966
Encrypted:	false
SSDEEP:	192:+y8C5Y1b47ZwpPgTWDoC0AXZb5kTEahf/0EYbRlmJsEY2BOE/V8462vZYL3X+Eqg:+y/Y1b47Z6oTMoVAXZbyTEahn0DlmJ7W
MD5:	ED7CD45B77EEC58D56C431CB6D353E38
SHA1:	52707751E374AC86E2BE8CFC7C9C43FCB0CA52B5
SHA-256:	C1FD80868EE87CB1C5FADF20637C8CD93D237050679DEBC8B77761655078CFB6
SHA-512:	8EBD1EF51653C337856883348B6CD586B17D16351A727928D3C0BF0FE1FCD236AB1BDB57F0253145242B8316FF3F228569A9AE038284E1B8D5411B87FACB58EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................................................................Rich....................PE..L....rT...........!.........................0...............................p......q.....@.........................p<.......5..x....P.......................`.......1..............................p3..@............0...............................text............................... ..`.rdata..6....0......................@..@.data...x....@.......&..............@....rsrc........P.......(..............@..@.reloc..Z....`.......,..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\SuperRender.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1294912
Entropy (8bit):	6.846526859175664
Encrypted:	false
SSDEEP:	12288:X7ZQw63LBDrNN3cXUeXXJVecG5Y0HZ4FX/8bOfCHAjvynt2Ap3Dv7pA2h7NGqH53:mDC8bOIxtCOEGqYJAew1dMZV4E
MD5:	5399BCE33FABE1E1BE06619FCAC1638A
SHA1:	17D0719D53D51F4A537F4D9C506BFB6797F9968F
SHA-256:	70C2884506FA0F885B4DEF55E74CF9FD033330F3AD8F9C8E6F9047C3454373EF
SHA-512:	4CC1747291B0FB5CB8B50E5399EDC0E6F2DFC8566D46E4EFA1C5CF04DFBE9DDFB9292A1B623F2B51C241340A597D11EFF2F3F7F82C90182868601D1A9A683726
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................-......&...............+...............r.....................................#......5c......%.....Rich....................PE..L......b...........!.................]..................................................................................u...d...x.......................@ ... ...b...................................................................................text............................... ..`.rodata.8........................... ..`.rdata...1.......2..................@..@.data...(.... ...F..................@..._RDATA...............2..............@..@.rsrc................4..............@..@.reloc...f... ...h...:..............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\SystemTransform.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	589824
Entropy (8bit):	6.503653225543875
Encrypted:	false
SSDEEP:	6144:395tgBH8acQEZB3rWhJEpRKmGdFrqk9b03QQwMUjAD57EAOOnXGbhvxVs:2ctB7Wi5ku3QYUjA17Em
MD5:	C39F735AF346571257DAA8F637C2D00E
SHA1:	DAF544EDD624005D6C28CDB3E68630FA3FF07E71
SHA-256:	F616E513BD345E7CDCF994786C1CF60F760C9E8CCAF9CA329DA036D76FBB2AC3
SHA-512:	678A44D3B7902D9FF03D84C9F9D611043A8CA25F6C6A63574FF1EB081D98209C5E827CF0046E5E43E73621A193A547AC6F259D68D3C9FC07134605D6FDAFA0CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%_.tv_.tv_.tvA..v}.tvx%.vZ.tv_.uv3.tvA..v[.tvA..v..tvA..v..tvA..v^.tvA..v^.tvA..v^.tvRich_.tv........PE..L...U..Y...........!.........f.......K..............................................tv..............................`...........<...............................`0...................................j..@............................................text............................... ..`.rdata..............................@..@.data............2..................@....rsrc...............................@..@.reloc..\|2.......4..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\VShowToolKit.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1227776
Entropy (8bit):	5.947332935754226
Encrypted:	false
SSDEEP:	12288:UWpjwsQwaQwQUx/Xfa3J6H4MukMF3bkgmPaiA5tBoTZP36Anr9T/yUbUcKw:HuXfa3JaukM5bkgmPH0AZPRnr1yUbV
MD5:	541D730FFA2F07AA461D60BECB00E7CB
SHA1:	A8B46AB5DC41BA21C76B296664EE5F74C793FF98
SHA-256:	9D1F61665E4B8BDDEADC1E3C47A6B0C861166349C5C3B3EA3C43297FAA07521E
SHA-512:	CD6B38D0B20679B4F6F18EC858DF734DAA6836BF9A9F2801FA571411BFE45507D8667F5F779B7FC631388A2B69D1CEDD4D01FE8FAFBEAA57A412FA578ED92006
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................=.4....7....!...].....1..........&......0....6....3...Rich............................PE..L...r.e...........!......................................................................@.............................re...P......................................P................................v..@............q...!...........................text............................... ..`.rdata..2-..........................@..@.data....&... ... ..................@....idata.......P.......$..............@....rsrc...............................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\YUVProcess.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	527424
Entropy (8bit):	6.814434563171184
Encrypted:	false
SSDEEP:	12288:Oez6M+2rR7o01tLSilzsrduQgqLbUIj1fEWmk:L6KG3iNogYpjOZk
MD5:	ADF22207DDF0F16F72A8C6317E609341
SHA1:	74AFC9D14F2A3B78F0DA9D18D58CD6DEDB542DA6
SHA-256:	ED9A37C6B2BEE95E49BD12A64F826A0D9D648ADD88480CD614EBF73BEBBED8CF
SHA-512:	F7D4632BEB0BB4C8E326AD6F833927B118A515F9FE9CDFAB61DADBFBB4196D1D349F37009FDC0F642C488B5DB22B92576D498641691AD555D8CD513A0D25E007
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%...D.S.D.S.D.S.<%S.D.S.<3SdD.S...S.D.S.D.S.D.S.2.S.D.S.<4S.D.S.<"S.D.S..$S.D.S.<!S.D.SRich.D.S................PE..L......[...........!................F........................................@............@.....................................(.......................@ ......\ ..p..................................@...............4............................text...z........................... ..`.rdata..c...........................@..@.data...<0..........................@....rsrc...............................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\area.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	9199
Entropy (8bit):	4.293948419348199
Encrypted:	false
SSDEEP:	96:CHAMiJDit8rz1JW849R0M0s0k0YGerrsigSaswsWlnxnTS8SBLLSn9+MwpqlKDQ6:IItNVB/z2b7N1kb24eNslS+q03b0drnr
MD5:	806317F447C17B22E94D668AD2B99201
SHA1:	68F967A8B74929FA0AC73EFC3EE0E5ED143C045C
SHA-256:	CB990103EB7ED3E46F0BE3DEA51D0395EACDD054AAFB0F379B07AE6B191453D2
SHA-512:	43030668373F2FD3C8EAC18CFE52093E2CCACB51F978A6875556FF21BC656F2D4A12074D4A2DA39D92BFCF3A4A13FB3C6C77329A9FF48C7053A77C106EFE7566
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<beans> .. <bean name="name" value="Afghanistan"/> .. <bean name="name" value="Africa Other"/> .. <bean name="name" value="Albania"/> .. <bean name="name" value="Algeria"/> .. <bean name="name" value="Andorra"/> .. <bean name="name" value="Angola"/> .. <bean name="name" value="Anguilla"/> .. <bean name="name" value="Antarctica"/> .. <bean name="name" value="Antigua and Barbuda"/> .. <bean name="name" value="Argentina"/> .. <bean name="name" value="Armenia"/> .. <bean name="name" value="Aruba"/> .. <bean name="name" value="Asia"/> .. <bean name="name" value="Asia Other"/> .. <bean name="name" value="Australia"/> .. <bean name="name" value="Austria"/> .. <bean name="name" value="Azerbaijan"/> .. <bean name="name" value="Bahamas"/> .. <bean name="name" value="Bahrain"/> .. <bean name="name" value="Bangladesh"/> .. <bean name="name" value="Barbados"/> .. <bean name="name" value="Belarus"/> .. <bean name="n

C:\Program Files (x86)\Ezviz Studio\cacert.pem (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	215556
Entropy (8bit):	6.002809648802936
Encrypted:	false
SSDEEP:	6144:CNc5Wb7qxz7d9/UaNR6dTd4tL2b0ObTDdTDs:CNce+1576f4tLe0ObTpo
MD5:	2C43548519379C083D60DD9E84A1B724
SHA1:	F8D2BB6DDE84F58B2C8CAF584EAF0C040E7AFC97
SHA-256:	79EA479E9F329DE7075C40154C591B51EB056D458BC4DFF76D9A4B9C6C4F6D0B
SHA-512:	EB3229DAD039821D1C65295B832BB83DF390D43C9B0A0E65A3A2134C0286A5E6C479E30CC4D7E50C5020C3640E61A6FD423CF3DFECCC8BDA70E0D76D6C0B3A59
Malicious:	false
Preview:	##.## Bundle of CA Root Certificates.##.## Certificate data from Mozilla as of: Wed Mar 7 04:12:06 2018 GMT.##.## This is a bundle of X.509 certificates of public Certificate Authorities.## (CA). These were automatically extracted from Mozilla's root certificates.## file (certdata.txt). This file can be found in the mozilla source tree:.## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt.##.## It contains the certificates in PEM format and therefore.## can be directly used with curl / libcurl / php_curl, or with.## an Apache+mod_ssl webserver for SSL client authentication..## Just configure this file as the SSLCACertificateFile..##.## Conversion done with mk-ca-bundle.pl version 1.27..## SHA256: 704f02707ec6b4c4a7597a8c6039b020def11e64f3ef0605a9c3543d48038a57.##...GlobalSign Root CA.==================.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx.GTAXBgNVBAoTEEdsb2Jh

C:\Program Files (x86)\Ezviz Studio\dbghelp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	940032
Entropy (8bit):	6.4853172826830825
Encrypted:	false
SSDEEP:	24576:4n9OEI7SfQaWOq/hAAB7rWbLgi/yPtsdhu:8OEI7/ZOqtrWEp
MD5:	5C350D0C2B331B342D52D1155A4C160E
SHA1:	8578F708454351A33B304B51214D7B20E4AE9EA9
SHA-256:	412F6C0ED936316275E68E21DF7255E4E35FAD14E114E479E8C5C9D75ECAC88C
SHA-512:	C8C2F0928570802990E5CB4467A6DFFDE5CE6A2BB8D2AEE5E6C25A6879F5CEB96045559BA6C27959F57F05B0E2531B2487FD605137C1E8D18C90B5F21CFAB57F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........SB...B...B....(..C....(..z...b..H...b..I...B.......b..L...b..C...b..i...b..C...b..C...RichB...........................PE..L......@...........!.....6...................P.....................................................................P1......\!..d............................ ......@................................`..H...............4............................text...Q4.......6.................. ..`.data........P...B...:..............@....rsrc................\|..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\gdiplus.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1645320
Entropy (8bit):	6.787752063353702
Encrypted:	false
SSDEEP:	24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
MD5:	871C903A90C45CA08A9D42803916C3F7
SHA1:	D962A12BC15BFB4C505BB63F603CA211588958DB
SHA-256:	F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
SHA-512:	985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..\|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hlog.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	925696
Entropy (8bit):	6.436450532205466
Encrypted:	false
SSDEEP:	12288:fdHcTo9g46seQGDmAAn79wrCuIaDIG6EgxrzRBtkvEb3TcAwjyjPoixPXgMM:FS7lQGDmAAn7yrFILtNkvEb3TzwyjP0
MD5:	72B73C9B303F130791B9244530A098E0
SHA1:	275859B441D49B956EA2A0B8B954917FB733B45E
SHA-256:	AAFDFE5193DFBA135BFD06330EED8BE0DDCC429788BF628303604DAC611DBA5A
SHA-512:	5674FCB65B05E0BED071696F0B836877AD2E4EC2253E3C240C3C5B266B25D3327ADDDA834569AB41ACCB77CD2EBE1076212E4D20F337D3401C9AF62E9D82AEB2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k5<..[o..[o..[oLE.o..[o.r.o..[o.r.o..[o.r.oe.[o.r.o..[o..Zo..[o.. o..[o.r.o..[o.r.o..[o.X.o..[o.r.o..[oRich..[o........................PE..L...qy.]...........!.........x.......W.......................................p............@......................... ........Y.......0..h....................@......................................0...@............................................text............................... ..`.rdata..............................@..@.data...Hy.......Z..................@....rsrc...h....0......................@..@.reloc..P%...@...&..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hlog2.intlog

Download File

Process:	C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	687
Entropy (8bit):	4.8521630042069575
Encrypted:	false
SSDEEP:	12:uKU7zw0G/UJ6ClBr8U7zw0G/2Dx/sO+rEU7zw0G/UJ6ClBr8U7zw0G/2Dx/sO+rd:Fwz91cCv8U7z9rDyO+oU7z91cCv8U7zW
MD5:	2167F8281E88F35C5681CF9C5F8785EB
SHA1:	F5B10A3B63A02E1A8794D8EAD6B38AAA5B9E4E8F
SHA-256:	A631390CD0667CA7D4AD197A0F9D6F146EB5DB3FDEA4251BF69512F838EFACF3
SHA-512:	35D714A2204F747872C664628086DDB8DAD33FF01B646F96B226499FEE76B47382D68078198CCE09FEB1FD37A930C30205A5D3045F5D5CC3B4120200F4740436
Malicious:	false
Preview:	[ 04/19/24 10:16:12 ..\src\main\cpp\optionconverter.cpp 312 ] Could not find value for key log4j.appender.stdout..[ 04/19/24 10:16:12 ..\src\main\cpp\propertyconfigurator.cpp 407 ] Could not instantiate appender named "stdout"...[ 04/19/24 10:16:12 ..\src\main\cpp\optionconverter.cpp 312 ] Could not find value for key log4j.appender.stdout..[ 04/19/24 10:16:12 ..\src\main\cpp\propertyconfigurator.cpp 407 ] Could not instantiate appender named "stdout"...[ 04/19/24 10:16:15 ..\src\main\cpp\optionconverter.cpp 312 ] Could not find value for key log4j.appender.stdout..[ 04/19/24 10:16:15 ..\src\main\cpp\propertyconfigurator.cpp 407 ] Could not instantiate appender named "stdout"...

C:\Program Files (x86)\Ezviz Studio\hplug.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223232
Entropy (8bit):	6.467007978478341
Encrypted:	false
SSDEEP:	6144:Mnp1oXTWXXo/TZDZlntqmH9Rh+0VeOtDlh:Mnp1dXX+TZDfntqmH9Rh+w1h
MD5:	5DA063D6106FE5357DDB75757D940B6C
SHA1:	1BFC544A331DF6244F66DCFC700D6F683CEF3D7C
SHA-256:	221CD8B137E3C56BC27DAF78E15F3B33EE8CF2293D4E1525156EB95664E4F1DD
SHA-512:	E4D68CE34C44BF09451C0A5DA9AB49B4A39BD18E26C2EA2D539C23537CCC6D60EF64620784150F677B1479D137CBB97C0868AAF971DA8A376A8521DEA9BD1F99
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+R,.o3BIo3BIo3BI.\|.In3BIfK.In3BIfK.I`3BIfK.Ig3BIH.9Im3BIfK.Ii3BI.,FIl3BIo3CI.3BIfK.Id3BIfK.In3BIqa.In3BIfK.In3BIRicho3BI........................PE..L.....tS...........!.....v..........S[..............................................El....@.........................P,..........x....@.......................P...4......................................@...............T............................text...Ku.......v.................. ..`.rdata...............z..............@..@.data...t....0......................@....rsrc........@....... ..............@..@.reloc...@...P...B...&..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\Client_DataCenter.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541696
Entropy (8bit):	6.348513063083184
Encrypted:	false
SSDEEP:	12288:ThxI4rBwzTMblGM1Z8Q6e0AmWJZOPdrsz7WcWop+AAXwZTrPHv0L:agblGM1eQ6e0AffQdrsz7Wctp+AAXwZA
MD5:	8906D1412F27CC067BBEA8AFF0E6D9CA
SHA1:	2EFD514BE511711C84D39686536C8AF83AB4072B
SHA-256:	D40F346F89FAC055FD180C872F19760BECF65235D0992F3CECEF098F60136639
SHA-512:	20C28C567F69243D0B03C8F8FBB92204723E81C39EB277AB4CF992C9B8BC8E753BEA164C24520A5E8A4E16A6DD88E73D14D862C55FF62FCCBD8F5A789B0E64C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.f.+.f.+.f....(.f.".../.f."...$.f."...".f..(..!.f."...8.f.+.g.;.f."....f."....f.5....f."....f.Rich+.f.................PE..L...c.e...........!.....B...................`...........................................@..................................n..........(.......................X....c.............................. ...@............`...............................text...+@.......B.................. ..`.rdata...1...`...2...F..............@..@.data....'...........x..............@....rsrc...(...........................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\LibDataAccess.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.404634465764856
Encrypted:	false
SSDEEP:	1536:S9RVUqAyonEZRNEFr6bpQlLRfk4Ti0uw8IGxlvByGhRhfD:S9RVUqAyHZgrf1eIGZyORhf
MD5:	F21007192D5DC743D37CFCF14904A01A
SHA1:	4B7BEECEB0F470EFE9FB21CED776D93AA6FFE5DF
SHA-256:	76029693021C9FACF117742158C1B2D686E4A44AA5795AAE0977CD0E1C248ED7
SHA-512:	237EA574E1F470F180CC05995334C063772B7414A2B8925E511BBCA4F7CC945692B02660761ED49CB388BD50DBF7EC4B7C40480D088F51F1CD46A7806D27B7C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r..!6c.r6c.r6c.r?..r c.r?..rXc.r...r4c.r?..r5c.r6c.rVc.r?..r.c.r?..r7c.r?..r7c.rRich6c.r........PE..L.....e...........!.....:...x...............P......................................~.....@.........................P...A.......<...............................,....Q...............................v..@............P..D............................text....9.......:.................. ..`.rdata...B...P...D...>..............@..@.data...$1..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\QtCore4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2554880
Entropy (8bit):	6.591414672760471
Encrypted:	false
SSDEEP:	49152:XL2lv4yEptIJxK5IFJsv6tWKFdu9C1TzLyvL/6mShMZtmjNUVrciV5P+7QVg07s1:72lcXIrU6Jsv6tWKFdu9C
MD5:	9945C8F8EB3DF171E1B576A9009D5117
SHA1:	FC07A2A6FD15989D71E2C4B5FF0377C2EB34CA21
SHA-256:	366BE6E5BAD7CAA4989D5339DBF68CEC42CF5A5EDF8573AAE85EF37222CC7C0B
SHA-512:	6DAAFF96046C80B197A3E0B5AD879015949C720F114B5D42B0DC7DB482873919294540DFE0B3B1D9E65B984BFFDCC77969904A6835CA8EF77539C58C6ED1310D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#...#...#..el...#...q...#...q...#.......#......#...#..."...q...#...q...#...q...#...q...#...q...#..Rich.#..........................PE..L......R...........!.................f.............g..............U..........@'.......'...@..........................U!.Pv...9!.......&...................... &.8...................................(j..@...............\............................text...n........................... ..`.rdata..P...........................@..@.data...`2....%..,....%.............@....rsrc.........&.......%.............@..@.reloc....... &.......%.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\hplugin.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	163
Entropy (8bit):	5.2824472017030155
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCaeCuFpJXeDBJYrs0dtXsxrYH++9R6Sp1JJEdmKECb:TMVBdzvpMgdKrYHPEdmfCb
MD5:	B62D4FB86CAA0C6E65DE55ABFAD9DE8A
SHA1:	E5C7BA812C6ED9FC65ED1DE25CF8DA0A7C423CCB
SHA-256:	E602842915FB92736E9EFC79C7B3311D6BB38D016552AE723EEFA0A5CE3A9E30
SHA-512:	7211D76920D4C6A11D5CE261D36C184E26598381FC0EE797EB5DB593D9C5E3882E513D3D1EAE225FDD3FCBE612389965885A520A4AA82733C519048E912582D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<hplug>.. <plugin fkey="6F26865C-8AAB-4433-A898-535CAEFCA387" file="./Client_DataCenter.dll" delayload="true" />..</hplug>

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-3N6JU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70920
Entropy (8bit):	6.725045615172787
Encrypted:	false
SSDEEP:	1536:Xmk3WI3AQy6m5MNSEo/Iu/uH13jZjLBtHcN4OrE67lIofdUeF:XmowQy6m5M8Eo/Iu/uHtJLANjE6JF
MD5:	5AD00C0F6659230CD34AE66E9EF95145
SHA1:	E347AF29C1710DCCA479F8756569B74CF0AAC041
SHA-256:	A6A6F1592AA3E43060A3FB87ED3D61007326407FD53B61CBDBF0FD039CE70CD8
SHA-512:	EBA5E6D4C1294FD3024206FC617E1798DFE289CDB858CA12BED8766D89A5F132CADC5191A284950D14E6960BF7C0A2849AC00D54289677F54D6456E1A7ECDBB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u6.m.e.m.e.m.e.".e.m.e...e.m.e...e.m.e...e.m.e.m.e.m.e..`e.m.e...e.m.e...e.m.e...e.m.e...e.m.eRich.m.e........................PE..L...^.J...........!.........@......&........................................0......ka..............................0.......L...d.......p.................... ..0.......................................@............................................text...:........................... ..`.rdata...).......*..................@..@.data...(...........................@....rsrc...p...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-F3UAA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	163
Entropy (8bit):	5.2824472017030155
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCaeCuFpJXeDBJYrs0dtXsxrYH++9R6Sp1JJEdmKECb:TMVBdzvpMgdKrYHPEdmfCb
MD5:	B62D4FB86CAA0C6E65DE55ABFAD9DE8A
SHA1:	E5C7BA812C6ED9FC65ED1DE25CF8DA0A7C423CCB
SHA-256:	E602842915FB92736E9EFC79C7B3311D6BB38D016552AE723EEFA0A5CE3A9E30
SHA-512:	7211D76920D4C6A11D5CE261D36C184E26598381FC0EE797EB5DB593D9C5E3882E513D3D1EAE225FDD3FCBE612389965885A520A4AA82733C519048E912582D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<hplug>.. <plugin fkey="6F26865C-8AAB-4433-A898-535CAEFCA387" file="./Client_DataCenter.dll" delayload="true" />..</hplug>

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-F9P72.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541696
Entropy (8bit):	6.348513063083184
Encrypted:	false
SSDEEP:	12288:ThxI4rBwzTMblGM1Z8Q6e0AmWJZOPdrsz7WcWop+AAXwZTrPHv0L:agblGM1eQ6e0AffQdrsz7Wctp+AAXwZA
MD5:	8906D1412F27CC067BBEA8AFF0E6D9CA
SHA1:	2EFD514BE511711C84D39686536C8AF83AB4072B
SHA-256:	D40F346F89FAC055FD180C872F19760BECF65235D0992F3CECEF098F60136639
SHA-512:	20C28C567F69243D0B03C8F8FBB92204723E81C39EB277AB4CF992C9B8BC8E753BEA164C24520A5E8A4E16A6DD88E73D14D862C55FF62FCCBD8F5A789B0E64C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.f.+.f.+.f....(.f.".../.f."...$.f."...".f..(..!.f."...8.f.+.g.;.f."....f."....f.5....f."....f.Rich+.f.................PE..L...c.e...........!.....B...................`...........................................@..................................n..........(.......................X....c.............................. ...@............`...............................text...+@.......B.................. ..`.rdata...1...`...2...F..............@..@.data....'...........x..............@....rsrc...(...........................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-NKU9P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.404634465764856
Encrypted:	false
SSDEEP:	1536:S9RVUqAyonEZRNEFr6bpQlLRfk4Ti0uw8IGxlvByGhRhfD:S9RVUqAyHZgrf1eIGZyORhf
MD5:	F21007192D5DC743D37CFCF14904A01A
SHA1:	4B7BEECEB0F470EFE9FB21CED776D93AA6FFE5DF
SHA-256:	76029693021C9FACF117742158C1B2D686E4A44AA5795AAE0977CD0E1C248ED7
SHA-512:	237EA574E1F470F180CC05995334C063772B7414A2B8925E511BBCA4F7CC945692B02660761ED49CB388BD50DBF7EC4B7C40480D088F51F1CD46A7806D27B7C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r..!6c.r6c.r6c.r?..r c.r?..rXc.r...r4c.r?..r5c.r6c.rVc.r?..r.c.r?..r7c.r?..r7c.rRich6c.r........PE..L.....e...........!.....:...x...............P......................................~.....@.........................P...A.......<...............................,....Q...............................v..@............P..D............................text....9.......:.................. ..`.rdata...B...P...D...>..............@..@.data...$1..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-OO7KH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	6.426761452579602
Encrypted:	false
SSDEEP:	6144:x4siSWNEonsEul5fNbSp4sul7zrUypnFHc6adK4R7Cd/a3va5ivZv14xkZjNfAbq:x4MWNEcsEul51bS+tlXrUyBFHc6adK4x
MD5:	6BC10EEC59B2AB24C24CC544B1A31178
SHA1:	2AA06BA399C7F45E90CB11E32C7C47250B0284D1
SHA-256:	0A906F0002A6637312A56D5FB92434BCFC47FE44636846454226EFE2DF872802
SHA-512:	AF764FAFAE682F433D4C372561DF895AF16E874E867CBAE1D12DBECAE102C3950C565FE6962CAE7F603531E0BF89F3AEB67AC86C5C7B83857A59A7DC3C0C8DE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........qR.u"R.u"R.u"uM."P.u"[.."P.u"[.."Q.u"[.."\.u"[.."P.u"L.."Q.u"R.t".u"L.."}.u"L.."S.u"L.."S.u"L.."S.u"RichR.u"........PE..L...1.LS...........!......................... ...............................`......R...................................p$..,...P.... .......................0..t#..0&..............................(...@............ ...............................text............................... ..`.rdata.. .... ......................@..@.data....1..........................@....rsrc........ ......................@..@.reloc..~$...0...&..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-SN6FQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2554880
Entropy (8bit):	6.591414672760471
Encrypted:	false
SSDEEP:	49152:XL2lv4yEptIJxK5IFJsv6tWKFdu9C1TzLyvL/6mShMZtmjNUVrciV5P+7QVg07s1:72lcXIrU6Jsv6tWKFdu9C
MD5:	9945C8F8EB3DF171E1B576A9009D5117
SHA1:	FC07A2A6FD15989D71E2C4B5FF0377C2EB34CA21
SHA-256:	366BE6E5BAD7CAA4989D5339DBF68CEC42CF5A5EDF8573AAE85EF37222CC7C0B
SHA-512:	6DAAFF96046C80B197A3E0B5AD879015949C720F114B5D42B0DC7DB482873919294540DFE0B3B1D9E65B984BFFDCC77969904A6835CA8EF77539C58C6ED1310D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#...#...#..el...#...q...#...q...#.......#......#...#..."...q...#...q...#...q...#...q...#...q...#..Rich.#..........................PE..L......R...........!.................f.............g..............U..........@'.......'...@..........................U!.Pv...9!.......&...................... &.8...................................(j..@...............\............................text...n........................... ..`.rdata..P...........................@..@.data...`2....%..,....%.............@....rsrc.........&.......%.............@..@.reloc....... &.......%.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\is-TJCPJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1171968
Entropy (8bit):	6.803630293199262
Encrypted:	false
SSDEEP:	24576:b/PuOV5fx786oizQYWg1PWZuVs2QW9YFBnJPX0VpoMhkV46:b/PFtJMUs2QW94P0VpoJV46
MD5:	1E03E56E8EB6EAFCB2C49268172939F6
SHA1:	A75FEB7E69D0C67E3805B824C6A425AC577ED555
SHA-256:	BF95B4E1E49AA532405EC045B0E8D83C7F07A70889975A015025BC3C0BF128D7
SHA-512:	EBE819F12DE5FD2595E7602E3DE2BDBC07F4B255CFD5B77DF26EAA95E2AD9C8EAEBB36CFD91466C7914409F96C4718E37A3A4912EFC2B8E8C225DF11CB150C08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.$...$...$...-.`.&...-.f.....-.p.)...-.w.&...$......C../...:.f.1...:.p.....:.a.%...:.g.%...:.b.%...Rich$...........................PE..L.....LS...........!.........................................................0...................................... B..Q....7..................................<....................................................................................text............................... ..`.rdata..q...........................@..@.data............^..................@....rsrc................>..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1171968
Entropy (8bit):	6.803630293199262
Encrypted:	false
SSDEEP:	24576:b/PuOV5fx786oizQYWg1PWZuVs2QW9YFBnJPX0VpoMhkV46:b/PFtJMUs2QW94P0VpoJV46
MD5:	1E03E56E8EB6EAFCB2C49268172939F6
SHA1:	A75FEB7E69D0C67E3805B824C6A425AC577ED555
SHA-256:	BF95B4E1E49AA532405EC045B0E8D83C7F07A70889975A015025BC3C0BF128D7
SHA-512:	EBE819F12DE5FD2595E7602E3DE2BDBC07F4B255CFD5B77DF26EAA95E2AD9C8EAEBB36CFD91466C7914409F96C4718E37A3A4912EFC2B8E8C225DF11CB150C08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.$...$...$...-.`.&...-.f.....-.p.)...-.w.&...$......C../...:.f.1...:.p.....:.a.%...:.g.%...:.b.%...Rich$...........................PE..L.....LS...........!.........................................................0...................................... B..Q....7..................................<....................................................................................text............................... ..`.rdata..q...........................@..@.data............^..................@....rsrc................>..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\libsasl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70920
Entropy (8bit):	6.725045615172787
Encrypted:	false
SSDEEP:	1536:Xmk3WI3AQy6m5MNSEo/Iu/uH13jZjLBtHcN4OrE67lIofdUeF:XmowQy6m5M8Eo/Iu/uHtJLANjE6JF
MD5:	5AD00C0F6659230CD34AE66E9EF95145
SHA1:	E347AF29C1710DCCA479F8756569B74CF0AAC041
SHA-256:	A6A6F1592AA3E43060A3FB87ED3D61007326407FD53B61CBDBF0FD039CE70CD8
SHA-512:	EBA5E6D4C1294FD3024206FC617E1798DFE289CDB858CA12BED8766D89A5F132CADC5191A284950D14E6960BF7C0A2849AC00D54289677F54D6456E1A7ECDBB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u6.m.e.m.e.m.e.".e.m.e...e.m.e...e.m.e...e.m.e.m.e.m.e..`e.m.e...e.m.e...e.m.e...e.m.e...e.m.eRich.m.e........................PE..L...^.J...........!.........@......&........................................0......ka..............................0.......L...d.......p.................... ..0.......................................@............................................text...:........................... ..`.rdata...).......*..................@..@.data...(...........................@....rsrc...p...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\Client_DataCenter\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	6.426761452579602
Encrypted:	false
SSDEEP:	6144:x4siSWNEonsEul5fNbSp4sul7zrUypnFHc6adK4R7Cd/a3va5ivZv14xkZjNfAbq:x4MWNEcsEul51bS+tlXrUyBFHc6adK4x
MD5:	6BC10EEC59B2AB24C24CC544B1A31178
SHA1:	2AA06BA399C7F45E90CB11E32C7C47250B0284D1
SHA-256:	0A906F0002A6637312A56D5FB92434BCFC47FE44636846454226EFE2DF872802
SHA-512:	AF764FAFAE682F433D4C372561DF895AF16E874E867CBAE1D12DBECAE102C3950C565FE6962CAE7F603531E0BF89F3AEB67AC86C5C7B83857A59A7DC3C0C8DE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........qR.u"R.u"R.u"uM."P.u"[.."P.u"[.."Q.u"[.."\.u"[.."P.u"L.."Q.u"R.t".u"L.."}.u"L.."S.u"L.."S.u"L.."S.u"RichR.u"........PE..L...1.LS...........!......................... ...............................`......R...................................p$..,...P.... .......................0..t#..0&..............................(...@............ ...............................text............................... ..`.rdata.. .... ......................@..@.data....1..........................@....rsrc........ ......................@..@.reloc..~$...0...&..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\PLUGIN_INFO.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.08591184498186
Encrypted:	false
SSDEEP:	6:TMVBdzvp5FNSG9hN9pkqOYHO+5QCdL5FNSG+dK5OYHeJm5QCd1CwH:TMHddJBNcqhfZJYK5KmfawH
MD5:	6376712174D79C2F9C3B7E9DF972EB8B
SHA1:	8589F19D95B4BD3265AD1AAAE5051CF563E16B73
SHA-256:	A1FE66CA233A1DC5F417A826CA8641C9990054CED908253752B39BB8F0211123
SHA-512:	75E0CF2278A5AF2C1A0622F41E215424C03CBFFFCD2E9106B2AF5B0B9C663E7293BFF6098BDB428B93E50396818F865F42205173DF1D9DCFEA939C60C12BBEFF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<hplug>.. <plugin.. fkey="79D697BB-6D87-491b-A857-F7A0F21C0239".. file=".\NetStream.dll".. title="NetStream".. delayload="false".. defultStartup="true".. />.. <plugin.. fkey="6F26865C-8AAB-4433-A898-535CAEFCA387".. file=".\Client_DataCenter.dll".. title="Client_DataCenter".. delayload="false".. defultStartup="true".. />..</hplug>..............

C:\Program Files (x86)\Ezviz Studio\hplugin\is-55CEI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.08591184498186
Encrypted:	false
SSDEEP:	6:TMVBdzvp5FNSG9hN9pkqOYHO+5QCdL5FNSG+dK5OYHeJm5QCd1CwH:TMHddJBNcqhfZJYK5KmfawH
MD5:	6376712174D79C2F9C3B7E9DF972EB8B
SHA1:	8589F19D95B4BD3265AD1AAAE5051CF563E16B73
SHA-256:	A1FE66CA233A1DC5F417A826CA8641C9990054CED908253752B39BB8F0211123
SHA-512:	75E0CF2278A5AF2C1A0622F41E215424C03CBFFFCD2E9106B2AF5B0B9C663E7293BFF6098BDB428B93E50396818F865F42205173DF1D9DCFEA939C60C12BBEFF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<hplug>.. <plugin.. fkey="79D697BB-6D87-491b-A857-F7A0F21C0239".. file=".\NetStream.dll".. title="NetStream".. delayload="false".. defultStartup="true".. />.. <plugin.. fkey="6F26865C-8AAB-4433-A898-535CAEFCA387".. file=".\Client_DataCenter.dll".. title="Client_DataCenter".. delayload="false".. defultStartup="true".. />..</hplug>..............

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\AnalyzeData.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441504
Entropy (8bit):	6.757717492726943
Encrypted:	false
SSDEEP:	6144:QWkN5tPYsRA318Y+vMwER19P7nQA7NubZIgxdqtAOjd/r:hkvtPYxSo7nQSWZ7PqtP/
MD5:	0B6A53ED0C81F73614D9E599817E19C1
SHA1:	5A33DA171EDAEA3877B9A83CC15E921F5E394984
SHA-256:	47F886FBEBB5C6FC4A2FA418FCFDF039B3C639306CD8466FA4E85020D0DBC652
SHA-512:	424A69B6C51FA4715D0A8C8201206BAA752BDFC65288620F41BB8FEFD6EDEA14EF43859BAEF0C9007384F0F73993DF49C5F67A22C87E5CDC0ACA070E06867B89
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.?...?...?...!.X......D..<...?...]...!.N...!.I.f...!._.>...!.Y.>...!.\.>...Rich?...........................PE..L...2..Y...........!.........l......W........0...............................P.......G..........................................(........................2... ..<&...1.................................@............0...............................text............................... ..`.rdata..f....0......................@..@.data....:..........................@....rsrc................\..............@..@.reloc..<'... ...(...b..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\NetStream.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1397760
Entropy (8bit):	6.646285231964503
Encrypted:	false
SSDEEP:	24576:ouDt6KhdG84eGsLmjdK0iCBHQVPBKbLlejgrOFkxNYyJfVG:oYXM8j3w+PNhkxNYyJfVG
MD5:	F94E800AD0CF55F6B2DC8C7D05C791B0
SHA1:	5D3D0FBA16F1AF123DC92C06DBF2EA8DBAE3820E
SHA-256:	4FA514BF9C8BF5E87A191371D7F60627E962131E1A9AEAB4E0C5029061E7C72C
SHA-512:	CA6696A50B6281F74B1554F799B4C329128FB1A5DDD7F2BBB54306B3FD6AE5412B49A6D57635803A7BB8153339FC15BBDFB6152238BF4C454FD32931E294A861
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........evr...!...!...!.V.!...!YK.!...!.\|.!...!.\|.!...!.\|.!O..!..c!...!.\|.!...!...!...!.\|.!...!.\|.!...!.V.!...!.\|.!...!Rich...!........PE..L.....ed...........!.....R...................p...............................@......................................`m......lW..,....`.......................p..d....u...............................6..@............p...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...$........(...X..............@...SharedDa.....P......................@....rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\PushClient.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	6.265799693694978
Encrypted:	false
SSDEEP:	1536:dOS0yuxr2k4h3IaqE2rQhnk1a7MsMHoGYZPf1CgTvmklOtuQorr2ib:V0yuxoh3Iaqehnk1aYsMHoGYZPheuOtt
MD5:	5FB63AE7186C2CAC5F27A2DAE8B14B57
SHA1:	AACB029339DDBB159738AA89C150B3E82AA2D979
SHA-256:	B0D7D85D8451CBF4488931F4E9414B505F1F558B1871B7097A3EFBB8942992B9
SHA-512:	9999A6FA6467106AEDDC8E87337C7628E0454A19BA5B74077F5E101600A65F8DABE51B39C35ED0FAB0A49044C966F23BE232A9434E906B28E801935C7D98420A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.\ ..2s..2s..2s...s..2s...s..2s...s..2s...s..2s1.Is..2s...s..2s..3s..2s...s..2s...s..2s...s..2s...s..2sRich..2s........PE..L....".Z...........!.........p.......................................................=....@.........................PE.......4.......`..8....................p..T...................................0...@............................................text...k........................... ..`.rdata...H.......J..................@..@.data...(....P.......:..............@....rsrc...8....`.......<..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\RTPRTCP.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.095424250986741
Encrypted:	false
SSDEEP:	1536:y1gJIbo0qyryv4/bGBjZP3ptkLyuAzR1aOycqIR:vHn+ygMtP5tNuAlcOy/IR
MD5:	E1626689F30A8FC9262A74280A5E2826
SHA1:	E0ECA47AB1CCABC240974C006EB902B65C538FD5
SHA-256:	11D984D749A0ED9E6FE645187948E7DC3A2D655A5FD234F97638C9FF66AE4250
SHA-512:	ED6ECA33C274490AFE3EAC7E501336551FE4C5226D484F1DD377E33D6C4BF670BAFAACCC513B174207F0AD4B5250089445700DCEB7162A9405F4A0DE43B03385
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.C.............P^......g]......gK......M[......g[.....................gL......gZ......M\......gY.....Rich....................PE..L....5_U...........!.........H...............0...............................P......._...............................\..A....P.......0.......................@.......2...............................@..@............0...............................text............................... ..`.rdata.../...0...0..................@..@.data...H....`.......L..............@....rsrc........0.......P..............@..@.reloc..<....@.......V..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\RTSPClient.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	6.296851874974514
Encrypted:	false
SSDEEP:	768:BseWchG5XM0TK1qDql+318xGsLVJM3ng5aiwP+Q4cNR1OKf01xQHUg+XuA:OzK1qDHCx/wng50PioR1W40g+XuA
MD5:	39B28A83FD12F2C60A64A0703B6BCEBD
SHA1:	CC7FDBAAB99AECA16D7765E42F1D4A8590736A0E
SHA-256:	260FF0069AA3B26033DF731E0BC44AFDF34416B2E9B46B6D4F013D2BED9F3B50
SHA-512:	E6CD2529039310AC8148F5CEECE2DD9079170BC5192D9D11E2DB9CF4D60551E9103F20F823FF071FAC8F540E0E7CC2102D8E06C17E38A36F70FFFB4D9FED4727
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Vr.r8!.r8!.r8!...!.r8!...!.r8!. .!.r8!...!.r8!.r9!.r8!..C!.r8!...!.r8!...!.r8!. .!.r8!...!.r8!Rich.r8!........................PE..L....5_U...........!.........Z......6........................................`..........................................$............@..L....................P..h...0...................................@............................................text...?........................... ..`.rdata...@.......B..................@..@.data........ ......................@....rsrc...L....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\StreamClient_V30.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	6.285751733176401
Encrypted:	false
SSDEEP:	1536:gaEyST1BWQil/BDFM+ZbkxVmohRDhR9uckC3wLZeY9dQNexmxQokyWj0ozJQ:g1yS54Qil/BDFM+ZbkxVmohRDhR9uckM
MD5:	7349BC792CE5278E2B00DD7CE8CF0C81
SHA1:	1496C578B6584BA53D49FF9C87B6109F170AFEB6
SHA-256:	80FF8314D2467EAE71E61A30DEDCF0B4DC61D13F913A4A14F1ACC3DC439CDE20
SHA-512:	E18AF41CD541DFDF54C0416431BA1E4901282A91E151BA1365FEDAA33696E92531E9220D2636C20F28C84EBA017A91600DF371828FB248951AD59BDAD0DAB930
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................-.........8.........(..._.....(.....)...?....)..../....*...Rich...........PE..L.....bU...........!.........V......K................................................P...............................................p..............................`...............................(...@...............D............................text............................... ..`.rdata...8.......:..................@..@.data...8_..........................@....rsrc........p......................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\StreamTransClient.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	266323
Entropy (8bit):	6.42033173265064
Encrypted:	false
SSDEEP:	6144:t54QDOpXxJ13cPJYcZWm7kJaol6lTaqLB:jOpXv44mw0lld
MD5:	448A0C1B15ACA33B18C8C4EDE751E63E
SHA1:	F856AE0412FC74AEB1A1D5A478EE82228C4B590F
SHA-256:	EB4618B8A69288F4FABF342A0244312EDEE9EBCF6DB1926EF478CAF39A99AB82
SHA-512:	B5E9B6DA01A6C2AA7DE30CF7EEEE48334010CA0CE79DA6DEE3A1301ACE3BFDA395160B9061692CFC00638ED83CB7155B381B016B15413785E8BD45E6BA4C4241
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q..H0}DH0}DH0}D3,qDK0}D.,sDS0}D./wD.0}D.8 DE0}DH0\|D.0}D./vD.0}D.6{DI0}D./yDI0}DRichH0}D................PE..L...Z..T...........!................D................................................................................K......@=.......@..(....................P...'...................................................................................text............................... ..`.rdata...@.......P..................@..@.data........`...`...`..............@....rsrc...(....@......................@..@.reloc...4...P...@..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\StunClientLib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48288
Entropy (8bit):	6.93631495624919
Encrypted:	false
SSDEEP:	768:A92dS2rPIYv891nQxF3aE//zgUkbDuh0D7QlnNWP7sPDKlfOtaZOep20d2V20sHf:AmSR9QxEEMUEDW0D7QslfOtaZ2+2Mp40
MD5:	2C4848053261D6C5484EAC59A98ED771
SHA1:	18AB8877983042E264E2C902667971BD605DA936
SHA-256:	53A78C675326E228FD4167D19358E73D77BDEDF6696927863709469B0E5C9DB0
SHA-512:	0D2CEBC3544F9B9E66F9D7C8480630E5D2114766DFD8DB75C90B89C254753683F15B7F0C74856B12D1B1F65880308A2F91C57D4BCEB44261E2224C03BE56EF69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1<:.PRi.PRi.PRir..i.PRi.(.i.PRi.(.i.PRi.(.i.PRi.)i.PRi.(.i.PRi.PSi.PRi.(.i.PRi.(.i.PRi...i.PRi.(.i.PRiRich.PRi........PE..L....0)X...........!.....b...$.......k...............................................t....@.............................F......x........................2..........`...............................`...@...............8............................text...Za.......b.................. ..`.rdata...............f..............@..@.data................\|..............@....rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\SystemTransform.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602784
Entropy (8bit):	6.55098231914905
Encrypted:	false
SSDEEP:	6144:X95tgBH8acQEZB3rWhJEpRKmGdFrqk9b03QQwMUjAD57EAOOnXGbhvxVsV:WctB7Wi5ku3QYUjA17Em
MD5:	0EEA71AEA757A1749C90A83D495719C4
SHA1:	D1B849C3424866032556FE79AD4F837E80FD1E0F
SHA-256:	E386DA870419696EEA70F0AB7E4BEC5040269915FB5C5F17750509A365A1CEC9
SHA-512:	DA2A848B362066F6E75534D3AC32B4927D0DECC27FAD3F63E36CE1BEBB814F1E93930CE07B60CE63457F3A8A2128EA807F1000A5343A2939473EE6112F5087AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%_.tv_.tv_.tvA..v}.tvx%.vZ.tv_.uv3.tvA..v[.tvA..v..tvA..v..tvA..v^.tvA..v^.tvA..v^.tvRich_.tv........PE..L...U..Y...........!.........f.......K..............................................#6..............................`...........<........................2......`0...................................j..@............................................text............................... ..`.rdata..............................@..@.data............2..................@....rsrc...............................@..@.reloc..\|2.......4..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\TTSClient.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38560
Entropy (8bit):	6.792389110377103
Encrypted:	false
SSDEEP:	768:jVyxz3wxHLYgdvAgLGwDmOtDSVqp205M20tp23+zjE:xyNIYgdvAgLTDmOtDSVD2z0E
MD5:	0B32BC405775355EC8FA102F58F679E9
SHA1:	4197FD6550BA99FEBE5AF89DE23C3EA903F0C2B0
SHA-256:	F7BFAAE4E3372E43012883C8D24B767EC72AA9421C5145ADA4286DC8DF2E7E73
SHA-512:	6FAA2C0C08D115298AF144F8DE2F89CFB25D76297CA2992E8F61C54782AE469B0F0E5483928DE198BEB1C265BB1FDBB6A5B901B5430AA049D4F5820428BB4F9D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O..h...h...h.+.....h.......h.......h.......h.......h.......h...i...h.......h.......h.......h.......h.Rich..h.........................PE..L...?.{T...........!.....8...(......f>.......P......................................d.....@..........................d..+....Y..d.......(............d...2..........`Q...............................R..@............P..L............................text...:7.......8.................. ..`.rdata.......P.......<..............@..@.data...P....p.......T..............@....rsrc...(............V..............@..@.reloc...............^..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\hplugin.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	156
Entropy (8bit):	5.357092229486018
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCaeCuFpJXeDBO+umNU+pbI9H+lRJUECb:TMVBdzvpMHhN9pb6He3RCb
MD5:	A94A643999C179C7EB9444E98FB470BE
SHA1:	59AB2F7E94EFDC6ADFCD941DEC40A1E40A1C5DFF
SHA-256:	6092724A24570F4C2337B7369806D91383E7E282C46F22042186E732CCE51767
SHA-512:	8AC215C6B3E63EB471780B6DF7C217DEBA602ACEEF66F3518D20A69EBF956E4089107C03E94185BE3D8EBAF0AC757F6D9AD734AA2EFC9A1D0FE90257EDDD4237
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<hplug>.. <plugin fkey="79D697BB-6D87-491b-A857-F7A0F21C0239" file="./NetStream.dll" delayload="false" />..</hplug>

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-244RQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86070
Entropy (8bit):	4.886057158141297
Encrypted:	false
SSDEEP:	768:bspjN7masPcbmZOzyKGdsmkHtpwpSH3UMp4K0/06gZiH3YbcZ8ysAa23Zm:eOEEMzHtpc2l0/0JZiH3YbcZ8lh
MD5:	0AB7D0E87F3843F8104B3670F5A9AF62
SHA1:	10C09A12E318F0FBEBF70C4C42AD6EE31D9DF2E5
SHA-256:	8AECAB563B3C629E8F9DCD525DC2D6B1903F6C600637E63B1EFE05E3C64D757B
SHA-512:	E08E17167EDF461C0FCA1E8B649C0C395793E80F5400F5CBB7D7906D0C99E955FCF6BE2300DB8663D413C4B3FFB075112A6CE5BF259553C0FD3D76200EE0D375
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%.].K.].K.].K.?.X.Y.K..E._.K.].J.h.K...A.X.K..M.\.K...O.Y.K.Rich].K.................PE..L..../.E...........!.........`...............................................P......................................0........ ..P....0..P....................@.......................................................!..\|............................text...z........................... ..`.rdata........... ..................@..@.data...$...........................@....idata....... ....... ..............@....rsrc...P....0.......0..............@..@.reloc..v....@.......@..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-2UBBQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	6.080316576004038
Encrypted:	false
SSDEEP:	384:N41gb4AohmWPd42dx22QfwixjgNmaHu2iBwOtbxlP6NmPyFf9p:N41wMY4d42dx2dYiKTgwOtP6aOp
MD5:	6408C172F31823178BCD7C75B858478C
SHA1:	BBC54DE9CE5FCF5D825DD42BC3FA4FC38E3FA3EB
SHA-256:	481F9A14360DA2296FAE9B55AC8EC634FE43C42D7F41BA7FD7E32C21C0E2B6BA
SHA-512:	E2144D703287A4E62C2B79BECC1188200915B0D239CBEBC5884C7FE4601D146075FD89C79D62AF0CCCD6DE8DAED03C5930AE5C516716DB6C25B803DB54830F8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........)...z...z...z..0z...z..5z...z..6z...z.. z...z..'z...z.Q.z...z...z...z..)z...z..1z...z..7z...z..2z...zRich...z................PE..L......T...........!...............J3.......@............................................@..........................L.......E.......`..8....................p..l... A...............................C..@............@...............................text...[)......................... ..`.rdata.......@......................@..@.data........P.......<..............@....rsrc...8....`.......>..............@..@.reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-7TQ67.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	266323
Entropy (8bit):	6.42033173265064
Encrypted:	false
SSDEEP:	6144:t54QDOpXxJ13cPJYcZWm7kJaol6lTaqLB:jOpXv44mw0lld
MD5:	448A0C1B15ACA33B18C8C4EDE751E63E
SHA1:	F856AE0412FC74AEB1A1D5A478EE82228C4B590F
SHA-256:	EB4618B8A69288F4FABF342A0244312EDEE9EBCF6DB1926EF478CAF39A99AB82
SHA-512:	B5E9B6DA01A6C2AA7DE30CF7EEEE48334010CA0CE79DA6DEE3A1301ACE3BFDA395160B9061692CFC00638ED83CB7155B381B016B15413785E8BD45E6BA4C4241
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q..H0}DH0}DH0}D3,qDK0}D.,sDS0}D./wD.0}D.8 DE0}DH0\|D.0}D./vD.0}D.6{DI0}D./yDI0}DRichH0}D................PE..L...Z..T...........!................D................................................................................K......@=.......@..(....................P...'...................................................................................text............................... ..`.rdata...@.......P..................@..@.data........`...`...`..............@....rsrc...(....@......................@..@.reloc...4...P...@..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-A1HFI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	156
Entropy (8bit):	5.357092229486018
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCaeCuFpJXeDBO+umNU+pbI9H+lRJUECb:TMVBdzvpMHhN9pb6He3RCb
MD5:	A94A643999C179C7EB9444E98FB470BE
SHA1:	59AB2F7E94EFDC6ADFCD941DEC40A1E40A1C5DFF
SHA-256:	6092724A24570F4C2337B7369806D91383E7E282C46F22042186E732CCE51767
SHA-512:	8AC215C6B3E63EB471780B6DF7C217DEBA602ACEEF66F3518D20A69EBF956E4089107C03E94185BE3D8EBAF0AC757F6D9AD734AA2EFC9A1D0FE90257EDDD4237
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<hplug>.. <plugin fkey="79D697BB-6D87-491b-A857-F7A0F21C0239" file="./NetStream.dll" delayload="false" />..</hplug>

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-A2HSD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	6.285751733176401
Encrypted:	false
SSDEEP:	1536:gaEyST1BWQil/BDFM+ZbkxVmohRDhR9uckC3wLZeY9dQNexmxQokyWj0ozJQ:g1yS54Qil/BDFM+ZbkxVmohRDhR9uckM
MD5:	7349BC792CE5278E2B00DD7CE8CF0C81
SHA1:	1496C578B6584BA53D49FF9C87B6109F170AFEB6
SHA-256:	80FF8314D2467EAE71E61A30DEDCF0B4DC61D13F913A4A14F1ACC3DC439CDE20
SHA-512:	E18AF41CD541DFDF54C0416431BA1E4901282A91E151BA1365FEDAA33696E92531E9220D2636C20F28C84EBA017A91600DF371828FB248951AD59BDAD0DAB930
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................-.........8.........(..._.....(.....)...?....)..../....*...Rich...........PE..L.....bU...........!.........V......K................................................P...............................................p..............................`...............................(...@...............D............................text............................... ..`.rdata...8.......:..................@..@.data...8_..........................@....rsrc........p......................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-AM4D0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	384000
Entropy (8bit):	6.398589540467588
Encrypted:	false
SSDEEP:	6144:wS8fVkDsskawLcCTAT2+CbZnWfrroKYOE41om3RxEQPKEWxdr2NQzhnidmBXOKn:GNKHSAro/OE4nfE8WH5H
MD5:	7F80D7D0F6D39AC478098B57202F32D6
SHA1:	A21A78CEEDE29412819DB9B26C6D125F4BBBE04B
SHA-256:	0CAF8A85A61E22C2EA5D77A910C6EE78B2D28B7790B228D526F91D454E939676
SHA-512:	21FF16434D564C6ECB4E4BACD9E1CAEC1B01758E212FA5214E671B81FA6BC2DE9D5DC4F37B3F7DF9BCC761C2D0D5706E9D7F52922475B8E1C59F01DAD42F7270
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?+&`{JH3{JH3{JH3.UL3yJH3e..3.JH3...3zJH3e..3~JH3e..3uJH3\.33\|JH3{JI3.JH3e..3aJH3e..3zJH3e..3zJH3e..3zJH3Rich{JH3................PE..L......R...........!................=................................................q..............................p...\.......................................,2..p................................h..@............................................text...O........................... ..`.rdata.............................@..@.data...............................@....rsrc...............................@..@.reloc...7.......8..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-BS81F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	6.296851874974514
Encrypted:	false
SSDEEP:	768:BseWchG5XM0TK1qDql+318xGsLVJM3ng5aiwP+Q4cNR1OKf01xQHUg+XuA:OzK1qDHCx/wng50PioR1W40g+XuA
MD5:	39B28A83FD12F2C60A64A0703B6BCEBD
SHA1:	CC7FDBAAB99AECA16D7765E42F1D4A8590736A0E
SHA-256:	260FF0069AA3B26033DF731E0BC44AFDF34416B2E9B46B6D4F013D2BED9F3B50
SHA-512:	E6CD2529039310AC8148F5CEECE2DD9079170BC5192D9D11E2DB9CF4D60551E9103F20F823FF071FAC8F540E0E7CC2102D8E06C17E38A36F70FFFB4D9FED4727
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Vr.r8!.r8!.r8!...!.r8!...!.r8!. .!.r8!...!.r8!.r9!.r8!..C!.r8!...!.r8!...!.r8!. .!.r8!...!.r8!Rich.r8!........................PE..L....5_U...........!.........Z......6........................................`..........................................$............@..L....................P..h...0...................................@............................................text...?........................... ..`.rdata...@.......B..................@..@.data........ ......................@....rsrc...L....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-C6R41.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	6.265799693694978
Encrypted:	false
SSDEEP:	1536:dOS0yuxr2k4h3IaqE2rQhnk1a7MsMHoGYZPf1CgTvmklOtuQorr2ib:V0yuxoh3Iaqehnk1aYsMHoGYZPheuOtt
MD5:	5FB63AE7186C2CAC5F27A2DAE8B14B57
SHA1:	AACB029339DDBB159738AA89C150B3E82AA2D979
SHA-256:	B0D7D85D8451CBF4488931F4E9414B505F1F558B1871B7097A3EFBB8942992B9
SHA-512:	9999A6FA6467106AEDDC8E87337C7628E0454A19BA5B74077F5E101600A65F8DABE51B39C35ED0FAB0A49044C966F23BE232A9434E906B28E801935C7D98420A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.\ ..2s..2s..2s...s..2s...s..2s...s..2s...s..2s1.Is..2s...s..2s..3s..2s...s..2s...s..2s...s..2s...s..2sRich..2s........PE..L....".Z...........!.........p.......................................................=....@.........................PE.......4.......`..8....................p..T...................................0...@............................................text...k........................... ..`.rdata...H.......J..................@..@.data...(....P.......:..............@....rsrc...8....`.......<..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-FBVS3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	243712
Entropy (8bit):	6.485972562678936
Encrypted:	false
SSDEEP:	6144:Hp+2lQPsyRjTJUrPhnEhPjSG22GiSiK9mFriy/idVOtYSL:Hp+2l6TRXyrPhnEhPjSG22GiSiK9mFrC
MD5:	51061620E98351FDC7BDAEF2057A5973
SHA1:	CD8CB6FD5AE835A7B3FDCF2FD9AC2FFAC324CFE1
SHA-256:	E74A57AB89E84E3EF32FCA2070E099C88DF5CEA26502E838A7FCDCCAD7267339
SHA-512:	454EF30C6189F6AF0EF7CB673C7AAF5DDEC2CF8F1EB7FF8D16494B35F2D108E23A69794BC0FB8B81421355F534BB490BFBDE8463731C8621E48B446F5E3F90E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?,+.^Bx.^Bx.^Bx...x.^Bx...x.^Bx...x.^Bx...x.^Bx...x.^Bx.&.x.^Bx.^Cx/^Bx..9x.^Bx...x.^Bx...x.^Bx...x.^Bx...x.^BxRich.^Bx................PE..L......Z...........!................\j...............................................w....@............................. ...tp..d...............................L)......................................@...............h............................text.............................. ..`.rdata.. ...........................@..@.data...h............\|..............@....rsrc...............................@..@.reloc..x*.......,..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-FK4IR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38560
Entropy (8bit):	6.792389110377103
Encrypted:	false
SSDEEP:	768:jVyxz3wxHLYgdvAgLGwDmOtDSVqp205M20tp23+zjE:xyNIYgdvAgLTDmOtDSVD2z0E
MD5:	0B32BC405775355EC8FA102F58F679E9
SHA1:	4197FD6550BA99FEBE5AF89DE23C3EA903F0C2B0
SHA-256:	F7BFAAE4E3372E43012883C8D24B767EC72AA9421C5145ADA4286DC8DF2E7E73
SHA-512:	6FAA2C0C08D115298AF144F8DE2F89CFB25D76297CA2992E8F61C54782AE469B0F0E5483928DE198BEB1C265BB1FDBB6A5B901B5430AA049D4F5820428BB4F9D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O..h...h...h.+.....h.......h.......h.......h.......h.......h...i...h.......h.......h.......h.......h.Rich..h.........................PE..L...?.{T...........!.....8...(......f>.......P......................................d.....@..........................d..+....Y..d.......(............d...2..........`Q...............................R..@............P..L............................text...:7.......8.................. ..`.rdata.......P.......<..............@..@.data...P....p.......T..............@....rsrc...(............V..............@..@.reloc...............^..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-HAJ0H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48288
Entropy (8bit):	6.93631495624919
Encrypted:	false
SSDEEP:	768:A92dS2rPIYv891nQxF3aE//zgUkbDuh0D7QlnNWP7sPDKlfOtaZOep20d2V20sHf:AmSR9QxEEMUEDW0D7QslfOtaZ2+2Mp40
MD5:	2C4848053261D6C5484EAC59A98ED771
SHA1:	18AB8877983042E264E2C902667971BD605DA936
SHA-256:	53A78C675326E228FD4167D19358E73D77BDEDF6696927863709469B0E5C9DB0
SHA-512:	0D2CEBC3544F9B9E66F9D7C8480630E5D2114766DFD8DB75C90B89C254753683F15B7F0C74856B12D1B1F65880308A2F91C57D4BCEB44261E2224C03BE56EF69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1<:.PRi.PRi.PRir..i.PRi.(.i.PRi.(.i.PRi.(.i.PRi.)i.PRi.(.i.PRi.PSi.PRi.(.i.PRi.(.i.PRi...i.PRi.(.i.PRiRich.PRi........PE..L....0)X...........!.....b...$.......k...............................................t....@.............................F......x........................2..........`...............................`...@...............8............................text...Za.......b.................. ..`.rdata...............f..............@..@.data................\|..............@....rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-HI3IC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602784
Entropy (8bit):	6.55098231914905
Encrypted:	false
SSDEEP:	6144:X95tgBH8acQEZB3rWhJEpRKmGdFrqk9b03QQwMUjAD57EAOOnXGbhvxVsV:WctB7Wi5ku3QYUjA17Em
MD5:	0EEA71AEA757A1749C90A83D495719C4
SHA1:	D1B849C3424866032556FE79AD4F837E80FD1E0F
SHA-256:	E386DA870419696EEA70F0AB7E4BEC5040269915FB5C5F17750509A365A1CEC9
SHA-512:	DA2A848B362066F6E75534D3AC32B4927D0DECC27FAD3F63E36CE1BEBB814F1E93930CE07B60CE63457F3A8A2128EA807F1000A5343A2939473EE6112F5087AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%_.tv_.tv_.tvA..v}.tvx%.vZ.tv_.uv3.tvA..v[.tvA..v..tvA..v..tvA..v^.tvA..v^.tvA..v^.tvRich_.tv........PE..L...U..Y...........!.........f.......K..............................................#6..............................`...........<........................2......`0...................................j..@............................................text............................... ..`.rdata..............................@..@.data............2..................@....rsrc...............................@..@.reloc..\|2.......4..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-HLPPD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.095424250986741
Encrypted:	false
SSDEEP:	1536:y1gJIbo0qyryv4/bGBjZP3ptkLyuAzR1aOycqIR:vHn+ygMtP5tNuAlcOy/IR
MD5:	E1626689F30A8FC9262A74280A5E2826
SHA1:	E0ECA47AB1CCABC240974C006EB902B65C538FD5
SHA-256:	11D984D749A0ED9E6FE645187948E7DC3A2D655A5FD234F97638C9FF66AE4250
SHA-512:	ED6ECA33C274490AFE3EAC7E501336551FE4C5226D484F1DD377E33D6C4BF670BAFAACCC513B174207F0AD4B5250089445700DCEB7162A9405F4A0DE43B03385
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.C.............P^......g]......gK......M[......g[.....................gL......gZ......M\......gY.....Rich....................PE..L....5_U...........!.........H...............0...............................P......._...............................\..A....P.......0.......................@.......2...............................@..@............0...............................text............................... ..`.rdata.../...0...0..................@..@.data...H....`.......L..............@....rsrc........0.......P..............@..@.reloc..<....@.......V..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-NN73K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76288
Entropy (8bit):	6.578611030127326
Encrypted:	false
SSDEEP:	1536:wBWXKw/z8jT3Ij/sYfvDsPyXd7H1aub9NPc60c8jYRrBMykSk:MWXKw/z8jT3Ij0Yn5XdV1b9n0c8jA1My
MD5:	0E6AFBE88BC7629ABFF3D62F981758A7
SHA1:	5F685B18839213A1781F580E2A1AF05B63E34881
SHA-256:	77677FFC606F0499D40A0049BF9A3F720E6FB73A3C8CC276D67D5F7E34506437
SHA-512:	8E1E559AE7E1575171F34DF0FDF76515EA94E5A3A3B685EA485313CDFABF018295F502A55F16FEB6123418BD1D0DC398CA4BD0CDC2DF68BF05EB0CEFBF576DF2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d..d..d.....d......d.....d.....d.....d..e...d.'...d.....d.....d.....d.....d.Rich..d.................PE..L...Y.V...........!.........R...............................................@......N5....@.....................................P.......D.................... ..\|.......................................@............................................text............................... ..`.rdata..f/.......0..................@..@.data........ ......................@....rsrc...D...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-O00C7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655360
Entropy (8bit):	6.628888894662019
Encrypted:	false
SSDEEP:	12288:byYjgyCSUYra3qahplm2KFRuSbZYgx5vnJJyy8y7zp:WWgyCSJrpwgRjO2JydyXp
MD5:	E914F933228BC7C441A6044DC21710F2
SHA1:	CAB1AE870FA17CC08A130956AF77713B8B4C9A14
SHA-256:	867B4E3B034A0AAF28B3A6578977DE8A7E0873A05B2D0FEF442491861215A87E
SHA-512:	815B72418598855C35B5F7A960F4CEE667511AB80233D9742C5897C9F8A28AF85620A3B21DE98D46314D35095E149CDA69B6C2358B2F8424D4771A1473A1B369
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8oCjY..jY..jY..M.l.kY......kY..c!..bY..c!..zY..c!..`Y..M.z.bY..c!..gY..jY..)X..c!..ZY..c!..kY..t...kY..c!..kY..RichjY..........................PE..L......Z...........!.....X..........P........p...............................p......ey....@......................... m..c....H...................................q...t..................................@............p..<............................text...eV.......X.................. ..`.rdata.......p.......\..............@..@.data....C...........j..............@....rsrc................p..............@..@.reloc..R............x..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-QEANV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441504
Entropy (8bit):	6.757717492726943
Encrypted:	false
SSDEEP:	6144:QWkN5tPYsRA318Y+vMwER19P7nQA7NubZIgxdqtAOjd/r:hkvtPYxSo7nQSWZ7PqtP/
MD5:	0B6A53ED0C81F73614D9E599817E19C1
SHA1:	5A33DA171EDAEA3877B9A83CC15E921F5E394984
SHA-256:	47F886FBEBB5C6FC4A2FA418FCFDF039B3C639306CD8466FA4E85020D0DBC652
SHA-512:	424A69B6C51FA4715D0A8C8201206BAA752BDFC65288620F41BB8FEFD6EDEA14EF43859BAEF0C9007384F0F73993DF49C5F67A22C87E5CDC0ACA070E06867B89
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.?...?...?...!.X......D..<...?...]...!.N...!.I.f...!._.>...!.Y.>...!.\.>...Rich?...........................PE..L...2..Y...........!.........l......W........0...............................P.......G..........................................(........................2... ..<&...1.................................@............0...............................text............................... ..`.rdata..f....0......................@..@.data....:..........................@....rsrc................\..............@..@.reloc..<'... ...(...b..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-VOK38.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1397760
Entropy (8bit):	6.646285231964503
Encrypted:	false
SSDEEP:	24576:ouDt6KhdG84eGsLmjdK0iCBHQVPBKbLlejgrOFkxNYyJfVG:oYXM8j3w+PNhkxNYyJfVG
MD5:	F94E800AD0CF55F6B2DC8C7D05C791B0
SHA1:	5D3D0FBA16F1AF123DC92C06DBF2EA8DBAE3820E
SHA-256:	4FA514BF9C8BF5E87A191371D7F60627E962131E1A9AEAB4E0C5029061E7C72C
SHA-512:	CA6696A50B6281F74B1554F799B4C329128FB1A5DDD7F2BBB54306B3FD6AE5412B49A6D57635803A7BB8153339FC15BBDFB6152238BF4C454FD32931E294A861
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........evr...!...!...!.V.!...!YK.!...!.\|.!...!.\|.!...!.\|.!O..!..c!...!.\|.!...!...!...!.\|.!...!.\|.!...!.V.!...!.\|.!...!Rich...!........PE..L.....ed...........!.....R...................p...............................@......................................`m......lW..,....`.......................p..d....u...............................6..@............p...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...$........(...X..............@...SharedDa.....P......................@....rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\is-VROPE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.352948061942098
Encrypted:	false
SSDEEP:	6144:KGAwnXH3n6A/e8TpXE+gYvhPKfywoyyiSCyRBUDIzUBrohgQH3nXXcs/mgXH3nXH:KGAwnXH3n6A/e8TpXE+gYvhPKfywoyy4
MD5:	ECEC565F866E91872E24F1EDFA71C096
SHA1:	30A5985D39E803E7200C88A9331AD5605D514C71
SHA-256:	79541BF45E0D4552C9A00CCB53B80D50CEA935F96F93421DA39A0FA675FDB8B0
SHA-512:	7A3AA373D1E0D9C5088D6A8DF1DF9B0FBE707EB9B6F3D2AEF3F39C427A2094E5C0D3C1635947BCCC2101AFBB7C21A6A26E1AAA622D7F94E930235A8D672D403C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Gj..&.L.&.L.&.L.i.L.&.L.^.L.&.L.^.L.&.L.^.L.&.L...L.&.L.&.L.&.L.^.L.&.L.^.L.&.L.t.L.&.L.^.L.&.LRich.&.L................PE..L....2`Z...........!..... ...................0..................................................................... ...B....r..d............................... ... 2...............................;..@............0...............................text............ .................. ..`.rdata..bd...0...f...$..............@..@.data...............................@....rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\libCASClient.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655360
Entropy (8bit):	6.628888894662019
Encrypted:	false
SSDEEP:	12288:byYjgyCSUYra3qahplm2KFRuSbZYgx5vnJJyy8y7zp:WWgyCSJrpwgRjO2JydyXp
MD5:	E914F933228BC7C441A6044DC21710F2
SHA1:	CAB1AE870FA17CC08A130956AF77713B8B4C9A14
SHA-256:	867B4E3B034A0AAF28B3A6578977DE8A7E0873A05B2D0FEF442491861215A87E
SHA-512:	815B72418598855C35B5F7A960F4CEE667511AB80233D9742C5897C9F8A28AF85620A3B21DE98D46314D35095E149CDA69B6C2358B2F8424D4771A1473A1B369
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8oCjY..jY..jY..M.l.kY......kY..c!..bY..c!..zY..c!..`Y..M.z.bY..c!..gY..jY..)X..c!..ZY..c!..kY..t...kY..c!..kY..RichjY..........................PE..L......Z...........!.....X..........P........p...............................p......ey....@......................... m..c....H...................................q...t..................................@............p..<............................text...eV.......X.................. ..`.rdata.......p.......\..............@..@.data....C...........j..............@....rsrc................p..............@..@.reloc..R............x..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\libGetHDSign.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	6.080316576004038
Encrypted:	false
SSDEEP:	384:N41gb4AohmWPd42dx22QfwixjgNmaHu2iBwOtbxlP6NmPyFf9p:N41wMY4d42dx2dYiKTgwOtP6aOp
MD5:	6408C172F31823178BCD7C75B858478C
SHA1:	BBC54DE9CE5FCF5D825DD42BC3FA4FC38E3FA3EB
SHA-256:	481F9A14360DA2296FAE9B55AC8EC634FE43C42D7F41BA7FD7E32C21C0E2B6BA
SHA-512:	E2144D703287A4E62C2B79BECC1188200915B0D239CBEBC5884C7FE4601D146075FD89C79D62AF0CCCD6DE8DAED03C5930AE5C516716DB6C25B803DB54830F8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........)...z...z...z..0z...z..5z...z..6z...z.. z...z..'z...z.Q.z...z...z...z..)z...z..1z...z..7z...z..2z...zRich...z................PE..L......T...........!...............J3.......@............................................@..........................L.......E.......`..8....................p..l... A...............................C..@............@...............................text...[)......................... ..`.rdata.......@......................@..@.data........P.......<..............@....rsrc...8....`.......>..............@..@.reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\libPPVClient2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	384000
Entropy (8bit):	6.398589540467588
Encrypted:	false
SSDEEP:	6144:wS8fVkDsskawLcCTAT2+CbZnWfrroKYOE41om3RxEQPKEWxdr2NQzhnidmBXOKn:GNKHSAro/OE4nfE8WH5H
MD5:	7F80D7D0F6D39AC478098B57202F32D6
SHA1:	A21A78CEEDE29412819DB9B26C6D125F4BBBE04B
SHA-256:	0CAF8A85A61E22C2EA5D77A910C6EE78B2D28B7790B228D526F91D454E939676
SHA-512:	21FF16434D564C6ECB4E4BACD9E1CAEC1B01758E212FA5214E671B81FA6BC2DE9D5DC4F37B3F7DF9BCC761C2D0D5706E9D7F52922475B8E1C59F01DAD42F7270
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?+&`{JH3{JH3{JH3.UL3yJH3e..3.JH3...3zJH3e..3~JH3e..3uJH3\.33\|JH3{JI3.JH3e..3aJH3e..3zJH3e..3zJH3e..3zJH3Rich{JH3................PE..L......R...........!................=................................................q..............................p...\.......................................,2..p................................h..@............................................text...O........................... ..`.rdata.............................@..@.data...............................@....rsrc...............................@..@.reloc...7.......8..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\paho-mqtt3c.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76288
Entropy (8bit):	6.578611030127326
Encrypted:	false
SSDEEP:	1536:wBWXKw/z8jT3Ij/sYfvDsPyXd7H1aub9NPc60c8jYRrBMykSk:MWXKw/z8jT3Ij0Yn5XdV1b9n0c8jA1My
MD5:	0E6AFBE88BC7629ABFF3D62F981758A7
SHA1:	5F685B18839213A1781F580E2A1AF05B63E34881
SHA-256:	77677FFC606F0499D40A0049BF9A3F720E6FB73A3C8CC276D67D5F7E34506437
SHA-512:	8E1E559AE7E1575171F34DF0FDF76515EA94E5A3A3B685EA485313CDFABF018295F502A55F16FEB6123418BD1D0DC398CA4BD0CDC2DF68BF05EB0CEFBF576DF2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d..d..d.....d......d.....d.....d.....d..e...d.'...d.....d.....d.....d.....d.Rich..d.................PE..L...Y.V...........!.........R...............................................@......N5....@.....................................P.......D.................... ..\|.......................................@............................................text............................... ..`.rdata..f/.......0..................@..@.data........ ......................@....rsrc...D...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\pthreadVC2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86070
Entropy (8bit):	4.886057158141297
Encrypted:	false
SSDEEP:	768:bspjN7masPcbmZOzyKGdsmkHtpwpSH3UMp4K0/06gZiH3YbcZ8ysAa23Zm:eOEEMzHtpc2l0/0JZiH3YbcZ8lh
MD5:	0AB7D0E87F3843F8104B3670F5A9AF62
SHA1:	10C09A12E318F0FBEBF70C4C42AD6EE31D9DF2E5
SHA-256:	8AECAB563B3C629E8F9DCD525DC2D6B1903F6C600637E63B1EFE05E3C64D757B
SHA-512:	E08E17167EDF461C0FCA1E8B649C0C395793E80F5400F5CBB7D7906D0C99E955FCF6BE2300DB8663D413C4B3FFB075112A6CE5BF259553C0FD3D76200EE0D375
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%.].K.].K.].K.?.X.Y.K..E._.K.].J.h.K...A.X.K..M.\.K...O.Y.K.Rich].K.................PE..L..../.E...........!.........`...............................................P......................................0........ ..P....0..P....................@.......................................................!..\|............................text...z........................... ..`.rdata........... ..................@..@.data...$...........................@....idata....... ....... ..............@....rsrc...P....0.......0..............@..@.reloc..v....@.......@..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\streamclient_lib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	243712
Entropy (8bit):	6.485972562678936
Encrypted:	false
SSDEEP:	6144:Hp+2lQPsyRjTJUrPhnEhPjSG22GiSiK9mFriy/idVOtYSL:Hp+2l6TRXyrPhnEhPjSG22GiSiK9mFrC
MD5:	51061620E98351FDC7BDAEF2057A5973
SHA1:	CD8CB6FD5AE835A7B3FDCF2FD9AC2FFAC324CFE1
SHA-256:	E74A57AB89E84E3EF32FCA2070E099C88DF5CEA26502E838A7FCDCCAD7267339
SHA-512:	454EF30C6189F6AF0EF7CB673C7AAF5DDEC2CF8F1EB7FF8D16494B35F2D108E23A69794BC0FB8B81421355F534BB490BFBDE8463731C8621E48B446F5E3F90E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?,+.^Bx.^Bx.^Bx...x.^Bx...x.^Bx...x.^Bx...x.^Bx...x.^Bx.&.x.^Bx.^Cx/^Bx..9x.^Bx...x.^Bx...x.^Bx...x.^Bx...x.^BxRich.^Bx................PE..L......Z...........!................\j...............................................w....@............................. ...tp..d...............................L)......................................@...............h............................text.............................. ..`.rdata.. ...........................@..@.data...h............\|..............@....rsrc...............................@..@.reloc..x*.......,..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\udt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.352948061942098
Encrypted:	false
SSDEEP:	6144:KGAwnXH3n6A/e8TpXE+gYvhPKfywoyyiSCyRBUDIzUBrohgQH3nXXcs/mgXH3nXH:KGAwnXH3n6A/e8TpXE+gYvhPKfywoyy4
MD5:	ECEC565F866E91872E24F1EDFA71C096
SHA1:	30A5985D39E803E7200C88A9331AD5605D514C71
SHA-256:	79541BF45E0D4552C9A00CCB53B80D50CEA935F96F93421DA39A0FA675FDB8B0
SHA-512:	7A3AA373D1E0D9C5088D6A8DF1DF9B0FBE707EB9B6F3D2AEF3F39C427A2094E5C0D3C1635947BCCC2101AFBB7C21A6A26E1AAA622D7F94E930235A8D672D403C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Gj..&.L.&.L.&.L.i.L.&.L.^.L.&.L.^.L.&.L.^.L.&.L...L.&.L.&.L.&.L.^.L.&.L.^.L.&.L.t.L.&.L.^.L.&.LRich.&.L................PE..L....2`Z...........!..... ...................0..................................................................... ...B....r..d............................... ... 2...............................;..@............0...............................text............ .................. ..`.rdata..bd...0...f...$..............@..@.data...............................@....rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\hpr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116736
Entropy (8bit):	6.42937079950737
Encrypted:	false
SSDEEP:	3072:1wumAuoyE8W9zyxLmTiRAb9HECADzG8UxmG1EFIXipOl6Otwk8Bcer8:1wumAGWExSmRi9Hzcg6OtwZ+
MD5:	AE369F96B50537C89904CA74B38CE6A5
SHA1:	5F75AA54A3FBE42E01BA8867E280C354FE960C77
SHA-256:	EC855B9D874D754A25752C7D1E6FE18E5F42721450D3C8D2AD3F46383A491D21
SHA-512:	46B49093A6F9C27A1072D71F86B43938994CB5701A7861C3AAF9859C33710AAAA969AA660687D456A8B41AF67E9A89BC27D56FBF4E63C01F18FAF10F23919AC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...zp.zp.zp.s.r.~p..?w.~p.s.t.sp.s.b.up.s.e.rp.zp...p.]...wp.s.k.Yp.s.s.{p.d"u.{p.s.p.{p.Richzp.........................PE..L....1.[...........!....."........... .......@...................................... .....@..........................q..9?..x[..........L............................C...............................O..@............@..l............................text.... .......".................. ..`.rdata...p...@...r...&..............@..@.data...............................@....rsrc...L...........................@..@.reloc..0".......$..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-0DP5N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4524608
Entropy (8bit):	6.391046322715047
Encrypted:	false
SSDEEP:	98304:GeH5hmovFJk87VUxQmsU1WP0USjMRInmg4MCDhj2:hPmovFJk87VQQmsU1WP32
MD5:	FD309D34FEDEE887AE36EC54730C89CB
SHA1:	24834A27902C7692EE53A14C4E5E2B12B0ABB872
SHA-256:	C45C3E871B8D56881AD9A0F1B2A555F5C686EF9CD215C64BD9B249B2EBD4F39B
SHA-512:	C67D87D36E4EFC639D27536C4AA23CF44D4F6CD06AAADD4FC281E8B685D56298F4FCC98927C72F6007B28155C13FEC171632AF8E70CCF07AF605533E8CC2DC81
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$j..J9..J9..J9...9..J9...9..J9...9..J9.i19..J9...9..J9..K9..J9...9..J9...9..J9...9..J9...9..J9Rich..J9........................PE..L.....e..................,.........z.'...... ,...@..........................0E.......E...@..........................x@.....le>.......@..>............D.@ ... A.(...`K,...............................9.@............ ,..(...........................text.....,.......,................. ..`.rdata...Z... ,..\....,.............@..@.data....T....@..6...n@.............@....rsrc....>....@..@....@.............@..@.reloc....... A.......@.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-0R3RH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	277504
Entropy (8bit):	6.517810468792593
Encrypted:	false
SSDEEP:	6144:BCUI3+gAJiyKNU633Gmkm8nPyQ6Pejv0itXt70Gy4cY2mqOyCNcK1Dv45:XI3+gA4yKK633Gm/ePyQ6Wjvf
MD5:	B52AA20EFEA636D0834820A06D89324D
SHA1:	38095988EAFF2A1CFA2EB2428F70A2270D66EF31
SHA-256:	FF3608B203F1A104720060A071B5EA18922754C927C262787C84795256BFDBCB
SHA-512:	B9FEEC9264A3DA8C1CC99E8F9B1BFFE0352425B2B434974E44957E6BA3DAD71FBA863CAFB96B92EE9A03149D9F6A8FB6C61F34B90A048E78BAD76CB829E682AE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................@..................................\|..............................Rich...................PE..L...L..Q...........!.........z.......~.............f..............U..........p......w.....@.........................p...."..\|a..d............................ ...;..................................@...@............................................text...k........................... ..`.rdata...#.......$..................@..@.data...X...........................@....rsrc...............................@..@.reloc...E... ...F..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-1PVTV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	165408
Entropy (8bit):	6.618708055696421
Encrypted:	false
SSDEEP:	3072:FhZ8JWtHMQNzuEhIsYDz/49GGH8kAGpwRYhd0E:PZ8JWtHZqZz/49dvAah+E
MD5:	97C0B7E26CF526FB2111678CD0B97611
SHA1:	6D53A7F86B6B1608D3BA6E8A1C7CAED34734BF68
SHA-256:	E47FF026C3D569AA9855D2FA40F64E9A62B87065944C4469BE46F3576DF6444F
SHA-512:	25DFEFA70BBB4BF6D4A944ACA621E5EA77BF55022292F76C3EA375ED1D8C2A83E38CEF99D4AC442E9DD1821577BC0D1A14729F09BA5EE94761A091DEA2B88BD4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.4q..Z"..Z"..Z".a."..Z"S."..Z"S."Q.Z"S.".Z"L.I"..Z"..["N.Z".."..Z".."..Z".."..Z".."..Z"Rich..Z"........PE..L..._D.V...........!......... ...........................................................@.............................g...x...<....................H.. >......8.......8...............................@...............4............................text.............................. ..`.rdata..T...........................@..@.data...h\|...0......................@....rsrc................(..............@..@.reloc..8............,..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-22416.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1878592
Entropy (8bit):	6.6018172083540305
Encrypted:	false
SSDEEP:	24576:aHdkoZbI7+BNNNYC7vqv8viwa/mlWwvsv/6UQon0OKjo5Nd83KJXl0pDcY0IdZgp:a9y2NCwayMV5Nd8aJXlwhhSyd2b5V0e
MD5:	109E041620DFEF9BC1BDA3D8CB4CBEB7
SHA1:	11C8DD3472F42132C29BE3DC4D2E4926BB29DC58
SHA-256:	02C4FA2C535EB8D8ACD888C13CEB5A97C44AE2A293BBE58D4A673E3EF9693A87
SHA-512:	A0168901792C8E7B853DE0882D8F2A8F2E313CA6AF02B58451A13BE2476938798BCD03A626966B84855253D63FD614EB1E109B12FFD3FDAD06255413C134B200
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Program Files (x86)\Ezviz Studio\is-22416.tmp, Author: Joe Security
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........W2Q.9aQ.9aQ.9a...aP.9a...a..9a...a..9a...a..9a...aP.9a...aP.9av.Wa[.9a\-.a..9aQ.8a..9a...aD.9a...aU.9a\-.a\|.9a\-.aP.9a\-.aP.9aQ..aP.9a\-.aP.9aRichQ.9a........PE..L...1..a...........!.........$............... ...............................`............@.........................0...................................@ ..........0$..8...........................`0..@............ ...............................text...,........................... ..`.rdata..:.... ......................@..@.data............:..................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-288KO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410624
Entropy (8bit):	6.7118202846586135
Encrypted:	false
SSDEEP:	6144:OuebAFajYaBmNVfDF+JtXGLDE3OERNVZ0GG9NQJUG2nJF3clY:O397IDF+JtXGHE3OUNYGG9+JUn
MD5:	44B73A0305018E29CC8AD8462BB7A872
SHA1:	51E6D713536D31B5843ACB6CFD751FE095AB938E
SHA-256:	938AAFE5965797CC67280842C8015F6904D1D349EFA3BC259CCFB16654E4FB8F
SHA-512:	3B82AA9B8BF56713FA7ACBC3CCAF9ED8A0D141247F86F7AB28798ABD985DF75AA6357BD928174078F2BA3D45799398944C6432B68CA817287EB9AAF9C1DCBE97
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..+..+..+...+..+...+.+...+C..+.@.+..+...+..+...+..+../+..+0..+..+..+[..+..+..+...+..+...+...+...+..+...+..+...+..+Rich..+........PE..L...G..Z...........!.........F......nX....... ...............................0............@.........................P...&.......................................h4..P$............................................... ..\............................text...O........................... ..`.rodata............................. ..`.rdata..v.... ......................@..@.data............2..................@....rsrc...............................@..@.reloc..\|5.......6..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-2ACRI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.863618031832429
Encrypted:	false
SSDEEP:	6:qv4uVKY9CvMJlCP8W4FV6RAYi+MvLTa8B4+RAYi+C/LThNhCUBMtn:UKY9CvATW42Wa8B4+k/h/6tn
MD5:	8F145A60FB401270BF9C4FF119D7A3A0
SHA1:	EE6703F306DDC9F107268DF653E5BCE7F760F0A1
SHA-256:	A915EE89D509CFE47A581EFC11D518423F255C9C98A851230738155D9E692A94
SHA-512:	288AF0D437C930652DEEB7E200DE3ACDAC5F5153A33241EC38E557410DED78C1031D79FC5E4AA4A64BC3ACA96F12C9F30FD91479B69041D7992D3C913471B96C
Malicious:	false
Preview:	[CrashReporter]..BeAutoRestart=0..RestartCount=2..LastRestartTime=0..BeTestPlatform=0..TestServerAddr=dump.shipin7.com..TestServerSite=/uploadDump..TestServerPort=10086..ServerAddr=www.shipin7.com..ServerSite=/uploadDump..ServerPort=10086..ClientName=EzvizStudio.exe..

C:\Program Files (x86)\Ezviz Studio\is-2G5F5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	6.229257200100164
Encrypted:	false
SSDEEP:	768:Y03RnwS+o2zYfvEatv2d32XCBbU43INGlOtROJ:j3FwS+DzYfvE043SCBv2GlOtROJ
MD5:	E4C7695A64D1ADA60AEB731B968ECBDC
SHA1:	3EEC7B6E344DA5D03FF0B92D07A1FF2BDB76BF07
SHA-256:	4C333EA0B74AD5E15BE89D7A488C0BAA31E4B94CE3DCD3D8B50C3940BFA84CB6
SHA-512:	BCADB9BEB363E0F47D243AE4C731DDC7F654619D9F3F8EBFC1FB27D9707F548FFBDFC8ABF5B9732D7746B4332CCA90D9F20EA3CA99F761A3FA2A19BB102280F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................(.".....!.....7.....0....\|......'...........>.....&.....%....Rich....................PE..L.....e...........!.....V...,......GX.......p............................................@.............................9.......d...................................Pq...............................u..@............p..8............................text...UU.......V.................. ..`.rdata..9....p.......Z..............@..@.data................v..............@....rsrc................x..............@..@.reloc..h............\|..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-2H5PH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.404634465764856
Encrypted:	false
SSDEEP:	1536:S9RVUqAyonEZRNEFr6bpQlLRfk4Ti0uw8IGxlvByGhRhfD:S9RVUqAyHZgrf1eIGZyORhf
MD5:	F21007192D5DC743D37CFCF14904A01A
SHA1:	4B7BEECEB0F470EFE9FB21CED776D93AA6FFE5DF
SHA-256:	76029693021C9FACF117742158C1B2D686E4A44AA5795AAE0977CD0E1C248ED7
SHA-512:	237EA574E1F470F180CC05995334C063772B7414A2B8925E511BBCA4F7CC945692B02660761ED49CB388BD50DBF7EC4B7C40480D088F51F1CD46A7806D27B7C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r..!6c.r6c.r6c.r?..r c.r?..rXc.r...r4c.r?..r5c.r6c.rVc.r?..r.c.r?..r7c.r?..r7c.rRich6c.r........PE..L.....e...........!.....:...x...............P......................................~.....@.........................P...A.......<...............................,....Q...............................v..@............P..D............................text....9.......:.................. ..`.rdata...B...P...D...>..............@..@.data...$1..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-2SHJB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	504038
Entropy (8bit):	6.5563812539456645
Encrypted:	false
SSDEEP:	12288:Zgc95f5AURgLJK3xubR706XdQnEFV/v7n:9mURggsbR70cQnEFV/v7n
MD5:	B35E59859B56C31C0ABBC32958F96C04
SHA1:	172321767BBC54F88F482FD1C4C1B0ECE6BE9B96
SHA-256:	6B99B9CB9369E10D0D5B9C02F30236C9C473288B4397A004179747F74EB32A9A
SHA-512:	E6A08C051659A0135D9B44DF7A330DF47D895AF304D5A8FFD90B43672E6572C1B2058EC676FDE48951DA8D10C45EA46474516C641BACCEA65A8B938AD6BEC096
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%.J.j......... ...8.....6.....................`.......................................... ...................... .......@..0............................P..."...................................................................................text...$...........................`..`.data...............................@....bss.....................................edata....... ......................@....idata..0....@......................@....reloc..."...P...$..................@....stab...l............:.................B.stabstr.............T.................B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-41TD8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36600
Entropy (8bit):	6.496691324388439
Encrypted:	false
SSDEEP:	768:r4/2sbo+oeVY7GI5tRdtwA2XxTF4gG1nPYx3f4IUfb4fuKRu:r4/2eo+oeuGIRwAZQRIOrM
MD5:	25401B0C9576C8456B3E0BBD74FF0771
SHA1:	C4F563342AB9EB4228E2C2A281A3FE68EDD5624E
SHA-256:	BB569C99360A631850537DC2EDA0BF85D091CC30BD98B3FD2AC9DABDFB7741DA
SHA-512:	51CF2B66202FA7498120951889B7700A030545DC59A2E0DDE305782A61CC1714E7E889DD8EDB11D47F3B7A4C86C23C33F64E0D75956045DC1B687D11AEB0670C
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................;..x...+...+...+X~.+\|..+...+/..+...+x..+...+~..+X~.+t..+X~.+~..+X~.+~..+Rich...+................PE..L.....0Q.................W..........._.......T...............................p......F.......................................D_..P....f...............p.......k..,....U...............................W..@............T...............................text....O.......P.................. ..h.rdata.......T.......T..............@..H.data........Y.......Y..............@...INIT........._......._..

C:\Program Files (x86)\Ezviz Studio\is-42497.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1025024
Entropy (8bit):	6.51461365339135
Encrypted:	false
SSDEEP:	24576:bFZSxRN3kJai0rl0zMDNfQ3zLZwyXYbAyY:bFZSxRS8KISDOzEyY
MD5:	62C8DD03AAE60CDB0D93909C0E336AEA
SHA1:	C50BF8BE7AAC3682E0512319B357C6D232CCAE41
SHA-256:	21D25C89A64666A11E94C4737B14595511684D75F7F14E71A05C84D8EC822647
SHA-512:	9EC75C662D25BAC8DECCDD6C3E83C8561A2B22B59AB8EC1C77E86A93094E92A42C69E2CD374F4DA5374AFF30CDBFCAE2B170882E1E161A7F32D93F792582CBE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G..<G...G..9G...G..:G...G..,G...G..+G...G..<G...G...G...G.E.G...G..+G.G..=G...G..;G...G..>G...GRich...G........PE..L...A..Q...........!.....2...n......E........P.....d..............U.................L1....@.........................P[..........d....................................................................\|..@............P...............................text....0.......2.................. ..`.rdata..H+...P...,...6..............@..@.data...L=...........b..............@....rsrc................z..............@..@.reloc..4".......$..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-59MEK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11362
Entropy (8bit):	3.7497861732909312
Encrypted:	false
SSDEEP:	96:ahfuHOIHxyOPLrHU4D+wdzpHvqsKZKnKTBKVhKRHK2FoSK8KcfK5uKxGKlJKHItQ:iuHOIE8rHI6RJyLTR24GEv
MD5:	DBDA60D92E774B4ACB3B1CD71F909426
SHA1:	66BFE06A16025F574323A0CE64DCC7C8216EB56C
SHA-256:	56A59DAE638D9BB45CE729A5D6FDFB0ECBE88B37047E4D6D20DBDEF1FC90BD72
SHA-512:	993A1F4AF21CD5E13C3B8059CF483B10A58BEB0D1777703EA07E9DCB5E7F681FA774E770ABE9B6B4CA66B348997DA0218D0FF67F18FCCA1B3CA1ECE2551D965A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....hI...."......#...8............`........ .....o.........................p................ ......................@..x....P...............................`..x....................................................................................text............................... .P`.data........ ......................@.0..bss.........0........................@..edata..x....@......................@.0@.idata.......P......................@.0..reloc..x....`......................@.0B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-5JFPD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	356352
Entropy (8bit):	6.754987401754759
Encrypted:	false
SSDEEP:	6144:aP+WEcVy+39YFTSVUGjvjOzR5D6oAzsRT89:a2gY+39eS1POV5D6voRo9
MD5:	AAA00C04821532C545E390C89970A2F9
SHA1:	94532D856B5EDB02A36D4083DDE3AC4D26D6C15E
SHA-256:	FEE1B82D0E13C08E0F70EF2DD6834D44EED0EB130F16D308616826933474A7C6
SHA-512:	B54DC80FAD8F0DDE262152A130DFE045E9B91A4DB93A3BA6D3E30D49F9B4B53028FB35C6F96F59508975129A495EAEE4673EFC0CDFB7E4F47A336323A2ED4195
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................q.d.......m.......{.!....#................\|.......j.......l.......i.....Rich....................PE..L.....Q[...........!................`...............................................wq..............................P8..\....-..x...............................t&..P...................................@............................................text............................... ..`.rdata...;.......<..................@..@.data...\|\|...@.......*..............@....rsrc................B..............@..@.reloc...'.......(...H..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-602QN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	345928
Entropy (8bit):	6.525618147005305
Encrypted:	false
SSDEEP:	6144:N6Hj3OKSA6+R8Z5BFeG0yJzgxLMs4PqHNokLPHjXcgzQD3:wj+E8Z51RgxLB4GokLPHj3kL
MD5:	F925FE2CCAF62128B355BB3B76500E71
SHA1:	90B1C4FBD5A8E2546935E97B60F29C0A6AD5B90F
SHA-256:	C747DEE70B08CC51363721B6363233FF01977F191AE23A5148E5F96263EBDAB7
SHA-512:	6C7ECA7FDF8A30E5B8B97AFCA1EA12B77ED20B700CCCA410D1954D101023620C4DA9F96F346747CE531D016B8DDB5CAC13DA24425077267DDE2EE82C31EC32F1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^.............T.......T................m.......{.9.....\|.......\|.......l.......i.....Rich............PE..L.....!W.................`...........7.......p....@..........................@...............................................1...........{..............H]..........Pv..................................@............p.......1..@....................text...>_.......`.................. ..`.rdata.......p.......d..............@..@.data....e...P...*...D..............@....rsrc....{.......\|...n..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-6E68T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.744133942517966
Encrypted:	false
SSDEEP:	192:+y8C5Y1b47ZwpPgTWDoC0AXZb5kTEahf/0EYbRlmJsEY2BOE/V8462vZYL3X+Eqg:+y/Y1b47Z6oTMoVAXZbyTEahn0DlmJ7W
MD5:	ED7CD45B77EEC58D56C431CB6D353E38
SHA1:	52707751E374AC86E2BE8CFC7C9C43FCB0CA52B5
SHA-256:	C1FD80868EE87CB1C5FADF20637C8CD93D237050679DEBC8B77761655078CFB6
SHA-512:	8EBD1EF51653C337856883348B6CD586B17D16351A727928D3C0BF0FE1FCD236AB1BDB57F0253145242B8316FF3F228569A9AE038284E1B8D5411B87FACB58EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................................................................Rich....................PE..L....rT...........!.........................0...............................p......q.....@.........................p<.......5..x....P.......................`.......1..............................p3..@............0...............................text............................... ..`.rdata..6....0......................@..@.data...x....@.......&..............@....rsrc........P.......(..............@..@.reloc..Z....`.......,..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-6NO15.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.84519716457685
Encrypted:	false
SSDEEP:	384:J1qv3eHhfdzoNcrOHmYL2N5ek5KvEIF5uOtuWi46GZOX:JgPKdzoNyTYaNIoKvBmOtG46GZO
MD5:	C3C8CBB7532D3462A782D72A15117025
SHA1:	3D4256BA4300F6333CB1B71F62788920A8F2B174
SHA-256:	4389E98E0E7E87CA5478194A770A1979D6A0D326294EE1701B87AECCBEC244BC
SHA-512:	9CBA6367C534CF0939F069248E0EA39A92CA6FEC1EED3E53A3820B73DFCF4C2FECF34E4B7DA3E14BB0D20C8DE3D3E676E1EF1E9684592C94AAAB3FD87875229A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b?...Q..Q..Q..L...Q.{...Q.{...Q.{...Q.{...Q....Q..P...Q.{...Q.{...Q.Q...Q.{...Q.Rich..Q.................PE..L....TRQ...........!.....2..........6.......P......................................a.....@..........................f.......Z..P.......<............................Q.............................. T..@............P..\|............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data...`....p.......N..............@....rsrc...<............P..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-7FLPA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1998168
Entropy (8bit):	6.7631254131269465
Encrypted:	false
SSDEEP:	24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
MD5:	86E39E9161C3D930D93822F1563C280D
SHA1:	F5944DF4142983714A6D9955E6E393D9876C1E11
SHA-256:	0B28546BE22C71834501F7D7185EDE5D79742457331C7EE09EFC14490DD64F5F
SHA-512:	0A3E311C4FD5C2194A8807469E47156AF35502E10AEB8A3F64A01FF802CD8669C7E668CC87B593B182FD830A126D002B5D5D7B6C77991158BFFDB0B5B997F6B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..=.a.n.a.n.a.n.a.n.a.n.3hn.a.n.3jn.a.n.3^nZa.n.3on.a.n.3_n.a.n-..n.a.n.3nn.a.n.3in.a.nRich.a.n........................PE..L....1.K...........!.........4......................................................m.....@..........................i..&,...Z..d....................f..X.......x.......................................@............................................text............................... ..`.data....P..........................@....rsrc...............................@..@.reloc..>...........................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-7VSP1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	169984
Entropy (8bit):	6.462529050201304
Encrypted:	false
SSDEEP:	3072:O1SEBXHnoai9fx3f9Tfx+VBiFoEIerKgsVQKJOKgmLerjr:O1z4tFTx+SKgUQKJOKgmk
MD5:	3345EDA88B472342D66878CFC142F7DD
SHA1:	A99F916BDE3A6BFE450CA9A8E7C41A757EDFEFB6
SHA-256:	7BA56AD7E3F05C4BD0F4E88FE94BCE26BD02FE54FD960D87E04188469394A61E
SHA-512:	170F69C8FE1A3B908D83AFFD7157B765CDA7200CD1752DE0DD4E524FE48A19841B3F3489E35A0BDFBDF5F6589360121E6F7C54BD82775FB02B83F16BAD6E33E9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.B.n.,\n.,\n.,\..\o.,\g..\j.,\g..\`.,\g..\h.,\I.W\l.,\g..\c.,\n.-\E.,\g..\c.,\g..\o.,\g..\o.,\Richn.,\........................PE..L.....e...........!......................................................................@.........................P`..A...\|:..................................d%......................................@............................................text............................... ..`.rdata...~..........................@..@.data........p.......`..............@....rsrc................d..............@..@.reloc..r/.......0...h..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-8CTED.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	976786
Entropy (8bit):	6.1059114855282175
Encrypted:	false
SSDEEP:	24576:wdB0j3YegUqHoYe2M5xST/mPNg3PyQSeBU:wnm3UUHb2EW/mPNgo
MD5:	87E1A4947E7E93D1FAD095AB91B20D70
SHA1:	BB44EDD085EE2B521F9124FD2DD1B57D018CA5A0
SHA-256:	F7046341C5B96BF9E499DFD6433DF171B7D13C02EAC8AF10C0669B95ABD1BCE2
SHA-512:	BC0A220AFC257349396FDDD58AE8880D9073A6D34E979080018E0ECAA0062A026051237A022313A52FB0EB3E4EF9705B5A21079DC33092CE753E5A2BB6E4C963
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+j.M....=......#...8.........z................pk.......................................... ......................p..6.......h.......x.......................0....................................................................................text...4...........................`..`.data...............................@....rdata..\...........................@..@.bss.....x...............................edata..6....p......................@..@.idata..h...........................@....rsrc...x...........................@....reloc..0...........................@..B.............>.................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-905AF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	6.426761452579602
Encrypted:	false
SSDEEP:	6144:x4siSWNEonsEul5fNbSp4sul7zrUypnFHc6adK4R7Cd/a3va5ivZv14xkZjNfAbq:x4MWNEcsEul51bS+tlXrUyBFHc6adK4x
MD5:	6BC10EEC59B2AB24C24CC544B1A31178
SHA1:	2AA06BA399C7F45E90CB11E32C7C47250B0284D1
SHA-256:	0A906F0002A6637312A56D5FB92434BCFC47FE44636846454226EFE2DF872802
SHA-512:	AF764FAFAE682F433D4C372561DF895AF16E874E867CBAE1D12DBECAE102C3950C565FE6962CAE7F603531E0BF89F3AEB67AC86C5C7B83857A59A7DC3C0C8DE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........qR.u"R.u"R.u"uM."P.u"[.."P.u"[.."Q.u"[.."\.u"[.."P.u"L.."Q.u"R.t".u"L.."}.u"L.."S.u"L.."S.u"L.."S.u"RichR.u"........PE..L...1.LS...........!......................... ...............................`......R...................................p$..,...P.... .......................0..t#..0&..............................(...@............ ...............................text............................... ..`.rdata.. .... ......................@..@.data....1..........................@....rsrc........ ......................@..@.reloc..~$...0...&..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-9GRVS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36600
Entropy (8bit):	6.293365115285525
Encrypted:	false
SSDEEP:	768:VVRRdUlDRJuOfUhk8ZX2ZeRY4soGLeTZ8wwfKRw:VVRsZREOfUhNK96TZ8wwi6
MD5:	DE7FCC77F4A503AF4CA6A47D49B3713D
SHA1:	8206E2D8374F5E7BF626E47D56D2431EDC939652
SHA-256:	4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6
SHA-512:	FDACE7EE2593FFE5724DB32F4BE62BB13AA1EC89E1E01C713D8C1E9891A5A0975D127450024C3388A987A35E546568ECDBCC60C185DC8F8B08CCEF67A084B20D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}i.}i.}i.}h..}i...}i...}i...}i...}i...}i...}i.Rich.}i.................PE..d.....0Q.........."......V..........................................................9q......................................................d...P....................p...............a...............................................`...............................text....M.......N.................. ..h.rdata.......`.......R..............@..H.data...4....p.......X..............@....pdata...............^..............@..HINIT.................`.............. ....rsrc................h..............@..B.reloc..<............n..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-A8VS5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88576
Entropy (8bit):	5.027908034200073
Encrypted:	false
SSDEEP:	1536:nAilT4tC7zYqy9x6KF8QFaN3g1uGba9GOt5NV:9l8o7zYqUx6KF/R1uGbbOt5D
MD5:	AED35991FF47E0FD28ABAF6090F11DC6
SHA1:	064DAED7D2DD845B9CCCDB966742826292D3B20C
SHA-256:	8DBDF5CC792B19C0F88CFF5F4014D174716F48F0A7BEC34820DEC422C15A08E0
SHA-512:	3B1946A996431715864FA9EC16B46B32D4A73BD41F332EDB43F293084589F8EFE43A0F3E9EDEA4E4F6AC6F69BC33D0238662953C4C6D3173C87CD1C1B72A61C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`O.$...$...$...a>.&...-V=.&...-V+.*.......&...-V;.-...$...U...-V,.(...-V:.%...-V9.%...Rich$...................PE..L.....e...........!.........`............................................................@.........................P>.......`..x................................... ................................"..@...........lc...............................text...K........................... ..`.rdata..W1.......2..................@..@.data........P.......,..............@....idata.......`.......0..............@....rsrc................J..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-AJQ1H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87552
Entropy (8bit):	6.518079451361349
Encrypted:	false
SSDEEP:	1536:zyqciylsql8Ao9lgxjt+PyK+vh6d6Mt+Gu0aPnHuM+jZ/kd8j7Ja/f9N1+LOt6qf:z1FyOql8Ao9lY+PYvgu5PnHuBjZcd8jY
MD5:	4F07153B94647A8F0DD844AD1F79C092
SHA1:	1B59C179284C4675D5408391F96C95F8DA2E9237
SHA-256:	7559B5BC65BCAE4BFDFF50AF2343B117F631B60F5507EFD3A3344C6684661DCA
SHA-512:	5EC61C9791F4DE674F2496BDC3BFD20EA8153B1E42017810A7F540DAC6B613C11395293E9F63627A02AC8A8008E05FAAAFB9575DD914C48FE69017112EFCD6C8
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......O 2c.A\0.A\0.A\0.9.0.A\0...0.A\0.9.0.A\0.9.0.A\0,.'0.A\0.A]05A\0.9.0.A\0.^W0.A\0.A\0.A\0_bl0.A\0.9.0.A\0.9.0.A\0...0.A\0.9.0.A\0Rich.A\0........................PE..L......^...........!.........J...............0......................................IL.............................. A......\;..<................................... 1...............................................0...............................text............................... ..`.rodata.p.... ...................... ..`.rdata.......0......................@..@.data....h...P...(... ..............@....rsrc................H..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-B06VR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2348032
Entropy (8bit):	6.1503918178326575
Encrypted:	false
SSDEEP:	49152:abRYIa2KS+bT235n/8VSR35H1xAvdC875+xP1CPwDv3uFfJ7QS:+RYIa2KS+bE5nUATwC8F+xP1CPwDv3uT
MD5:	1B4BF0709F37B7047423736E1E253DC6
SHA1:	305431F8C4600DFDEEF81C73AA61C42C2E7F4A68
SHA-256:	24A7A1BB77F97D5C7F21778BA0BD5C5362DCC3C7252233C9B454307F5783EC9D
SHA-512:	9F59EBE3C37B6E212C48D8EEA7C5DE45FB320F277BBE7161F97833F70E23B18AFDA81CBE2BAF97B7B9A5C1803D5221A8EDE7E66C46AB9AD8012E81D64FE27F05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#K..pK..pK..p...pa..p...pU..p...p...p...pB..pK.~p...pF..p4..pF..pJ..pF..pJ..pF..pJ..pRichK..p........PE..L...!..a...........!.........<.......?.......................................p$...........@..........................4 ..h..X3#.d....P#.\|....................`#.....P...8...........................X...@............0#.X............................text............................... ..`.rdata..............................@..@.data...d.....".......".............@....idata..K....0#.......".............@..@.rsrc...\|....P#.......".............@..@.reloc.......`#.......".............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-B6PJK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.690648483945704
Encrypted:	false
SSDEEP:	12288:IWnOqCV69MtyroKyYr8lRPm4bHuG2gwQWiGUeRxVb/Gowgaj9sraw:IWOqCVMMcroKyYAnmaui9eRxVyoBd
MD5:	D54A58B52F548275AEB9ED1822D0DDB7
SHA1:	E3180202B8852BB975F262B7CCD85D71C1E12A2D
SHA-256:	18C50E20AAA5F85A8BC70BC297DCAF48A1DF355E7A6D611013941446EDE13B23
SHA-512:	CB0C36629CE6F06AC657D72A13C008752B5C1404AF47951BEDE3D077D014E5FCDEDD666BC110900B00B9A1CB4944A9DFE55D72BF84AA280C21F41450E4F2B442
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ S..A=L.A=L.A=LI..L.A=L...L.A=L...L.A=L...L.A=L...L.A=L...L.A=L.A<L.@=L...L.A=L...L.A=L...L.A=L...L.A=L.A.L.A=L...L.A=LRich.A=L........................PE..L...;.mc...........!.........T......]........................................ ............@..............................v..(,...................................... ...8...........................0>..@............................................text............................... ..`.rdata..............................@..@.data...l ...P...,...>..............@....rsrc................j..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-C56CN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	287232
Entropy (8bit):	6.6174141355540135
Encrypted:	false
SSDEEP:	6144:dlfP6t+9zAlguI5oOq2pLjHWmBYOFNiUwwC1km3eGtWPvlvRg0HMt:bP6Uelzl9On19dNmOeWbg0k
MD5:	A8C7CC2ADEF970175E87BB5CF0576FB5
SHA1:	46D08085C6C16FB5DEA4686D309F67D183DA60BB
SHA-256:	080E111B9AD198796CE2D875F3BE9D793627B546BF6D57AA1F3E2184533981CD
SHA-512:	714F43F706EB3ACDC29BF7E2005F3B9B02959F74EA5FCE9C4A7B5B936CD108C5AFAA6599063E535F92E0AC5CE8D02AAC39BFECB351CF5B9C8531CD471E96CE4C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................\|.#...... ......1..............&......6.A....'......!......$.....Rich....................PE..L....SGT...........!.................................................................................................;..c...\0.......`.......................p...)..P................................/..@...............,............................text...f........................... ..`.rdata..#...........................@..@.data........P.......,..............@....rsrc........`......................@..@.reloc...*...p...,...6..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-CD1R1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.357541095717686
Encrypted:	false
SSDEEP:	1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
MD5:	86A1311D51C00B278CB7F27796EA442E
SHA1:	AC08AC9D08F8F5380E2A9A65F4117862AA861A19
SHA-256:	E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D
SHA-512:	129E4B8DD2665BCFC5E72B4585343C51127B5D027DBB0234291E7A197BAECA1BAB5ED074E65E5E8C969EE01F9F65CC52C9993037416DE9BFFF2F872E5AEBA7EC
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................<......0.............@..........................`.......................................................@....................... ..h...................................................................................CODE....\........................... ..`DATA....h...........................@...BSS......................................idata..............................@....edata..............................@..P.reloc..h.... ......................@..P.rsrc........@......................@..P.............`......................@..P................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-CPBPM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	940032
Entropy (8bit):	6.4853172826830825
Encrypted:	false
SSDEEP:	24576:4n9OEI7SfQaWOq/hAAB7rWbLgi/yPtsdhu:8OEI7/ZOqtrWEp
MD5:	5C350D0C2B331B342D52D1155A4C160E
SHA1:	8578F708454351A33B304B51214D7B20E4AE9EA9
SHA-256:	412F6C0ED936316275E68E21DF7255E4E35FAD14E114E479E8C5C9D75ECAC88C
SHA-512:	C8C2F0928570802990E5CB4467A6DFFDE5CE6A2BB8D2AEE5E6C25A6879F5CEB96045559BA6C27959F57F05B0E2531B2487FD605137C1E8D18C90B5F21CFAB57F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........SB...B...B....(..C....(..z...b..H...b..I...B.......b..L...b..C...b..i...b..C...b..C...RichB...........................PE..L......@...........!.....6...................P.....................................................................P1......\!..d............................ ......@................................`..H...............4............................text...Q4.......6.................. ..`.data........P...B...:..............@....rsrc................\|..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-DP620.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	589824
Entropy (8bit):	6.503653225543875
Encrypted:	false
SSDEEP:	6144:395tgBH8acQEZB3rWhJEpRKmGdFrqk9b03QQwMUjAD57EAOOnXGbhvxVs:2ctB7Wi5ku3QYUjA17Em
MD5:	C39F735AF346571257DAA8F637C2D00E
SHA1:	DAF544EDD624005D6C28CDB3E68630FA3FF07E71
SHA-256:	F616E513BD345E7CDCF994786C1CF60F760C9E8CCAF9CA329DA036D76FBB2AC3
SHA-512:	678A44D3B7902D9FF03D84C9F9D611043A8CA25F6C6A63574FF1EB081D98209C5E827CF0046E5E43E73621A193A547AC6F259D68D3C9FC07134605D6FDAFA0CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%_.tv_.tv_.tvA..v}.tvx%.vZ.tv_.uv3.tvA..v[.tvA..v..tvA..v..tvA..v^.tvA..v^.tvA..v^.tvRich_.tv........PE..L...U..Y...........!.........f.......K..............................................tv..............................`...........<...............................`0...................................j..@............................................text............................... ..`.rdata..............................@..@.data............2..................@....rsrc...............................@..@.reloc..\|2.......4..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-E83DF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2106216
Entropy (8bit):	6.4563314852745375
Encrypted:	false
SSDEEP:	49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
MD5:	1C9B45E87528B8BB8CFA884EA0099A85
SHA1:	98BE17E1D324790A5B206E1EA1CC4E64FBE21240
SHA-256:	2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
SHA-512:	B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-ED0L2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	716570
Entropy (8bit):	6.497908445034353
Encrypted:	false
SSDEEP:	12288:50QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv35ELA6XEx9rB:xfKbT5lrPo37AzHTA63/cfU9IEU35364
MD5:	341D1D6681C808128C1C0C8C82C39DFA
SHA1:	8AE352DD7CF5CE1B69EC6C6C3EB55BADE8F6D7A1
SHA-256:	B7B7B384EEFF193993C209F7339C200E82002C90982F6FD8CAFF9AF9F3008457
SHA-512:	D529B537CAE3463AF22AB8C4E38F7198E5D4EF7C69F21C8423F95675E9A99E024FC6BDBA3FEF3299B3B876FB7C83A3ED65AD0552749B616665C4A718E217F03A
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...a..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....a...`...b...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-EIJEC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223232
Entropy (8bit):	6.467007978478341
Encrypted:	false
SSDEEP:	6144:Mnp1oXTWXXo/TZDZlntqmH9Rh+0VeOtDlh:Mnp1dXX+TZDfntqmH9Rh+w1h
MD5:	5DA063D6106FE5357DDB75757D940B6C
SHA1:	1BFC544A331DF6244F66DCFC700D6F683CEF3D7C
SHA-256:	221CD8B137E3C56BC27DAF78E15F3B33EE8CF2293D4E1525156EB95664E4F1DD
SHA-512:	E4D68CE34C44BF09451C0A5DA9AB49B4A39BD18E26C2EA2D539C23537CCC6D60EF64620784150F677B1479D137CBB97C0868AAF971DA8A376A8521DEA9BD1F99
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+R,.o3BIo3BIo3BI.\|.In3BIfK.In3BIfK.I`3BIfK.Ig3BIH.9Im3BIfK.Ii3BI.,FIl3BIo3CI.3BIfK.Id3BIfK.In3BIqa.In3BIfK.In3BIRicho3BI........................PE..L.....tS...........!.....v..........S[..............................................El....@.........................P,..........x....@.......................P...4......................................@...............T............................text...Ku.......v.................. ..`.rdata...............z..............@..@.data...t....0......................@....rsrc........@....... ..............@..@.reloc...@...P...B...&..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-FD4R7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	9199
Entropy (8bit):	4.293948419348199
Encrypted:	false
SSDEEP:	96:CHAMiJDit8rz1JW849R0M0s0k0YGerrsigSaswsWlnxnTS8SBLLSn9+MwpqlKDQ6:IItNVB/z2b7N1kb24eNslS+q03b0drnr
MD5:	806317F447C17B22E94D668AD2B99201
SHA1:	68F967A8B74929FA0AC73EFC3EE0E5ED143C045C
SHA-256:	CB990103EB7ED3E46F0BE3DEA51D0395EACDD054AAFB0F379B07AE6B191453D2
SHA-512:	43030668373F2FD3C8EAC18CFE52093E2CCACB51F978A6875556FF21BC656F2D4A12074D4A2DA39D92BFCF3A4A13FB3C6C77329A9FF48C7053A77C106EFE7566
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<beans> .. <bean name="name" value="Afghanistan"/> .. <bean name="name" value="Africa Other"/> .. <bean name="name" value="Albania"/> .. <bean name="name" value="Algeria"/> .. <bean name="name" value="Andorra"/> .. <bean name="name" value="Angola"/> .. <bean name="name" value="Anguilla"/> .. <bean name="name" value="Antarctica"/> .. <bean name="name" value="Antigua and Barbuda"/> .. <bean name="name" value="Argentina"/> .. <bean name="name" value="Armenia"/> .. <bean name="name" value="Aruba"/> .. <bean name="name" value="Asia"/> .. <bean name="name" value="Asia Other"/> .. <bean name="name" value="Australia"/> .. <bean name="name" value="Austria"/> .. <bean name="name" value="Azerbaijan"/> .. <bean name="name" value="Bahamas"/> .. <bean name="name" value="Bahrain"/> .. <bean name="name" value="Bangladesh"/> .. <bean name="name" value="Barbados"/> .. <bean name="name" value="Belarus"/> .. <bean name="n

C:\Program Files (x86)\Ezviz Studio\is-FIAFN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48968
Entropy (8bit):	7.037914834013295
Encrypted:	false
SSDEEP:	768:gJ+Ff1A+Qek4kY0AvB51UROMSNSj5B6UOyYida3hc92+T3hmj:P1FQek44AvBHmOV4jL7da3hcUM3hmj
MD5:	F98A08CF8AF1C62FB89FCB7BE8D15E7E
SHA1:	870297453CF97A0983788EB289993EE180CEA645
SHA-256:	99E8D275552BCC891D44D2E4168ABC92AC38AE39BBC2E21F623EDE6D8E8DB1B9
SHA-512:	081B06B085DA4973FF2360D7C6A587381139C151454CAC4BA1E58AB6DC1518F6E06D86C5A98BD8ED4A41C1352BEBE1A3640C7E1DAE1D6E5CABE69889A8C5323A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..............D.......G.......Q...............A.........\|.....V.......C.....Rich............................PE..L......S................. ...>.......%.......0....@.................................wo....@.................................4?..x....p...............b..H]...........................................9..@............0..(............................text............ .................. ..`.rdata..p....0...0...$..............@..@.data........`.......T..............@....rsrc........p.......V..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-FM8S1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3408008
Entropy (8bit):	6.439717447308692
Encrypted:	false
SSDEEP:	49152:UWcOLf2zTASjTxgu4gufguTJ7hMDkfiY2Qeo49:UWcOLf2zT5rHzp9
MD5:	DAD876D137BD65D1D2F298E7B8F8C318
SHA1:	211EF46E6C5960BBB9C69E43766EB2C01C9DFF59
SHA-256:	B3F3E842D21EF89FB53A6D718AB2F5C7A24DFBA088B6D3389D6FB1F2BF9C06DA
SHA-512:	59F3842D6571053F534F68051D75EB9A3E8A681AE17886E23348838EA20F7B6D65987776D501A1E892600EC54DC62834267D51686CEE7A294FEF21C2B1E746FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R?<..^R..^R..^R..B\..^R.yAX..^R.yAV..^R..^S..^R.tAA..^R..AX.4^R..R..>^R.1./..^R..^R.=[R.B}c..^R..XT..^R..~V..^R.Rich.^R.........PE..L....:.Q...........!.....@2.........{........P2...............................3......v4..............................,3......3.<....P3.............H.3.@ ...`3.tk..`P2..............................................P2.L............................text....82......@2................. ..`.rdata.......P2......P2.............@..@.data...8....03.. ...03.............@....rsrc........P3......P3.............@..@.reloc..{...`3......`3.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-GJ4VR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116736
Entropy (8bit):	6.42937079950737
Encrypted:	false
SSDEEP:	3072:1wumAuoyE8W9zyxLmTiRAb9HECADzG8UxmG1EFIXipOl6Otwk8Bcer8:1wumAGWExSmRi9Hzcg6OtwZ+
MD5:	AE369F96B50537C89904CA74B38CE6A5
SHA1:	5F75AA54A3FBE42E01BA8867E280C354FE960C77
SHA-256:	EC855B9D874D754A25752C7D1E6FE18E5F42721450D3C8D2AD3F46383A491D21
SHA-512:	46B49093A6F9C27A1072D71F86B43938994CB5701A7861C3AAF9859C33710AAAA969AA660687D456A8B41AF67E9A89BC27D56FBF4E63C01F18FAF10F23919AC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...zp.zp.zp.s.r.~p..?w.~p.s.t.sp.s.b.up.s.e.rp.zp...p.]...wp.s.k.Yp.s.s.{p.d"u.{p.s.p.{p.Richzp.........................PE..L....1.[...........!....."........... .......@...................................... .....@..........................q..9?..x[..........L............................C...............................O..@............@..l............................text.... .......".................. ..`.rdata...p...@...r...&..............@..@.data...............................@....rsrc...L...........................@..@.reloc..0".......$..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-H6BF4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51360
Entropy (8bit):	6.752761608535189
Encrypted:	false
SSDEEP:	768:mTMddX3sE5EY2QWyrzYdUGoxO72zjN+KcOtsEaVp20BR207p23+zj4:mysE5EY9UdU3xOaPN+KcOtsEaeBx04
MD5:	4C718D2AD254F44BC32EED17D3E25FC0
SHA1:	5CC62DBDE128E9B9CA6356C3ADA6C406F071AC22
SHA-256:	C5FE1467133192C4C928CC7343D74A9BE9DDEC7A0CA06D2B92030DC8A496F11D
SHA-512:	04E83199D8A189D2B802ABF0F4032534F7819F03CE31F55BAA05575A5AEBD6601F6A4DC09DC75CA4552958BCEB3FDD9ACE85A39B4B98938BF3C3A27D09C5146C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V)5@.H[..H[..H[......H[..0...H[..0...H[..0...H[.5. ..H[..0...H[..HZ..H[..0...H[..0...H[......H[..0...H[.Rich.H[.................PE..L....\Q]...........!.....X...:.......a.......p.......................................m....@............................................(................2...........r..................................@............p..l............................text....W.......X.................. ..`.rdata...&...p...(...\..............@..@.data...$...........................@....rsrc...(...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-H7EA0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95296
Entropy (8bit):	5.457397189343623
Encrypted:	false
SSDEEP:	1536:41pRi3A0lcFMbxAOomOYILwa7c7dA3hdej:kvi3A0lcFMbxAONOY/acpuK
MD5:	4406E8265B80FC6B36046B07F98067B4
SHA1:	BEBB9E97BCF0477FF8A867E4241E49F52A9583C4
SHA-256:	1E6F8DD640C43C37F91D40C44E9B382EA9CEF9801FDC0183CE53A9742CA2928A
SHA-512:	4DB3ACA14A2DDC6F152C065232BF44F87D8DB54D5B273318101947D68B6286FE63F3531D3207FB7760042FB0B34E11E49D10555EF617109403F0BB3C3E6E4EDF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..2..2..2S.D2..2..G2..2..Q2...2.c.2..2..A2..2..2(..2..V2..2..F2..2..C2..2Rich..2........................PE..L.....e.............................b............@.......................................@..........................................0...9...........T..@ ...p.. ...0...............................P...@...............4............................text...R........................... ..`.rdata...+.......,..................@..@.data...............................@....idata...*.......,..................@....rsrc....9...0...:..................@..@.reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-HTMT8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12747264
Entropy (8bit):	6.6817162366350065
Encrypted:	false
SSDEEP:	98304:PxRSeXoBhwRkPyEeqMbLH09KOJu1tzFaUFlNNN7wIgQB:ZRVXoBuQGbDqu/J/tgQ
MD5:	AB3C99F71055A79EEBABB4B0405B57FA
SHA1:	965C3D40E7AD3AA7C8AC24680839D27EF16EC832
SHA-256:	C8D18BFEB07A9D388F717F7C8D6CFAB6EA27BC5382B0166E1004445137103E56
SHA-512:	1D0FF85F29EE07A950789D50913ABB6583B44DE357586618C3CCAE7822E59D2B9F27B5D6A7188947865CD26EDC4A86AD42F8173E76BAEFC15B7EDDAA21D640B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eg..!.@B!.@B!.@B.I.B#.@B?T.B/.@B?T.B..@B?T.B%.@B?T.B).@B(~.B'.@B..;B..@B!.AB9.@B(~.B .@B(~.B..@B(~.B .@B(~.B .@B(~.B .@BRich!.@B........PE..L.../..Q...........!..........<....../}...........................^.................J1....@......................... ............... .......................0......................................(...@...............d............................text...]........................... ..`.rdata....-.......-.................@..@.data....j.......(..................@....unwanted...........................@..@.rsrc........ .....................@..@.reloc.......0.....................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-I91V5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1325056
Entropy (8bit):	6.538912426398886
Encrypted:	false
SSDEEP:	24576:U+hcnIflk51vNrhW2ORXffWXCphzIciJk44wBP5+o0erXwMmwb1E:U0cnklkDz27zTiJn4wRZZ5mwbu
MD5:	F83C16A2E9274F2118E1734A9B9B1B5E
SHA1:	384F66EE3E055AC0418921820396A5948793718D
SHA-256:	DEE59B389BC51ED2950FAAB315FEFA3FE9609F6833224D53D28E789475B4BFBE
SHA-512:	4A2AD713B789190D5D305CCF8190EF33C221F0DC5C4A216C768348D53406EC43528D307FBBC966231CA0CCA5CA23DBDA669C3E230FB6C22ECDC39E8062A10F1D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tt~w0..$0..$0..$.Z.$2..$9m.$...$9m.$...$..}$1..$9m.$b..$..k$!..$0..$E..$9m.$s..$9m.$1..$.G.$1..$9m.$1..$Rich0..$........PE..L...JW.Z...........!.....l................................................................@.........................`...........................................W..................................P...@............................................text...sj.......l.................. ..`.rdata...0.......2...p..............@..@.data...l...........................@....rsrc...............................@..@.reloc...r.......t..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-IDLFR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	340992
Entropy (8bit):	6.4314715652629175
Encrypted:	false
SSDEEP:	6144:Y2o+3SlfoWPbMIoV50sWTwlZ2ysNOmmNSu7:i+3SlfoWPYIoP0s2Vu7
MD5:	F1B2CE3DCAEAB0267543035BFFD10851
SHA1:	D8BF3346E4399FAAF5C1884C7FA349972B1FCDFD
SHA-256:	03BDFF0CA987FAE960EB15543902776DC3CAA69E4315CC8903367F5D6F2F2BDE
SHA-512:	88F3FCBD537CB4D262F94C0AF1B5E46A8632C03332815DC8A8D0DA73E19FBE69F5540990BE9E24799980B9786DDBAC4D72F54ADDBB98BB269A4D7FD2811D38B2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7w..s.o.s.o.s.o.T...q.o..Y..r.o.mD..q.o.mD..~.o.mD..t.o.s.n.h.o.mD..{.o.mD..r.o.mD..r.o.mD..r.o.Richs.o.........................PE..L......R...........!.....J...................`.....a..............U..........p.......1....@..........................B......t...d................................L...d..................................@............`..\|............................text...tI.......J.................. ..`.rdata.......`.......N..............@..@.data...L...........................@....rsrc...............................@..@.reloc...W.......X..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-IO7BE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	428544
Entropy (8bit):	6.705383344139919
Encrypted:	false
SSDEEP:	6144:WWkN5tPYsRA318Y+vMwER19P7nQA7NubZIgxdqtAOje/:zkvtPYxSo7nQSWZ7Pqt0/
MD5:	9029D85F9533C62560A4792B07EDD821
SHA1:	DADBB7130A1173F6EB0A07745FAEF7C19203AEE1
SHA-256:	C33EE2A3AC83C69584F7559F6C0A4D28E621A116A4ABA97C8945E103DAEC2302
SHA-512:	1139512F3C5BB3B5AA548285ACBAD2D65A4B7828F53E48321521AEAA1156385290CCA6383765096276CF510B4782D72517DA66B335664B6F3F383A6A62CE1AAC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.?...?...?...!.X......D..<...?...]...!.N...!.I.f...!._.>...!.Y.>...!.\.>...Rich?...........................PE..L...2..Y...........!.........l......W........0...............................P..................................................(............................ ..<&...1.................................@............0...............................text............................... ..`.rdata..f....0......................@..@.data....:..........................@....rsrc................\..............@..@.reloc..<'... ...(...b..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-JB66K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	5.084125091817236
Encrypted:	false
SSDEEP:	768:ZOyY7dTQzsCuV/ILSmY8lhcELGL3/hglgz23OKRuQNv:01VwsCuG+sUEaL3/+OKRuQNv
MD5:	475E16473CCE539A5908466F7C58F5C2
SHA1:	62F329D4F7052DF0C7094C33BEB0F89D5657F951
SHA-256:	3C34717314E1EB298C6B7C5596F9C4BC43E74A07685085E2D004B6E1A35A5A20
SHA-512:	7DFE8A7778EC69E17EE6DB56790F35B33AC206AE844D3700F3634F2AEE265A2FABC889EAB86C58845EFA9BCC929C80498930F824B0ED485AE5BB1D64D97570EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q.;.0ih.0ih.0ih]..h.0ih.H.h.0ih.H.h.0ih...h.0ih.H.h.0ih.0hh.0ih.H.h.0ih.H.h.0ih.b.h.0ih.H.h.0ihRich.0ih........................PE..L.....e...........!.........V...............................................p......&.....@......................... ........0.......P..L....................`..@... ...................................@............4..h............................text............................... ..`.rdata...).......*..................@..@.data...(.... ......................@....idata..a....0......................@....rsrc...L....P.......&..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-JRCF8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2180096
Entropy (8bit):	6.715858746553116
Encrypted:	false
SSDEEP:	49152:cgOnLzp2WX3D+mjfpz+MeHLbdI4iGUd0wmz/EO4GjF:+DvjhzMHLbdI4iGg0wmzSG
MD5:	82A0338F91996B9046D4B75058413674
SHA1:	877641B022F73F12F71DAD50113999E966A5BFFA
SHA-256:	1EE58997256093F4C3D077A1EB695FB0532FAEFD8B884A124688CA443670CCC4
SHA-512:	2D2495186EBE07889DE0E724AE2B134AC6583EEDE931F15DC0428CD1FCE4C6D2157DA720C0E7D426839049777F472AC2B35CBE0209AD84D4AECF7A5EFD99896F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m..>..>..>.eD>..>.b>..>.\>..>.c>s.>J:H>..>..>8.>..f>..>..c>..>..b>..>.._>..>..X>..>...>..>..]>..>Rich..>................PE..L.....mc...........!.....&....V..............@................................p...........@.................................`.........n.......................n.8(...C..8...........................p...@............@...............................text...f%.......&.................. ..`.rdata...y...@...z.................@..@.data.....N......r..................@....rsrc.........n....... .............@..@.reloc..8(....n...... .............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-K3809.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1645320
Entropy (8bit):	6.787752063353702
Encrypted:	false
SSDEEP:	24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
MD5:	871C903A90C45CA08A9D42803916C3F7
SHA1:	D962A12BC15BFB4C505BB63F603CA211588958DB
SHA-256:	F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
SHA-512:	985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..\|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-LBT3O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69960
Entropy (8bit):	6.805631727988293
Encrypted:	false
SSDEEP:	1536:IfjGURVk5nMuOPCR45JF5aTSpz7dT3hTFI3hZR:gikiR45JF5auVpdFqR
MD5:	191F9AAA1C9DC443D70096D556C046BB
SHA1:	D48C71395DD5891AA785DFECA90D0A9757E80CA7
SHA-256:	02B0F286FB92F289C0875CDBCA9942C3E7E53E91CE5C776919B622DC791F28D3
SHA-512:	3D07B493F37051D95894F59585E17B1C85ADD1F302F8715B82A74A0365661D7500E3AA3DDA5786CDF1A776BEC79CB532F9F61DD67A9A7FB8B3DF07D888850446
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................R......C......U..........................\.....B......G....Rich...........................PE..L......Y.................l...D....................@.................................C.....@....................................d.......................H]......\...`...............................p...@...............0............................text...$j.......l.................. ..`.rdata...............p..............@..@.data...............................@....rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-LD25M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	6.708726906598856
Encrypted:	false
SSDEEP:	6144:8uzPKWItJHu6UBhRb37ejmPsR95DHdSyz7pDWiitPLh0FiGAn4gutSglVrTS:8uzPKWAtehdeyPsR95Rxz7pDW7PLox
MD5:	38C31E508FCC7AE2615CC11D053022BB
SHA1:	EF9DCFAA4A54C0C660FFBFB7C18FF8792D88E443
SHA-256:	906CFDCC7E2D55EF96C32718549961227B041083855AD12434572A14D6F0BB37
SHA-512:	D8674D40FF456DE5A8E6F90102A6F04D676D81604E945B9FF1621909D6A896EC8E53AA51FD1C9C94511AC2B459A57EB5B3E5A3F96E74D6931EC1322F26297C88
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.....Y...Y...Y.YuY...Y.YcY...Y..Y...Y...Y...Yh+.Y...Y...Y...Y.YdY...Y.YrY...Y.YtY...Y.YqY...YRich...Y................PE..L.....U...........!.....<...................P......................................b_...............................O.......C..<................................"..@R...............................................P...............................text....:.......<.................. ..`.rdata.......P.......@..............@..@.data...`....`.......D..............@....rsrc...............................@..@.reloc...$.......&..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-LF1B9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.819071831745927
Encrypted:	false
SSDEEP:	1536:lTGKPckiCjU1zpQxIV23/CcNOVFQIOQIOzG7HSE:lpckiZPQ6V23/k3GGzG7HS
MD5:	FDF28DA2ACB985539C24438A3E9576A8
SHA1:	F8E8E68C0BB0C50F3559A28B272FBADC7500DFE7
SHA-256:	CF007ED15815BB20CE747D6534383621E39442004D77C7BBFA8197A38CF665E2
SHA-512:	04B031FEC366A921B6B34BBCE0BF99E9AA14A3B1B7FA5CAA989507FE37B70E45F59A2A043E8D06D7E6D2BADFEF6CE5B9BDAC00D7F0C03F7C3F7D729FA326FB73
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I..(..(..(..\.l.(..(..(...yz.(....`.(...yx.(...yG.(...yF.(..zG.(..z{.(..z\|.(..zy.(..Rich.(..................PE..L....;Vb...........!.........f......<.............LZ.........................`............@.........................p.......D$..<....@.......................P..<.......8...........................@...@............................................text............................... ..`.rdata...W.......X..................@..@.data...X....0......................@....rsrc........@......................@..@.reloc..<....P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-M11TJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4629568
Entropy (8bit):	6.615107373053946
Encrypted:	false
SSDEEP:	98304:I2po51Ma7WrO9XHqYnLW6jDwroQvwvrx+zU0zHxqATxj2:IQCXfJ6oQojx+zzzHja
MD5:	F08E03127DCD470C45DE029574C1C630
SHA1:	8774EBB14ADBF284BF4A839A7EB405D0BB0E7069
SHA-256:	821326BFDF4A0A1B1B298425DF59CEA5E62FA898EBE4BAA1FE424535F11CD70F
SHA-512:	108ED88915EFAC2D88885F2DE9A6B458BAA1643B5B29F9BC829CD9DDDC594B83403E653068F2283F3708F521C99F9F3DA774702B6C31108ABEB6337195DDB6AB
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......N=...\.U.\.U.\.U..;U.\.U..8U.\.U.$;U8\.U..OU.\.U-..U.\.Ul.`U%\.U.$'U.\.U.C.U.\.U.$-U.\.U..=U.\.U.\.U.\.U^..U.\.U.\.U.\.U..-U.\.U..US\.U.$Uj\.U.$<U.\.U..:U.\.U.$?U.\.URich.\.U........PE..L...S."c.........."!......8...........2.......8..............................@N.......F...............................B..J....B.......L...............F.@ ....M..)....8...............................................8.p............................text.....8.......8................. ..`.rodata.p.....8.......8............. ..`.rdata...U....8..V....8.............@..@.data........@C.......C.............@....data1........L......2E.............@..._RDATA..@.....L......>E.............@..@.rsrc.........L......DE.............@..@.reloc..Z9....M..:...JE.............@..B........................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-M6FVE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	6.5893492509549665
Encrypted:	false
SSDEEP:	768:sZ1l+WCdhTcpKn+CwZoyf/dadEU9mRWtyTN:41l+WGhIKn+CQ7EyW0TN
MD5:	C4B4409F186DA70FCF2BCC60D5F05489
SHA1:	056663C9FD2851CD64F39D882F6758E7A987BD42
SHA-256:	B35F2A8F4C8F1833F3CDEC20739C58E295758CE22021D03D4335043148BD7610
SHA-512:	CDCB945A82A0304E4D7CFC9AE9D7E5A5E81D4E3025E982494C87C283F6FAC542181E9E1E3028456B9B0B5B6279990CB3E1A50F9DF0F6E707C70FA0E23C7A808C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."A@J...........#...8.z..........`..............n................................1N........ .................................T...............................0....................................................................................text...hy.......z..................`.P`.data...(............~..............@.0..rdata..P...........................@.`@.bss..................................@..edata..............................@.0@.idata..T...........................@.0..reloc..0...........................@.0B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-M9R81.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	764928
Entropy (8bit):	6.669106147235707
Encrypted:	false
SSDEEP:	12288:ggGeJLBm1hmvXaCckVzTe9XXYCS9RT1wACAOv8e4rWkbig:g0BGmvXaCckxMHlS9RT1wACAOE
MD5:	A8591BC0151D4C57D0746CE4DD6432EF
SHA1:	214E155C65554935B655B655B4A07CAD15EAEACA
SHA-256:	D7F4D4C110D7BB4EA731873D81B092E3EF3BDA6A72C3D8FBC532E4998E0A92DC
SHA-512:	EE6385CDD3E5245F198CD59EE08AF6ED30F7B89A559DADD11C8D5EA8CD0057E5D07AFCB90BCBDDED649ADB292D8B91A0CBCB3F5E275AF458E63B48D172B47DE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9}P.}.>.}.>.}.>.cN....>..S..\|.>.cN..u.>.cN..s.>.cN..{.>.td..y.>.Z.E.t.>.}.?...>.td..b.>.td..\|.>.td..\|.>.td..\|.>.Rich}.>.................PE..L......Q...........!.....0...x...............@.....c..............U.......................@.........................p)..............@.......................P...e......................................@............@...............................text............0.................. ..`.rdata..N....@.......4..............@..@.data....I.......B..................@....rsrc........@.......$..............@..@.reloc..$....P.......*..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-NGVJB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2617544
Entropy (8bit):	7.9969519062261885
Encrypted:	true
SSDEEP:	49152:U2n2fcbD7Gq3LNj321aFIWs8a16THZ9NyoooSdpuFZbdFFhbPKsGukLUgb9:5nqYDK8LHHLa16znQdoSdwvdFDbP10J5
MD5:	21658E7290EAEB93D83403D2E5B5F458
SHA1:	66AC378BA6172B7E84BB269D62CB278E2391FBF2
SHA-256:	93B3CE1A5DCCDC79C472069C9EE0AF74CA6D6ACC6AEB9C3437BE2A1CEA23A588
SHA-512:	7CE0E27FFCAC4FCA5E78B4DE0DC64A15E029BEE2CD51CEB1C02ABDB315904DE501945A3ECB24B26E9E355BF3968CE02B680ECE300CC9E69F3EC8ED13AB8F79B7
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................:......$.............@..........................@......R.(..........@..............................P.......`(............'.............................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....H................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...`(.........................@..P.............@......................@..P........................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-NLQUS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	375808
Entropy (8bit):	7.079582943202465
Encrypted:	false
SSDEEP:	6144:iaVgHJEoFJdVBJUMhZW9stxtl91TfE3wxxmpcYK4vcXr1+OUbyc5/g1DnUq46t0r:7V5oFJdVBJUMhZ2I3l9pM3wx+cYK4vcQ
MD5:	F1AE1CEA6A77616C739AC021C38EB910
SHA1:	152B5379395C03270243610A293D1D7555BE725D
SHA-256:	6D1626E2C850B15A6A1F0CAC3CEEC9F24A20F6EE3A9C4199F9BF2E02CA5DD2C8
SHA-512:	B2118491B4B0FBB37103BFB2B76FDBE68BE969EF1FF9106012FFFB94EFDCE9B76EF2290313D6D563ED943472D3E9BABF85F7B8BD2B254293D2C8C6706384E79B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................k.......m.......\|.....b.n......3..........B.....{.......j.......l.......i.....Rich............................PE..L....1._...........!.....l...L......Qu....................................................@..........................}..!....p...................................-...................................o..@...............\|............................text....k.......l.................. ..`.rdata..1............p..............@..@.data................~..............@....rsrc...............................@..@.reloc..v3.......4..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-OKI5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	527424
Entropy (8bit):	6.814434563171184
Encrypted:	false
SSDEEP:	12288:Oez6M+2rR7o01tLSilzsrduQgqLbUIj1fEWmk:L6KG3iNogYpjOZk
MD5:	ADF22207DDF0F16F72A8C6317E609341
SHA1:	74AFC9D14F2A3B78F0DA9D18D58CD6DEDB542DA6
SHA-256:	ED9A37C6B2BEE95E49BD12A64F826A0D9D648ADD88480CD614EBF73BEBBED8CF
SHA-512:	F7D4632BEB0BB4C8E326AD6F833927B118A515F9FE9CDFAB61DADBFBB4196D1D349F37009FDC0F642C488B5DB22B92576D498641691AD555D8CD513A0D25E007
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%...D.S.D.S.D.S.<%S.D.S.<3SdD.S...S.D.S.D.S.D.S.2.S.D.S.<4S.D.S.<"S.D.S..$S.D.S.<!S.D.SRich.D.S................PE..L......[...........!................F........................................@............@.....................................(.......................@ ......\ ..p..................................@...............4............................text...z........................... ..`.rdata..c...........................@..@.data...<0..........................@....rsrc...............................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-PCNT3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	4.847392796872375
Encrypted:	false
SSDEEP:	768:tWqAV6qVqzI7+ZqsSWOFZLpvTR1UPJzOBDOKj2Cp:tWqvqSMYCbUPJADOKj2
MD5:	91DD086F09AC2A5B5BC6E033B7E113B0
SHA1:	AF83B085C6749ED35E85CECED49B273869FB2AEE
SHA-256:	D950BB05785D0FAA32602BF6997AEC788675658086378248A022E53245A29F99
SHA-512:	78DD858EE3733EF461FD382C19BD633729685D08A331AC867D4B654B493E579E39CADADD275FB591A3B91B1F1327E35C0B2769F6D15A36A43C47B2B560DBC2E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...[..[..[.Z.L..[..#O..[..#Y..[..#I..[......[..[..[..#^..[..#H..[...N..[..#K..[.Rich.[.................PE..L.....e...........!.........B......e........................................@............@.....................................d.... ..L....................0..T... ...................................@...........0................................text............................... ..`.rdata...!......."..................@..@.data...(...........................@....idata..{...........................@....rsrc...L.... ......................@..@.reloc..{....0......................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-PO33G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1227776
Entropy (8bit):	5.947332935754226
Encrypted:	false
SSDEEP:	12288:UWpjwsQwaQwQUx/Xfa3J6H4MukMF3bkgmPaiA5tBoTZP36Anr9T/yUbUcKw:HuXfa3JaukM5bkgmPH0AZPRnr1yUbV
MD5:	541D730FFA2F07AA461D60BECB00E7CB
SHA1:	A8B46AB5DC41BA21C76B296664EE5F74C793FF98
SHA-256:	9D1F61665E4B8BDDEADC1E3C47A6B0C861166349C5C3B3EA3C43297FAA07521E
SHA-512:	CD6B38D0B20679B4F6F18EC858DF734DAA6836BF9A9F2801FA571411BFE45507D8667F5F779B7FC631388A2B69D1CEDD4D01FE8FAFBEAA57A412FA578ED92006
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................=.4....7....!...].....1..........&......0....6....3...Rich............................PE..L...r.e...........!......................................................................@.............................re...P......................................P................................v..@............q...!...........................text............................... ..`.rdata..2-..........................@..@.data....&... ... ..................@....idata.......P.......$..............@....rsrc...............................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-PU62R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8358912
Entropy (8bit):	6.729195080956289
Encrypted:	false
SSDEEP:	98304:VxwW0Zvw2/EUpSf9DSGpL5550w8chBhZug63GS+L+z2/zSA:VxoZvwBfdL5sKtcP
MD5:	4A87B028A26BDFA8BC5B8678EC777A8A
SHA1:	F5CC12C71D82E399C21C37DFE9730A04BF4415C2
SHA-256:	A65F7351FF0B008DA6F4D69304CEDE6FDC7505FE582267E6EE0E5D7DB91636FD
SHA-512:	61061DB5D6AB92D0AED50271755E7FF553CFA123FEEA540A1FFE025DE41AA08CE65312EBB4A4B026F2A459C9CCA659CE7B072AF0276E765F5AF62B654DFBF1AA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C...C...C.....(.B...].+.J...d[.F...].-.E...d[.T...C......].=.]...].:.....].,.B...].*.B...]./.B...RichC...........PE..L......R...........!......W..r(.......Q......0W....e..............U.................3t....@.........................p.j.'a.. ii.,.....x.......................x.t....OW..............................vb.@............0W..............................text.....W.......W................. ..`.rdata.... ..0W... ...W.............@..@.data.........x.......w.............@....rsrc.........x......zx.............@..@.reloc..$.....x.......x.............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-RAF6L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	6.248995357251524
Encrypted:	false
SSDEEP:	768:XDU4HaoGoYTIPOW6ysjv0B1s4dby5M/FPTOc8s1qMbk62OKR8QBYWi:4eYTIPOW6ysbU1Pdby5MNSc8s1qMo62U
MD5:	3A5478A176DF86880D872740E96ADC57
SHA1:	CF8D23C0991A8260470C2989ECBA6AFF88CD64AE
SHA-256:	97F59D9AED4378019628AFA4F17FEEAFEBF5FD91D12866E7EE81730FFE9017CD
SHA-512:	66EB44D2A8E327433148741A1DB3F4603A14B28BFAA3389F28F03EF27B211BF2EC8FAB6BBDCD9D2A3ED2E5DA565A00B71012031741F08FB0096897ECCFBE39BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.q.!...!...!...(.%...... ...(. ...(.,...(.%....Ld.#......"...!...r...(.)...(. ...?.. ...(. ...Rich!...................PE..L.....e...........!.....T...B......]V.......p......................................qr....@.........................0...p......d.......D...........................@q..................................@............p..,............................text...ER.......T.................. ..`.rdata...-...p.......X..............@..@.data...............................@....rsrc...D...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-S0N29.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2001
Entropy (8bit):	5.43553780197753
Encrypted:	false
SSDEEP:	48:4lKyHYlLarLEIFPueZpPCKIeZfm43PBLd1PCj:gYlLarLrFvpqKhl35aj
MD5:	DE2E9E9AE8D4B1346D47003F2372DE65
SHA1:	C588341CBC17403F50E04F649A8FC67C772B52E1
SHA-256:	BA1748B042C16AD3DAA0F75132196925B329D13F8D1ADFFDA4C3934E28F69B32
SHA-512:	A8E962F3E6CBB9C4328C171518E87271EE32EF9C71ECF1773FD391A24BB7AF1DD353D0414F3FA4A26AE60CF1BE0712D4AE6AE770C7A4E7B24CA2F6576166D341
Malicious:	false
Preview:	# ....root logger.DEBUG......log4j.rootLogger=TRACE, stdout, default....#std_out..............#default..................................25M.........12.......#...........#log4j.appender.stdout = org.apache.log4j.ConsoleAppender ..#log4j.appender.stdout.layout = org.apache.log4j.PatternLayout ..#log4j.appender.stdout.layout.ConversionPattern = %d{HH:mm:ss,SSS} [%t] %-5p - %m%n..log4j.additivity.stdout = false....#.....default........log4j.appender.default = org.apache.log4j.RollingFileAppender..log4j.appender.default.File = ./log/default.log..log4j.appender.default.DatePattern = '.'yyyy-MM-dd..log4j.appender.default.MaxFileSize = 10MB..log4j.appender.default.MaxBackupIndex = 2..log4j.appender.default.Append = true..log4j.appender.default.Threshold = DEBUG..log4j.appender.default.layout = org.apache.log4j.PatternLayout..log4j.appender.default.layout.ConversionPattern = %d - %m..log4j.additivity.default = false....#....PLUG..log4j.logger.PLUG = TRACE, PLUG..log4j.appende

C:\Program Files (x86)\Ezviz Studio\is-SSUFV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1171968
Entropy (8bit):	6.803630293199262
Encrypted:	false
SSDEEP:	24576:b/PuOV5fx786oizQYWg1PWZuVs2QW9YFBnJPX0VpoMhkV46:b/PFtJMUs2QW94P0VpoJV46
MD5:	1E03E56E8EB6EAFCB2C49268172939F6
SHA1:	A75FEB7E69D0C67E3805B824C6A425AC577ED555
SHA-256:	BF95B4E1E49AA532405EC045B0E8D83C7F07A70889975A015025BC3C0BF128D7
SHA-512:	EBE819F12DE5FD2595E7602E3DE2BDBC07F4B255CFD5B77DF26EAA95E2AD9C8EAEBB36CFD91466C7914409F96C4718E37A3A4912EFC2B8E8C225DF11CB150C08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.$...$...$...-.`.&...-.f.....-.p.)...-.w.&...$......C../...:.f.1...:.p.....:.a.%...:.g.%...:.b.%...Rich$...........................PE..L.....LS...........!.........................................................0...................................... B..Q....7..................................<....................................................................................text............................... ..`.rdata..q...........................@..@.data............^..................@....rsrc................>..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-ST8MO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	925696
Entropy (8bit):	6.436450532205466
Encrypted:	false
SSDEEP:	12288:fdHcTo9g46seQGDmAAn79wrCuIaDIG6EgxrzRBtkvEb3TcAwjyjPoixPXgMM:FS7lQGDmAAn7yrFILtNkvEb3TzwyjP0
MD5:	72B73C9B303F130791B9244530A098E0
SHA1:	275859B441D49B956EA2A0B8B954917FB733B45E
SHA-256:	AAFDFE5193DFBA135BFD06330EED8BE0DDCC429788BF628303604DAC611DBA5A
SHA-512:	5674FCB65B05E0BED071696F0B836877AD2E4EC2253E3C240C3C5B266B25D3327ADDDA834569AB41ACCB77CD2EBE1076212E4D20F337D3401C9AF62E9D82AEB2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k5<..[o..[o..[oLE.o..[o.r.o..[o.r.o..[o.r.oe.[o.r.o..[o..Zo..[o.. o..[o.r.o..[o.r.o..[o.X.o..[o.r.o..[oRich..[o........................PE..L...qy.]...........!.........x.......W.......................................p............@......................... ........Y.......0..h....................@......................................0...@............................................text............................... ..`.rdata..............................@..@.data...Hy.......Z..................@....rsrc...h....0......................@..@.reloc..P%...@...&..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-SVNSK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1344512
Entropy (8bit):	6.7094779678629335
Encrypted:	false
SSDEEP:	24576:RuElCoqrkWPVF7/Ft4/QH7s1UbgksX9wrAto8c/lztqOJG:4vYcl/Ft6ObQuT/
MD5:	9A2F17DD74365C29E9FA1A9503FA750F
SHA1:	3492DACEF4E0C52DF6B72C00E27C6781F6C31C03
SHA-256:	A69E597D4B244EE7974ABBA67929975CAB0BC21F324D26F070826AAA733EDB6F
SHA-512:	0061DB34DCCF2A67B14F78E1F9730CFCD992EAE992E024D02866783A72C8B8DBB8A4F52B8771EBB74C4587DA035CCB061EE56C5EDEE74C4C84F88B69D65685A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?!..{@m.{@m.{@m.....z@m.r8..\@m.r8..@m.\...y@m.e..}Am.r8..~@m.{@l..@m.r8..@m.r8..z@m.e...z@m.r8..z@m.Rich{@m.................PE..L.....^...........!................LN...............................................@....@..........................%......D...P....`.......................p...h......................................@............................................text...>........................... ..`.rdata...L.......N..................@..@.data....,...0......................@....rsrc........`......................@..@.reloc..F....p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-T09PE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2554880
Entropy (8bit):	6.591414672760471
Encrypted:	false
SSDEEP:	49152:XL2lv4yEptIJxK5IFJsv6tWKFdu9C1TzLyvL/6mShMZtmjNUVrciV5P+7QVg07s1:72lcXIrU6Jsv6tWKFdu9C
MD5:	9945C8F8EB3DF171E1B576A9009D5117
SHA1:	FC07A2A6FD15989D71E2C4B5FF0377C2EB34CA21
SHA-256:	366BE6E5BAD7CAA4989D5339DBF68CEC42CF5A5EDF8573AAE85EF37222CC7C0B
SHA-512:	6DAAFF96046C80B197A3E0B5AD879015949C720F114B5D42B0DC7DB482873919294540DFE0B3B1D9E65B984BFFDCC77969904A6835CA8EF77539C58C6ED1310D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#...#...#..el...#...q...#...q...#.......#......#...#..."...q...#...q...#...q...#...q...#...q...#..Rich.#..........................PE..L......R...........!.................f.............g..............U..........@'.......'...@..........................U!.Pv...9!.......&...................... &.8...................................(j..@...............\............................text...n........................... ..`.rdata..P...........................@..@.data...`2....%..,....%.............@....rsrc.........&.......%.............@..@.reloc....... &.......%.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-TDFSL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	6.07920369888355
Encrypted:	false
SSDEEP:	384:No1gb4AohmWPd42dx22QfwixjgNmaHu2iBwOtbxlPqNmPyMf9p:No1wMY4d42dx2dYiKTgwOtPqavp
MD5:	588E8CE1A2FC98B7993480B0F808FF01
SHA1:	5798DE32C184146DC2A7A7F586519C4067E11117
SHA-256:	154F004E37875538AB16FE504B8594C8F646C61924F3031F6B0211D7946E9373
SHA-512:	907CDAFAC3CB7AC41FEEE13EF3DA55536D666AF100E3F1AE5EA6D2C3D3711AF142FA58221C98F626C90381D4C8C4DBA7DA712B02CFE21BC40588138A133B976E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........)...z...z...z..0z...z..5z...z..6z...z.. z...z..'z...z.Q.z...z...z...z..)z...z..1z...z..7z...z..2z...zRich...z................PE..L......T...........!...............J3.......@............................................@..........................L.......E.......`..@....................p..l... A...............................C..@............@...............................text...[)......................... ..`.rdata.......@......................@..@.data........P.......<..............@....rsrc...@....`.......>..............@..@.reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-TVHVS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	673280
Entropy (8bit):	5.859380193965669
Encrypted:	false
SSDEEP:	12288:TF/pobqiviup6IPSkhc+wJUXThBsOvuRc/RApdlR+23ArZ0U2lvzol9OW7:ZhUvakfZt/cbR+GArKU2lvzg9j7
MD5:	EA843F2C7959307ED96F6D40EDD6F443
SHA1:	3AF3121C37AF025C3C41BF9AEA0A7D415C8DFD93
SHA-256:	52BBDBB09263EEF1883CA01610940A349E980605B37F53AADCCBA21DF69841E9
SHA-512:	8D8136FE9F43B2251A6B7BD34296453FC5C86A6F49AF82FF185706AEB060342020E65C5B792331CAB4C8F08C1DEB3EEFE53D3F257EA7930445537C4B1A5D5B08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2gU.2gU.2gUG.U.2gU.c.U.2gU.c.U.2gU.c.U.2gU.`.U.2gU.2fU.0gU.`.U.2gU.`.U.2gU.`.U.2gU.`.U.2gURich.2gU........PE..L...D..a...........!.....................................................................@..........................+...N......<....@..s....................P..LE..P...8...........................x...@............................................text.............................. ..`.rdata..............................@..@.data...@m.......J...b..............@....idata...A.......B..................@..@.rsrc...s....@......................@..@.reloc..wN...P...P..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-URJG1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	158784
Entropy (8bit):	6.65480912912977
Encrypted:	false
SSDEEP:	1536:YtPFvOFJvapyoa3UeceWACYThGcI2m+J//Oe2DcBpkgZFPBG64R9P0TUP7d13h72:cmSwTUrAnMcb6gZFPArR9P04pX2
MD5:	CF7F9F76F1F093B84A70ECA6E1355EB7
SHA1:	9C84D723DF60132E921AE40C35E50606F9901525
SHA-256:	C6587FABA5A8CC6318AE371345611F8002C67D1475625A4A1453F426CAE9B1A8
SHA-512:	E47623935C8B7CB59181A69C68C310FE48ECBBDA1BA82F638699432ABC4EDD74FDAB35405A723A2B9E6584CFC16679C68BBF0BE054727E117585DA8E5E34F9EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........F...........C.......U.e.....}......_......E.....M..............R.......D......B......G....Rich...........................PE..L...\|'.a...........!......................................................................@.........................p...........x....................L..@ ..............................................@............................................text............................... ..`.rdata...O.......P..................@..@.data....z... ......................@....rsrc................&..............@..@.reloc..f........ ...,..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\is-VR9CN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	215556
Entropy (8bit):	6.002809648802936
Encrypted:	false
SSDEEP:	6144:CNc5Wb7qxz7d9/UaNR6dTd4tL2b0ObTDdTDs:CNce+1576f4tLe0ObTpo
MD5:	2C43548519379C083D60DD9E84A1B724
SHA1:	F8D2BB6DDE84F58B2C8CAF584EAF0C040E7AFC97
SHA-256:	79EA479E9F329DE7075C40154C591B51EB056D458BC4DFF76D9A4B9C6C4F6D0B
SHA-512:	EB3229DAD039821D1C65295B832BB83DF390D43C9B0A0E65A3A2134C0286A5E6C479E30CC4D7E50C5020C3640E61A6FD423CF3DFECCC8BDA70E0D76D6C0B3A59
Malicious:	false
Preview:	##.## Bundle of CA Root Certificates.##.## Certificate data from Mozilla as of: Wed Mar 7 04:12:06 2018 GMT.##.## This is a bundle of X.509 certificates of public Certificate Authorities.## (CA). These were automatically extracted from Mozilla's root certificates.## file (certdata.txt). This file can be found in the mozilla source tree:.## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt.##.## It contains the certificates in PEM format and therefore.## can be directly used with curl / libcurl / php_curl, or with.## an Apache+mod_ssl webserver for SSL client authentication..## Just configure this file as the SSLCACertificateFile..##.## Conversion done with mk-ca-bundle.pl version 1.27..## SHA256: 704f02707ec6b4c4a7597a8c6039b020def11e64f3ef0605a9c3543d48038a57.##...GlobalSign Root CA.==================.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx.GTAXBgNVBAoTEEdsb2Jh

C:\Program Files (x86)\Ezviz Studio\is-VUI8I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1294912
Entropy (8bit):	6.846526859175664
Encrypted:	false
SSDEEP:	12288:X7ZQw63LBDrNN3cXUeXXJVecG5Y0HZ4FX/8bOfCHAjvynt2Ap3Dv7pA2h7NGqH53:mDC8bOIxtCOEGqYJAew1dMZV4E
MD5:	5399BCE33FABE1E1BE06619FCAC1638A
SHA1:	17D0719D53D51F4A537F4D9C506BFB6797F9968F
SHA-256:	70C2884506FA0F885B4DEF55E74CF9FD033330F3AD8F9C8E6F9047C3454373EF
SHA-512:	4CC1747291B0FB5CB8B50E5399EDC0E6F2DFC8566D46E4EFA1C5CF04DFBE9DDFB9292A1B623F2B51C241340A597D11EFF2F3F7F82C90182868601D1A9A683726
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................-......&...............+...............r.....................................#......5c......%.....Rich....................PE..L......b...........!.................]..................................................................................u...d...x.......................@ ... ...b...................................................................................text............................... ..`.rodata.8........................... ..`.rdata...1.......2..................@..@.data...(.... ...F..................@..._RDATA...............2..............@..@.rsrc................4..............@..@.reloc...f... ...h...:..............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\libGetHDSign.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	6.07920369888355
Encrypted:	false
SSDEEP:	384:No1gb4AohmWPd42dx22QfwixjgNmaHu2iBwOtbxlPqNmPyMf9p:No1wMY4d42dx2dYiKTgwOtPqavp
MD5:	588E8CE1A2FC98B7993480B0F808FF01
SHA1:	5798DE32C184146DC2A7A7F586519C4067E11117
SHA-256:	154F004E37875538AB16FE504B8594C8F646C61924F3031F6B0211D7946E9373
SHA-512:	907CDAFAC3CB7AC41FEEE13EF3DA55536D666AF100E3F1AE5EA6D2C3D3711AF142FA58221C98F626C90381D4C8C4DBA7DA712B02CFE21BC40588138A133B976E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........)...z...z...z..0z...z..5z...z..6z...z.. z...z..'z...z.Q.z...z...z...z..)z...z..1z...z..7z...z..2z...zRich...z................PE..L......T...........!...............J3.......@............................................@..........................L.......E.......`..@....................p..l... A...............................C..@............@...............................text...[)......................... ..`.rdata.......@......................@..@.data........P.......<..............@....rsrc...@....`.......>..............@..@.reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\libcrypto-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2348032
Entropy (8bit):	6.1503918178326575
Encrypted:	false
SSDEEP:	49152:abRYIa2KS+bT235n/8VSR35H1xAvdC875+xP1CPwDv3uFfJ7QS:+RYIa2KS+bE5nUATwC8F+xP1CPwDv3uT
MD5:	1B4BF0709F37B7047423736E1E253DC6
SHA1:	305431F8C4600DFDEEF81C73AA61C42C2E7F4A68
SHA-256:	24A7A1BB77F97D5C7F21778BA0BD5C5362DCC3C7252233C9B454307F5783EC9D
SHA-512:	9F59EBE3C37B6E212C48D8EEA7C5DE45FB320F277BBE7161F97833F70E23B18AFDA81CBE2BAF97B7B9A5C1803D5221A8EDE7E66C46AB9AD8012E81D64FE27F05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#K..pK..pK..p...pa..p...pU..p...p...p...pB..pK.~p...pF..p4..pF..pJ..pF..pJ..pF..pJ..pRichK..p........PE..L...!..a...........!.........<.......?.......................................p$...........@..........................4 ..h..X3#.d....P#.\|....................`#.....P...8...........................X...@............0#.X............................text............................... ..`.rdata..............................@..@.data...d.....".......".............@....idata..K....0#.......".............@..@.rsrc...\|....P#.......".............@..@.reloc.......`#.......".............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\libcurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	287232
Entropy (8bit):	6.6174141355540135
Encrypted:	false
SSDEEP:	6144:dlfP6t+9zAlguI5oOq2pLjHWmBYOFNiUwwC1km3eGtWPvlvRg0HMt:bP6Uelzl9On19dNmOeWbg0k
MD5:	A8C7CC2ADEF970175E87BB5CF0576FB5
SHA1:	46D08085C6C16FB5DEA4686D309F67D183DA60BB
SHA-256:	080E111B9AD198796CE2D875F3BE9D793627B546BF6D57AA1F3E2184533981CD
SHA-512:	714F43F706EB3ACDC29BF7E2005F3B9B02959F74EA5FCE9C4A7B5B936CD108C5AFAA6599063E535F92E0AC5CE8D02AAC39BFECB351CF5B9C8531CD471E96CE4C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................\|.#...... ......1..............&......6.A....'......!......$.....Rich....................PE..L....SGT...........!.................................................................................................;..c...\0.......`.......................p...)..P................................/..@...............,............................text...f........................... ..`.rdata..#...........................@..@.data........P.......,..............@....rsrc........`......................@..@.reloc...*...p...,...6..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1171968
Entropy (8bit):	6.803630293199262
Encrypted:	false
SSDEEP:	24576:b/PuOV5fx786oizQYWg1PWZuVs2QW9YFBnJPX0VpoMhkV46:b/PFtJMUs2QW94P0VpoJV46
MD5:	1E03E56E8EB6EAFCB2C49268172939F6
SHA1:	A75FEB7E69D0C67E3805B824C6A425AC577ED555
SHA-256:	BF95B4E1E49AA532405EC045B0E8D83C7F07A70889975A015025BC3C0BF128D7
SHA-512:	EBE819F12DE5FD2595E7602E3DE2BDBC07F4B255CFD5B77DF26EAA95E2AD9C8EAEBB36CFD91466C7914409F96C4718E37A3A4912EFC2B8E8C225DF11CB150C08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.$...$...$...-.`.&...-.f.....-.p.)...-.w.&...$......C../...:.f.1...:.p.....:.a.%...:.g.%...:.b.%...Rich$...........................PE..L.....LS...........!.........................................................0...................................... B..Q....7..................................<....................................................................................text............................... ..`.rdata..q...........................@..@.data............^..................@....rsrc................>..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\libgcc_s_dw2-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	6.5893492509549665
Encrypted:	false
SSDEEP:	768:sZ1l+WCdhTcpKn+CwZoyf/dadEU9mRWtyTN:41l+WGhIKn+CQ7EyW0TN
MD5:	C4B4409F186DA70FCF2BCC60D5F05489
SHA1:	056663C9FD2851CD64F39D882F6758E7A987BD42
SHA-256:	B35F2A8F4C8F1833F3CDEC20739C58E295758CE22021D03D4335043148BD7610
SHA-512:	CDCB945A82A0304E4D7CFC9AE9D7E5A5E81D4E3025E982494C87C283F6FAC542181E9E1E3028456B9B0B5B6279990CB3E1A50F9DF0F6E707C70FA0E23C7A808C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."A@J...........#...8.z..........`..............n................................1N........ .................................T...............................0....................................................................................text...hy.......z..................`.P`.data...(............~..............@.0..rdata..P...........................@.`@.bss..................................@..edata..............................@.0@.idata..T...........................@.0..reloc..0...........................@.0B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\libssl-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	673280
Entropy (8bit):	5.859380193965669
Encrypted:	false
SSDEEP:	12288:TF/pobqiviup6IPSkhc+wJUXThBsOvuRc/RApdlR+23ArZ0U2lvzol9OW7:ZhUvakfZt/cbR+GArKU2lvzg9j7
MD5:	EA843F2C7959307ED96F6D40EDD6F443
SHA1:	3AF3121C37AF025C3C41BF9AEA0A7D415C8DFD93
SHA-256:	52BBDBB09263EEF1883CA01610940A349E980605B37F53AADCCBA21DF69841E9
SHA-512:	8D8136FE9F43B2251A6B7BD34296453FC5C86A6F49AF82FF185706AEB060342020E65C5B792331CAB4C8F08C1DEB3EEFE53D3F257EA7930445537C4B1A5D5B08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2gU.2gU.2gUG.U.2gU.c.U.2gU.c.U.2gU.c.U.2gU.`.U.2gU.2fU.0gU.`.U.2gU.`.U.2gU.`.U.2gU.`.U.2gURich.2gU........PE..L...D..a...........!.....................................................................@..........................+...N......<....@..s....................P..LE..P...8...........................x...@............................................text.............................. ..`.rdata..............................@..@.data...@m.......J...b..............@....idata...A.......B..................@..@.rsrc...s....@......................@..@.reloc..wN...P...P..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\log4cxx.properties (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2001
Entropy (8bit):	5.43553780197753
Encrypted:	false
SSDEEP:	48:4lKyHYlLarLEIFPueZpPCKIeZfm43PBLd1PCj:gYlLarLrFvpqKhl35aj
MD5:	DE2E9E9AE8D4B1346D47003F2372DE65
SHA1:	C588341CBC17403F50E04F649A8FC67C772B52E1
SHA-256:	BA1748B042C16AD3DAA0F75132196925B329D13F8D1ADFFDA4C3934E28F69B32
SHA-512:	A8E962F3E6CBB9C4328C171518E87271EE32EF9C71ECF1773FD391A24BB7AF1DD353D0414F3FA4A26AE60CF1BE0712D4AE6AE770C7A4E7B24CA2F6576166D341
Malicious:	false
Preview:	# ....root logger.DEBUG......log4j.rootLogger=TRACE, stdout, default....#std_out..............#default..................................25M.........12.......#...........#log4j.appender.stdout = org.apache.log4j.ConsoleAppender ..#log4j.appender.stdout.layout = org.apache.log4j.PatternLayout ..#log4j.appender.stdout.layout.ConversionPattern = %d{HH:mm:ss,SSS} [%t] %-5p - %m%n..log4j.additivity.stdout = false....#.....default........log4j.appender.default = org.apache.log4j.RollingFileAppender..log4j.appender.default.File = ./log/default.log..log4j.appender.default.DatePattern = '.'yyyy-MM-dd..log4j.appender.default.MaxFileSize = 10MB..log4j.appender.default.MaxBackupIndex = 2..log4j.appender.default.Append = true..log4j.appender.default.Threshold = DEBUG..log4j.appender.default.layout = org.apache.log4j.PatternLayout..log4j.appender.default.layout.ConversionPattern = %d - %m..log4j.additivity.default = false....#....PLUG..log4j.logger.PLUG = TRACE, PLUG..log4j.appende

C:\Program Files (x86)\Ezviz Studio\log\PLUG.log

Download File

Process:	C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5158
Entropy (8bit):	5.582413829626026
Encrypted:	false
SSDEEP:	96:tdwxP5RPLD66gMHLnXrLAQbLe5LP0uLynMxLwRR7ZEhO9BnwdWCC7oAaWvaWQANz:82UgCMCyRbI
MD5:	856CAF7DE51BD50B3BD3269D69C9E60F
SHA1:	D3664A2564DED63D74A537AE30F00108F09B6580
SHA-256:	F3D3D813B76A9CC7B0D90CFD5A7EA57314500F4938F1016F170A0C9A4E962DC0
SHA-512:	FDD4234F24A889DA8B440C742F195D53DFD52291F971C591811A3B11D7DF758607FA365CA618AF1DF4C0E988CB4290CDB792DED26F6387EE257CF7330EEA4AD2
Malicious:	false
Preview:	2024-04-19 10:16:12.425 - [7940] NS INFO .<SoundConfig::SoundConfig>.<81>,no config file exist.2024-04-19 10:16:12.425 - [7940] NS INFO .<SoundConfig::SoundConfig>.<88>,sound config file path:C:\Users\user\Shipin7Config\soundconfig.xml..2024-04-19 10:16:12.425 - [7940] NS INFO .<NS_Init>.<8>,NS_Init.2024-04-19 10:16:12.425 - [7940] NS INFO .<CreateMemoryIncreaseHandle>.<960>,Create MemoryIncrease Handle Succ!.2024-04-19 10:16:12.425 - [7940] NS INFO .<GetYSVtduClientLibByVtduPath>.<742>,YSVtduClientLibByVtduPath path:C:\Program Files (x86)\Ezviz Studio\hplugin\netstream\streamclient_lib.dll.2024-04-19 10:16:12.441 - [7940] NS INFO .<CTransUnitMgr::InitLibByVtdu_YS>.<230>,StreamClient SetRecvDataBufferSwitch Success..2024-04-19 10:16:12.441 - [7940] NS INFO .<CTransUnitMgr::LoadTransUnitLibByVtdu_YS>.<179>,streamclient_lib.dll Load Succ, m_iInitCountByVtdu_YS = 1.2024-04-19 10:16:12.441 - [7940] NS INFO .<GetStunClientLibPath>.<748>,libPPVClient path:C:\Program Files (x

C:\Program Files (x86)\Ezviz Studio\log\default.log

Download File

Process:	C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe
File Type:	data
Category:	dropped
Size (bytes):	11867
Entropy (8bit):	5.4310242868020095
Encrypted:	false
SSDEEP:	192:wPSyvyOGSNsy0yTkbYEMWkT18G8eQ9YKblM9rlzBre1gdAPqsc1G36ki/l:0uy0yTkbYpWkT18G8eQVblM9rldrUWAO
MD5:	FCCC91B53799BD6E240B1F76CC57D8B3
SHA1:	9B203F65C4F086D525E0005C99E65506B2E2F7E0
SHA-256:	151330F5E32E7A1DB3F02027BE3E7B31E2462FCB90D51A58A3B8EB907B007757
SHA-512:	95C5FBDF928614807EFC2A7DFFB39AB0317592424E5C291DCFC0E13F5080A3EEF978382986D5C039F30A6DE1C2D7B80FAF163C0FC8A945952D456DE2D48637A1
Malicious:	false
Preview:	2024-04-19 10:16:12.394 - hplug init2024-04-19 10:16:12.394 - Run func2024-04-19 10:16:12.394 - plugin_root = C:/Program Files (x86)/Ezviz Studio/hplugin, config_filename = hplugin.xml2024-04-19 10:16:12.409 - config_file_path = C:/Program Files (x86)/Ezviz Studio/hplugin/Client_DataCenter/hplugin.xml2024-04-19 10:16:12.409 - file_path = C:/Program Files (x86)/Ezviz Studio/hplugin/Client_DataCenter/hplugin.xml2024-04-19 10:16:12.409 - path C:/Program Files (x86)/Ezviz Studio/hplugin/Client_DataCenter/hplugin.xml, config <?xml version="1.0" encoding="utf-8"?>..<hplug>.. <plugin fkey="6F26865C-8AAB-4433-A898-535CAEFCA387" file="./Client_DataCenter.dll" delayload="true" />..</hplug>2024-04-19 10:16:12.409 - xml = <?xml version="1.0" encoding="utf-8"?>..<hplug>.. <plugin fkey="6F26865C-8AAB-4433-A898-535CAEFCA387" file="./Client_DataCenter.dll" delayload="true" />..</hplug>2024-04-19 10:16:12.409 - plugin list succeeded.. config file path C:/Program Files (x86)/Ezviz Studio/hplugin/Clien

C:\Program Files (x86)\Ezviz Studio\mingwm10.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11362
Entropy (8bit):	3.7497861732909312
Encrypted:	false
SSDEEP:	96:ahfuHOIHxyOPLrHU4D+wdzpHvqsKZKnKTBKVhKRHK2FoSK8KcfK5uKxGKlJKHItQ:iuHOIE8rHI6RJyLTR24GEv
MD5:	DBDA60D92E774B4ACB3B1CD71F909426
SHA1:	66BFE06A16025F574323A0CE64DCC7C8216EB56C
SHA-256:	56A59DAE638D9BB45CE729A5D6FDFB0ECBE88B37047E4D6D20DBDEF1FC90BD72
SHA-512:	993A1F4AF21CD5E13C3B8059CF483B10A58BEB0D1777703EA07E9DCB5E7F681FA774E770ABE9B6B4CA66B348997DA0218D0FF67F18FCCA1B3CA1ECE2551D965A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....hI...."......#...8............`........ .....o.........................p................ ......................@..x....P...............................`..x....................................................................................text............................... .P`.data........ ......................@.0..bss.........0........................@..edata..x....@......................@.0@.idata.......P......................@.0..reloc..x....`......................@.0B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\npf.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36600
Entropy (8bit):	6.496691324388439
Encrypted:	false
SSDEEP:	768:r4/2sbo+oeVY7GI5tRdtwA2XxTF4gG1nPYx3f4IUfb4fuKRu:r4/2eo+oeuGIRwAZQRIOrM
MD5:	25401B0C9576C8456B3E0BBD74FF0771
SHA1:	C4F563342AB9EB4228E2C2A281A3FE68EDD5624E
SHA-256:	BB569C99360A631850537DC2EDA0BF85D091CC30BD98B3FD2AC9DABDFB7741DA
SHA-512:	51CF2B66202FA7498120951889B7700A030545DC59A2E0DDE305782A61CC1714E7E889DD8EDB11D47F3B7A4C86C23C33F64E0D75956045DC1B687D11AEB0670C
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................;..x...+...+...+X~.+\|..+...+/..+...+x..+...+~..+X~.+t..+X~.+~..+X~.+~..+Rich...+................PE..L.....0Q.................W..........._.......T...............................p......F.......................................D_..P....f...............p.......k..,....U...............................W..@............T...............................text....O.......P.................. ..h.rdata.......T.......T..............@..H.data........Y.......Y..............@...INIT........._......._..

C:\Program Files (x86)\Ezviz Studio\npf64.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36600
Entropy (8bit):	6.293365115285525
Encrypted:	false
SSDEEP:	768:VVRRdUlDRJuOfUhk8ZX2ZeRY4soGLeTZ8wwfKRw:VVRsZREOfUhNK96TZ8wwi6
MD5:	DE7FCC77F4A503AF4CA6A47D49B3713D
SHA1:	8206E2D8374F5E7BF626E47D56D2431EDC939652
SHA-256:	4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6
SHA-512:	FDACE7EE2593FFE5724DB32F4BE62BB13AA1EC89E1E01C713D8C1E9891A5A0975D127450024C3388A987A35E546568ECDBCC60C185DC8F8B08CCEF67A084B20D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}i.}i.}i.}h..}i...}i...}i...}i...}i...}i...}i.Rich.}i.................PE..d.....0Q.........."......V..........................................................9q......................................................d...P....................p...............a...............................................`...............................text....M.......N.................. ..h.rdata.......`.......R..............@..H.data...4....p.......X..............@....pdata...............^..............@..HINIT.................`.............. ....rsrc................h..............@..B.reloc..<............n..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\opensslwrap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51360
Entropy (8bit):	6.752761608535189
Encrypted:	false
SSDEEP:	768:mTMddX3sE5EY2QWyrzYdUGoxO72zjN+KcOtsEaVp20BR207p23+zj4:mysE5EY9UdU3xOaPN+KcOtsEaeBx04
MD5:	4C718D2AD254F44BC32EED17D3E25FC0
SHA1:	5CC62DBDE128E9B9CA6356C3ADA6C406F071AC22
SHA-256:	C5FE1467133192C4C928CC7343D74A9BE9DDEC7A0CA06D2B92030DC8A496F11D
SHA-512:	04E83199D8A189D2B802ABF0F4032534F7819F03CE31F55BAA05575A5AEBD6601F6A4DC09DC75CA4552958BCEB3FDD9ACE85A39B4B98938BF3C3A27D09C5146C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V)5@.H[..H[..H[......H[..0...H[..0...H[..0...H[.5. ..H[..0...H[..HZ..H[..0...H[..0...H[......H[..0...H[.Rich.H[.................PE..L....\Q]...........!.....X...:.......a.......p.......................................m....@............................................(................2...........r..................................@............p..l............................text....W.......X.................. ..`.rdata...&...p...(...\..............@..@.data...$...........................@....rsrc...(...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\pem\ca_cert.pem (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1456
Entropy (8bit):	5.944783221099145
Encrypted:	false
SSDEEP:	24:LrVSwQIVCBz8t2ge8IpSxaiPOebBUNt/J11SGDbfnKfS3EI7eE5WYhRqG3A:LrVvVAPgWY/db8T1zbPKK3E63RqJ
MD5:	CB9148C8ED24135CC2CBB29504042E87
SHA1:	4B3D51AE0927A0AC6FDA7ED54722C691914E2EBA
SHA-256:	7BF6880E831722660D7063F2044F2211D8287F53938139CF998DBB356434954D
SHA-512:	221D15D2DA98F9559BA992524CF06D72C89CF6EB4A52BEF054473AA377E6810A31F9A920015E99F84ED255FAF50AD25444E7EFF176DD5F7E1958C715B7F096B0
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIID9TCCAt2gAwIBAgIUMZ7hqlfVn8suh+RoV66loqFZbH0wDQYJKoZIhvcNAQEL..BQAwgYkxCzAJBgNVBAYTAkNOMREwDwYDVQQIDAhaaGVKaWFuZzERMA8GA1UEBwwI..SGFuZ3pob3UxDjAMBgNVBAoMBUV6dml6MQ4wDAYDVQQLDAVFenZpejERMA8GA1UE..AwwIQ0FTZXJ2ZXIxITAfBgkqhkiG9w0BCQEWEnNlY3VyaXR5QGV6dml6LmNvbTAe..Fw0yMzEyMTQwMzEyMDdaFw0zMzEyMTEwMzEyMDdaMIGJMQswCQYDVQQGEwJDTjER..MA8GA1UECAwIWmhlSmlhbmcxETAPBgNVBAcMCEhhbmd6aG91MQ4wDAYDVQQKDAVF..enZpejEOMAwGA1UECwwFRXp2aXoxETAPBgNVBAMMCENBU2VydmVyMSEwHwYJKoZI..hvcNAQkBFhJzZWN1cml0eUBlenZpei5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB..DwAwggEKAoIBAQDqRvSP9kfrqBquXxP3y0jhvb3iWnB/b2LIqn8jRclLedSKTeNl..SHBBtl4tujaG6ulZIlz1O3HRDtyJwZq1k85ffD0raDbv6DOiylmR+cP4h+G2RfQN..bg4oHGQxpKs6J9aUThpavBykrQIFo4G19Kc14z1cf91TZpP507fYW+sI5cXrB7X6..oJTBrAxEhOJL5MKcVqv4FuPodWMiM+luPPNmZMaoFcfQML1EiF6uQdv16XNq3Dg0..64c+xxmJ9UXgeqGQI49Yk2FXWvuzJrIWcvs8AqHaHZpQXvyXFnEJpBgAKXGdpNJ9..JR0aBmGCziJTvFr9qeRglxgvJvCfjwQEPuvxAgMBAAGjUzBRMB0GA1UdDgQWBBSk..2aynf7L9hLXGDFDNR5t66AioIzAfBgNVHSMEGDAWgBSk2ay

C:\Program Files (x86)\Ezviz Studio\pem\is-6T36M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1456
Entropy (8bit):	5.944783221099145
Encrypted:	false
SSDEEP:	24:LrVSwQIVCBz8t2ge8IpSxaiPOebBUNt/J11SGDbfnKfS3EI7eE5WYhRqG3A:LrVvVAPgWY/db8T1zbPKK3E63RqJ
MD5:	CB9148C8ED24135CC2CBB29504042E87
SHA1:	4B3D51AE0927A0AC6FDA7ED54722C691914E2EBA
SHA-256:	7BF6880E831722660D7063F2044F2211D8287F53938139CF998DBB356434954D
SHA-512:	221D15D2DA98F9559BA992524CF06D72C89CF6EB4A52BEF054473AA377E6810A31F9A920015E99F84ED255FAF50AD25444E7EFF176DD5F7E1958C715B7F096B0
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIID9TCCAt2gAwIBAgIUMZ7hqlfVn8suh+RoV66loqFZbH0wDQYJKoZIhvcNAQEL..BQAwgYkxCzAJBgNVBAYTAkNOMREwDwYDVQQIDAhaaGVKaWFuZzERMA8GA1UEBwwI..SGFuZ3pob3UxDjAMBgNVBAoMBUV6dml6MQ4wDAYDVQQLDAVFenZpejERMA8GA1UE..AwwIQ0FTZXJ2ZXIxITAfBgkqhkiG9w0BCQEWEnNlY3VyaXR5QGV6dml6LmNvbTAe..Fw0yMzEyMTQwMzEyMDdaFw0zMzEyMTEwMzEyMDdaMIGJMQswCQYDVQQGEwJDTjER..MA8GA1UECAwIWmhlSmlhbmcxETAPBgNVBAcMCEhhbmd6aG91MQ4wDAYDVQQKDAVF..enZpejEOMAwGA1UECwwFRXp2aXoxETAPBgNVBAMMCENBU2VydmVyMSEwHwYJKoZI..hvcNAQkBFhJzZWN1cml0eUBlenZpei5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB..DwAwggEKAoIBAQDqRvSP9kfrqBquXxP3y0jhvb3iWnB/b2LIqn8jRclLedSKTeNl..SHBBtl4tujaG6ulZIlz1O3HRDtyJwZq1k85ffD0raDbv6DOiylmR+cP4h+G2RfQN..bg4oHGQxpKs6J9aUThpavBykrQIFo4G19Kc14z1cf91TZpP507fYW+sI5cXrB7X6..oJTBrAxEhOJL5MKcVqv4FuPodWMiM+luPPNmZMaoFcfQML1EiF6uQdv16XNq3Dg0..64c+xxmJ9UXgeqGQI49Yk2FXWvuzJrIWcvs8AqHaHZpQXvyXFnEJpBgAKXGdpNJ9..JR0aBmGCziJTvFr9qeRglxgvJvCfjwQEPuvxAgMBAAGjUzBRMB0GA1UdDgQWBBSk..2aynf7L9hLXGDFDNR5t66AioIzAfBgNVHSMEGDAWgBSk2ay

C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-8T0ER.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	141312
Entropy (8bit):	7.775693566794078
Encrypted:	false
SSDEEP:	3072:Sul1obA0wKw3LCms9PQcLwI2T2VtTzJUOuFBKLOygzg:SuNGpp24ABoOyg
MD5:	6948267C879C5284C68FE5C94AD0FBD8
SHA1:	D3802AFF1AEA3C8CF04A0A87B4CF7AEBD9522CF2
SHA-256:	41BD76A84AED08588486B9641C8B1B4B2B931C322C568384B4300054BE407593
SHA-512:	DFD39DE9A9F85BD34A9CFDE9413354CB20EBED9E5AB8715CB7764DD392CF3C4B54EED2065AE4CCDDEE0C0DDF1643E07ECA6AA33D3D27BA16FAEBD9F1A89D18D1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Jd_}+..}+..}+..Z.q..+..cy...+...d..\|+..cy..\|+..cy..p+..cy..y+..tS..~+..}+..:+..tS...+..tS..\|+..tS..\|+..tS..\|+..Rich}+..................PE..L......Q...........!.....2..........y7.......P....................U..........p......Dv....@.........................`1.......'..P....P.......................`..P.......................................@............P..(............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data........@......................@....rsrc........P......................@..@.reloc.......`....... ..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-EPFIS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.581074299325587
Encrypted:	false
SSDEEP:	1536:EW9G/ClX0/58oPBFpFZxsj2EpBWyt8onEEkYyhPbwkT3STq2OKTX:EWcClX0B8oPj/wL0m8ondTwSTrOKTX
MD5:	BC3248710736D8945567F55644BF42F0
SHA1:	58CF2C41D116FEB2D5327F1046D62815A07AB1B1
SHA-256:	238342A5A8465A54E09599DFF3AA6B40AB28C4E0113BA4E9472C10F1CCE4B77C
SHA-512:	5121423B1DDD00FC65DAEE4191B61A4F2E35526A6C0DFCFBAF55539BD39479029145528EA6387CD620587EDAC617D7A4723074950DAE065B3109959EE4E85395
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Jd_}+..}+..}+..Z.q..+..cy...+...d..\|+..cy..\|+..cy..p+..cy..y+..tS..~+..}+..:+..tS...+..tS..\|+..tS..\|+..tS..\|+..Rich}+..................PE..L......Q...........!.....&...........,.......@....................U..........p............@.........................`6.......,..P....P.......................`......................................h$..@............@..(............................text...m%.......&.................. ..`.rdata.......@.....................@..@.data...\|....@......."..............@....rsrc........P.......$..............@..@.reloc.......`.....................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-G4ERQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	155136
Entropy (8bit):	7.656700761986931
Encrypted:	false
SSDEEP:	3072:dIOtzF60rV4Js9Y/SZKuI8HKdEYtriq7gReCsO+zrv1diL8KQ/GhKOKdf:KI6i4Js9YqZKu7K5tH71OIL1Vb/lOKd
MD5:	EDECCD4F7ABE9F155452EF1235B555F3
SHA1:	CBFDA175D8B95F90B7191714725F48B5C02EB280
SHA-256:	29FA271E057AA0F44A288F24B2BCDCDC42C353F8699241DF4D531A2E79374D2A
SHA-512:	907A3591FDAA06F105B527B7AF7B80D798A92AA8FA9375D657E03C969A6BDB6463AA59C05C363148F3EE80CF6D5472BC427AFA49763324EDD9224B2269CB1B1D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Jd_}+..}+..}+..Z.q..+..cy...+...d..\|+..cy..\|+..cy..p+..cy..y+..tS..~+..}+..:+..tS...+..tS..\|+..tS..\|+..tS..\|+..Rich}+..................PE..L......Q...........!.....(...2......u........@....................U.......................@..........................c......lY..P....................................................................P..@............@..(............................text....&.......(.................. ..`.rdata...#...@...$...,..............@..@.data........p.......P..............@....rsrc................R..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\codecs\is-P08M4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	4.543791350201907
Encrypted:	false
SSDEEP:	3072:d7kgnnckZ/5P/Di7jo6uxCwkbCpV+J9ks+Xe5IOKT/:d7pnj/uf6aCpVkk8IOKT
MD5:	52764B71333C369D04EB51BFED67E1C9
SHA1:	4E026F06563A175D668D11F8FD1A6EF4DBCD2812
SHA-256:	F7B2A75C804ABE7751AEB942D2C00715AA3A88261594B3F3A9A227493D353AC5
SHA-512:	F7E59FE73AC05DE282E13DE4A111EFB6A3D784D3284DAD655AFBF7BD46D68C12BDD0B4BC320E51DF110E121E0F8CCDFAC2029F8710F6D1C31FDE7FDD93730E33
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9-iI}L..}L..}L..Z.\|..L..c....L......\|L..c...\|L..c...pL..c...yL..t4..~L..}L../L..t4..xL..t4..\|L..t4..\|L..t4..\|L..Rich}L..........................PE..L......Q...........!.....F...F......{J.......`....................U.......................@.....................................P...................................................................8w..@............`..T............................text....D.......F.................. ..`.rdata.. /...`...0...J..............@..@.data................z..............@....rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qcncodecs4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	141312
Entropy (8bit):	7.775693566794078
Encrypted:	false
SSDEEP:	3072:Sul1obA0wKw3LCms9PQcLwI2T2VtTzJUOuFBKLOygzg:SuNGpp24ABoOyg
MD5:	6948267C879C5284C68FE5C94AD0FBD8
SHA1:	D3802AFF1AEA3C8CF04A0A87B4CF7AEBD9522CF2
SHA-256:	41BD76A84AED08588486B9641C8B1B4B2B931C322C568384B4300054BE407593
SHA-512:	DFD39DE9A9F85BD34A9CFDE9413354CB20EBED9E5AB8715CB7764DD392CF3C4B54EED2065AE4CCDDEE0C0DDF1643E07ECA6AA33D3D27BA16FAEBD9F1A89D18D1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Jd_}+..}+..}+..Z.q..+..cy...+...d..\|+..cy..\|+..cy..p+..cy..y+..tS..~+..}+..:+..tS...+..tS..\|+..tS..\|+..tS..\|+..Rich}+..................PE..L......Q...........!.....2..........y7.......P....................U..........p......Dv....@.........................`1.......'..P....P.......................`..P.......................................@............P..(............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data........@......................@....rsrc........P......................@..@.reloc.......`....... ..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qjpcodecs4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	4.543791350201907
Encrypted:	false
SSDEEP:	3072:d7kgnnckZ/5P/Di7jo6uxCwkbCpV+J9ks+Xe5IOKT/:d7pnj/uf6aCpVkk8IOKT
MD5:	52764B71333C369D04EB51BFED67E1C9
SHA1:	4E026F06563A175D668D11F8FD1A6EF4DBCD2812
SHA-256:	F7B2A75C804ABE7751AEB942D2C00715AA3A88261594B3F3A9A227493D353AC5
SHA-512:	F7E59FE73AC05DE282E13DE4A111EFB6A3D784D3284DAD655AFBF7BD46D68C12BDD0B4BC320E51DF110E121E0F8CCDFAC2029F8710F6D1C31FDE7FDD93730E33
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9-iI}L..}L..}L..Z.\|..L..c....L......\|L..c...\|L..c...pL..c...yL..t4..~L..}L../L..t4..xL..t4..\|L..t4..\|L..t4..\|L..Rich}L..........................PE..L......Q...........!.....F...F......{J.......`....................U.......................@.....................................P...................................................................8w..@............`..T............................text....D.......F.................. ..`.rdata.. /...`...0...J..............@..@.data................z..............@....rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qkrcodecs4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.581074299325587
Encrypted:	false
SSDEEP:	1536:EW9G/ClX0/58oPBFpFZxsj2EpBWyt8onEEkYyhPbwkT3STq2OKTX:EWcClX0B8oPj/wL0m8ondTwSTrOKTX
MD5:	BC3248710736D8945567F55644BF42F0
SHA1:	58CF2C41D116FEB2D5327F1046D62815A07AB1B1
SHA-256:	238342A5A8465A54E09599DFF3AA6B40AB28C4E0113BA4E9472C10F1CCE4B77C
SHA-512:	5121423B1DDD00FC65DAEE4191B61A4F2E35526A6C0DFCFBAF55539BD39479029145528EA6387CD620587EDAC617D7A4723074950DAE065B3109959EE4E85395
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Jd_}+..}+..}+..Z.q..+..cy...+...d..\|+..cy..\|+..cy..p+..cy..y+..tS..~+..}+..:+..tS...+..tS..\|+..tS..\|+..tS..\|+..Rich}+..................PE..L......Q...........!.....&...........,.......@....................U..........p............@.........................`6.......,..P....P.......................`......................................h$..@............@..(............................text...m%.......&.................. ..`.rdata.......@.....................@..@.data...\|....@......."..............@....rsrc........P.......$..............@..@.reloc.......`.....................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\codecs\qtwcodecs4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	155136
Entropy (8bit):	7.656700761986931
Encrypted:	false
SSDEEP:	3072:dIOtzF60rV4Js9Y/SZKuI8HKdEYtriq7gReCsO+zrv1diL8KQ/GhKOKdf:KI6i4Js9YqZKu7K5tH71OIL1Vb/lOKd
MD5:	EDECCD4F7ABE9F155452EF1235B555F3
SHA1:	CBFDA175D8B95F90B7191714725F48B5C02EB280
SHA-256:	29FA271E057AA0F44A288F24B2BCDCDC42C353F8699241DF4D531A2E79374D2A
SHA-512:	907A3591FDAA06F105B527B7AF7B80D798A92AA8FA9375D657E03C969A6BDB6463AA59C05C363148F3EE80CF6D5472BC427AFA49763324EDD9224B2269CB1B1D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Jd_}+..}+..}+..Z.q..+..cy...+...d..\|+..cy..\|+..cy..p+..cy..y+..tS..~+..}+..:+..tS...+..tS..\|+..tS..\|+..tS..\|+..Rich}+..................PE..L......Q...........!.....(...2......u........@....................U.......................@..........................c......lY..P....................................................................P..@............@..(............................text....&.......(.................. ..`.rdata...#...@...$...,..............@..@.data........p.......P..............@....rsrc................R..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-GDFO4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	6.070702652265097
Encrypted:	false
SSDEEP:	768:fE/f7U0VbLT9v6nkV2vMLKYPYGChGxCbuGOK8uA:K77fRv6kYmKYPLFxCbuGOK8u
MD5:	57C35275996008BE2F5F2E41849ACFBB
SHA1:	448695A96438D123B5933272DAEE67A07F4FDC42
SHA-256:	1B32C68693DC2789CCD5DA7F6D9325A58497C59B7EBC25F1CD016A954F57E5E0
SHA-512:	F9E027D8801D7C2ED40A60461CDC9B5238AE2340AE7A255F7CBDC2E2B460CB49C04E1658DA9D91F8D60E9625F3EAFAFF2F9D863A5F23F45429311856A102FAE5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.Bau.,2u.,2u.,2R.W2w.,2k..2w.,2..2t.,2k..2t.,2k..2x.,2k..2s.,2\|..2p.,2u.-2..,2\|..2w.,2\|..2t.,2\|..2t.,2\|..2t.,2Richu.,2........................PE..L......Q...........!.....:...2.......A.......P....................U.................A.....@..........................p..{...\^..d...............................x...................................pS..@............P...............................text....9.......:.................. ..`.rdata..{ ...P..."...>..............@..@.data................`..............@....rsrc................b..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-JNSH8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	220672
Entropy (8bit):	6.563009085492853
Encrypted:	false
SSDEEP:	6144:bzTGCbyt11Eg61stxt9VIwurz9FWnH1C6TPsIUnSJB+7fjeV3eKpail8vAsPI4OH:bzyEQpbsPI
MD5:	464A21150967DA073CF8FFC2C879E7CD
SHA1:	B93C99C6CCBFA400C7CF8BFB5250FC27107B6D1A
SHA-256:	AF6E3A092AE6530D90C65B1DDFC46B0FEA75057D48F4342AB6D8F0A1ECAE9DBC
SHA-512:	CD5B8FC9BABC5BDE5716A752185B048EDF73C7B3522EF432CAA9B3F5BAC0A9930CE5CF097BC6ABCB19CAF492EFDB3E4EC3B42958BD9A008878C76582130E59EB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u.I....................FC......[F......FE......FS......FT......lC..............lS......lT......lB......lD......lA.....Rich............PE..L......Q...........!.........h....................................U.......................@..........................X..{...tJ..d....p...............................................................C..@............................................text............................... ..`.rdata..[I.......J..................@..@.data...l....`.......@..............@....rsrc........p.......B..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-KHS6O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.552856268509819
Encrypted:	false
SSDEEP:	6144:R5hdviK8myWc2UNfQv3vCJYajvS2c99lOK0:rivmxI7JYa
MD5:	763931B6B0C4B16FAC0B1B6C88D957A7
SHA1:	A9956E47E82B1E6608B175813D7F8A95201D1DB0
SHA-256:	2F0C8AE700744EDB22AA743FAF1A8530FDC424EA9DFE8F84406C052D47361DA9
SHA-512:	DE2D620D204662B0CDE2CA979B00648AA6D185B31C55D785121678A4042B72B64C1CAD0133BFDD6C2ABFDC6BC33E8DF6B8622F6F7BA9F05F6F86EB92E4961B6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..".{hq.{hq.{hq>..q.{hq.).q.{hq.4.q.{hq.).q.{hq.).q.{hq.).q.{hq...q.{hq.{iq.{hq...q7{hq...q.{hq...q.{hq...q.{hq...q.{hqRich.{hq........................PE..L......Q...........!.........\......C.............................U..........@...........@.............................\|.......d.... .......................0..h.......................................@...............(............................text.............................. ..`.rdata...D.......F..................@..@.data...p...........................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-MPN8E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	6.093553095630681
Encrypted:	false
SSDEEP:	768:gZOe2dqXatJUhcY5vdREEHpYlpsm3oTbySAS5R2OK7O5:gZOe28Xar0ckoEJYlpcTbLx5R2OK7O
MD5:	70DFD43B094ACEA1B3CE4D2DAA4FB9F1
SHA1:	8ACD358E3F4A5D12AAC39260439C898856688760
SHA-256:	59F113196790BD94D7AB33C630CA3CA7B3D1995D48D3FCE0E7FD84855627F8C8
SHA-512:	0E8DBD869663BE523A15CC5697B2C93523BF67F7188AA53586297A212344A60CED6675B92CFB4C39C67EFC28757B2114B0A4DA7A5398A41DD37D1773167F87AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q..b5..15..15..1.H.17..1+.117..1..414..1+.714..1+.!18..1+.&10..1<.110..15..1Y..1<.&17..1<.014..1<.614..1<.314..1Rich5..1........................PE..L......Q...........!.....:...*.......@.......P....................U.......................@......................... j..{...T[..d...................................................................8S..@............P...............................text...]9.......:.................. ..`.rdata.......P.......>..............@..@.data........p.......Z..............@....rsrc................\..............@..@.reloc...............b..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-PJMGV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	5.841344771430067
Encrypted:	false
SSDEEP:	384:xOy6emMuYosL7hgjOmNgH9jtnMMkGW2OK/hVKrfqDVN:bttg5gh62OKquD
MD5:	BAFA504A9225192C8C593D99399E4044
SHA1:	7F21C88DB62213707ED9FCF4DEFC08574C27BFA0
SHA-256:	54270108330A8CEE264311E9CC2D486272D9429DB3D7116DE707A726C0772E5E
SHA-512:	0AA2D5FB11B59BCA1288E840F0B2E744B7588A91A291A7AB473DE63A04302EDD810150CA1F5B70E705E1989F6F941351E4D6B5A8C33C37CE9C08FCF02242D0DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=-.HyLq.yLq.yLq.^...{Lq.g...{Lq.....xLq.g...xLq.g...tLq.g...}Lq.p4..\|Lq.yLp..Lq.p4..zLq.p4..xLq.p4..xLq.p4..xLq.RichyLq.........PE..L......Q...........!....."...*......M(.......@....................U.................r)....@..........................Z..{....M..d....p..........................T....................................D..@............@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data........`.......B..............@....rsrc........p.......D..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-RFGC0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.878471712964188
Encrypted:	false
SSDEEP:	384:twJvJ2xksE9L4t+U2kIaynZX9XSESgLxJAJXvLLdS75n5R2OK/h8brfqLXd:te8kBU2w6xSOEA5R2OKkuLXd
MD5:	47B84BA05EE9EC047D2C7B01754E0ED5
SHA1:	41C059065DCC4482F3D8742D225D07F132BD2EB2
SHA-256:	BA4C99CFFA32A47C7450ACB0CD39001AE3F91C0A116883DB86CBB4387592FF68
SHA-512:	F242EFA56E421C01A0B6853F19B52425DB10808B11E93E28F4CC89F72D4FB27DB9CF5834B9E92B411A8DCCE1FBB210617DB4D817D85F67FEB92C9473CCDE122B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6Hg\|r)./r)./r)./U.r/p)./l{./p)./.f./s)./l{./p)./l{./.)./l{./v)./{Q./{)./r)./.)./{Q./p)./{Q./s)./{Q./s)./{Q./s)./Richr)./........................PE..L......Q...........!.....$...........*.......@....................U.......................@..........................]..{...<K.......p..........................X...................................HC..@............@...............................text....#.......$.................. ..`.rdata..;....@... ...(..............@..@.data...l....`.......H..............@....rsrc........p.......J..............@..@.reloc..:............P..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\is-RMC60.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278528
Entropy (8bit):	5.559872489533016
Encrypted:	false
SSDEEP:	6144:Jj7tJruPlnl2VnJUQRag6AK26M94zOK1r:Jj7vruPlMVJ6P
MD5:	70A982836147CA1361DE3A94944F04A3
SHA1:	E6800781F3254B8B0098FE0B74E65A48382AB20F
SHA-256:	31472DDC7F44CE96E42C73D16742A1400EE6FA9DCF274DC75645139DF7B80B31
SHA-512:	1C45F0A6124FCECF48AE520626FB3F3B14AE080DB6BB6FFA39FF61A8BBD043D4433B6F9B17765C5DB80DB9FC970A6F861CD5E1E703FC03D06B9465895A5D2A83
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............{...{...{..^....{.....{.....{.....{.......{.......{.....{...z...{.......{.......{.....{.....{.....{.Rich..{.........PE..L......Q...........!......................... ....................U..........`......+.....@.............................\|.......d....0.......................@..........................................@............ ..`............................text............................... ..`.rdata..l.... ......................@..@.data...@.... ......................@....rsrc........0......................@..@.reloc.......@......."..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qgif4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	6.093553095630681
Encrypted:	false
SSDEEP:	768:gZOe2dqXatJUhcY5vdREEHpYlpsm3oTbySAS5R2OK7O5:gZOe28Xar0ckoEJYlpcTbLx5R2OK7O
MD5:	70DFD43B094ACEA1B3CE4D2DAA4FB9F1
SHA1:	8ACD358E3F4A5D12AAC39260439C898856688760
SHA-256:	59F113196790BD94D7AB33C630CA3CA7B3D1995D48D3FCE0E7FD84855627F8C8
SHA-512:	0E8DBD869663BE523A15CC5697B2C93523BF67F7188AA53586297A212344A60CED6675B92CFB4C39C67EFC28757B2114B0A4DA7A5398A41DD37D1773167F87AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q..b5..15..15..1.H.17..1+.117..1..414..1+.714..1+.!18..1+.&10..1<.110..15..1Y..1<.&17..1<.014..1<.614..1<.314..1Rich5..1........................PE..L......Q...........!.....:...*.......@.......P....................U.......................@......................... j..{...T[..d...................................................................8S..@............P...............................text...]9.......:.................. ..`.rdata.......P.......>..............@..@.data........p.......Z..............@....rsrc................\..............@..@.reloc...............b..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qico4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	6.070702652265097
Encrypted:	false
SSDEEP:	768:fE/f7U0VbLT9v6nkV2vMLKYPYGChGxCbuGOK8uA:K77fRv6kYmKYPLFxCbuGOK8u
MD5:	57C35275996008BE2F5F2E41849ACFBB
SHA1:	448695A96438D123B5933272DAEE67A07F4FDC42
SHA-256:	1B32C68693DC2789CCD5DA7F6D9325A58497C59B7EBC25F1CD016A954F57E5E0
SHA-512:	F9E027D8801D7C2ED40A60461CDC9B5238AE2340AE7A255F7CBDC2E2B460CB49C04E1658DA9D91F8D60E9625F3EAFAFF2F9D863A5F23F45429311856A102FAE5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.Bau.,2u.,2u.,2R.W2w.,2k..2w.,2..2t.,2k..2t.,2k..2x.,2k..2s.,2\|..2p.,2u.-2..,2\|..2w.,2\|..2t.,2\|..2t.,2\|..2t.,2Richu.,2........................PE..L......Q...........!.....:...2.......A.......P....................U.................A.....@..........................p..{...\^..d...............................x...................................pS..@............P...............................text....9.......:.................. ..`.rdata..{ ...P..."...>..............@..@.data................`..............@....rsrc................b..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qjpeg4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.552856268509819
Encrypted:	false
SSDEEP:	6144:R5hdviK8myWc2UNfQv3vCJYajvS2c99lOK0:rivmxI7JYa
MD5:	763931B6B0C4B16FAC0B1B6C88D957A7
SHA1:	A9956E47E82B1E6608B175813D7F8A95201D1DB0
SHA-256:	2F0C8AE700744EDB22AA743FAF1A8530FDC424EA9DFE8F84406C052D47361DA9
SHA-512:	DE2D620D204662B0CDE2CA979B00648AA6D185B31C55D785121678A4042B72B64C1CAD0133BFDD6C2ABFDC6BC33E8DF6B8622F6F7BA9F05F6F86EB92E4961B6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..".{hq.{hq.{hq>..q.{hq.).q.{hq.4.q.{hq.).q.{hq.).q.{hq.).q.{hq...q.{hq.{iq.{hq...q7{hq...q.{hq...q.{hq...q.{hq...q.{hqRich.{hq........................PE..L......Q...........!.........\......C.............................U..........@...........@.............................\|.......d.... .......................0..h.......................................@...............(............................text.............................. ..`.rdata...D.......F..................@..@.data...p...........................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qmng4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	220672
Entropy (8bit):	6.563009085492853
Encrypted:	false
SSDEEP:	6144:bzTGCbyt11Eg61stxt9VIwurz9FWnH1C6TPsIUnSJB+7fjeV3eKpail8vAsPI4OH:bzyEQpbsPI
MD5:	464A21150967DA073CF8FFC2C879E7CD
SHA1:	B93C99C6CCBFA400C7CF8BFB5250FC27107B6D1A
SHA-256:	AF6E3A092AE6530D90C65B1DDFC46B0FEA75057D48F4342AB6D8F0A1ECAE9DBC
SHA-512:	CD5B8FC9BABC5BDE5716A752185B048EDF73C7B3522EF432CAA9B3F5BAC0A9930CE5CF097BC6ABCB19CAF492EFDB3E4EC3B42958BD9A008878C76582130E59EB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u.I....................FC......[F......FE......FS......FT......lC..............lS......lT......lB......lD......lA.....Rich............PE..L......Q...........!.........h....................................U.......................@..........................X..{...tJ..d....p...............................................................C..@............................................text............................... ..`.rdata..[I.......J..................@..@.data...l....`.......@..............@....rsrc........p.......B..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qsvg4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.878471712964188
Encrypted:	false
SSDEEP:	384:twJvJ2xksE9L4t+U2kIaynZX9XSESgLxJAJXvLLdS75n5R2OK/h8brfqLXd:te8kBU2w6xSOEA5R2OKkuLXd
MD5:	47B84BA05EE9EC047D2C7B01754E0ED5
SHA1:	41C059065DCC4482F3D8742D225D07F132BD2EB2
SHA-256:	BA4C99CFFA32A47C7450ACB0CD39001AE3F91C0A116883DB86CBB4387592FF68
SHA-512:	F242EFA56E421C01A0B6853F19B52425DB10808B11E93E28F4CC89F72D4FB27DB9CF5834B9E92B411A8DCCE1FBB210617DB4D817D85F67FEB92C9473CCDE122B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6Hg\|r)./r)./r)./U.r/p)./l{./p)./.f./s)./l{./p)./l{./.)./l{./v)./{Q./{)./r)./.)./{Q./p)./{Q./s)./{Q./s)./{Q./s)./Richr)./........................PE..L......Q...........!.....$...........*.......@....................U.......................@..........................]..{...<K.......p..........................X...................................HC..@............@...............................text....#.......$.................. ..`.rdata..;....@... ...(..............@..@.data...l....`.......H..............@....rsrc........p.......J..............@..@.reloc..:............P..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qtga4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	5.841344771430067
Encrypted:	false
SSDEEP:	384:xOy6emMuYosL7hgjOmNgH9jtnMMkGW2OK/hVKrfqDVN:bttg5gh62OKquD
MD5:	BAFA504A9225192C8C593D99399E4044
SHA1:	7F21C88DB62213707ED9FCF4DEFC08574C27BFA0
SHA-256:	54270108330A8CEE264311E9CC2D486272D9429DB3D7116DE707A726C0772E5E
SHA-512:	0AA2D5FB11B59BCA1288E840F0B2E744B7588A91A291A7AB473DE63A04302EDD810150CA1F5B70E705E1989F6F941351E4D6B5A8C33C37CE9C08FCF02242D0DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=-.HyLq.yLq.yLq.^...{Lq.g...{Lq.....xLq.g...xLq.g...tLq.g...}Lq.p4..\|Lq.yLp..Lq.p4..zLq.p4..xLq.p4..xLq.p4..xLq.RichyLq.........PE..L......Q...........!....."...*......M(.......@....................U.................r)....@..........................Z..{....M..d....p..........................T....................................D..@............@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data........`.......B..............@....rsrc........p.......D..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\imageformats\qtiff4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278528
Entropy (8bit):	5.559872489533016
Encrypted:	false
SSDEEP:	6144:Jj7tJruPlnl2VnJUQRag6AK26M94zOK1r:Jj7vruPlMVJ6P
MD5:	70A982836147CA1361DE3A94944F04A3
SHA1:	E6800781F3254B8B0098FE0B74E65A48382AB20F
SHA-256:	31472DDC7F44CE96E42C73D16742A1400EE6FA9DCF274DC75645139DF7B80B31
SHA-512:	1C45F0A6124FCECF48AE520626FB3F3B14AE080DB6BB6FFA39FF61A8BBD043D4433B6F9B17765C5DB80DB9FC970A6F861CD5E1E703FC03D06B9465895A5D2A83
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............{...{...{..^....{.....{.....{.....{.......{.......{.....{...z...{.......{.......{.....{.....{.....{.Rich..{.........PE..L......Q...........!......................... ....................U..........`......+.....@.............................\|.......d....0.......................@..........................................@............ ..`............................text............................... ..`.rdata..l.... ......................@..@.data...@.... ......................@....rsrc........0......................@..@.reloc.......@......."..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\skins\DefaultSkin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7958528
Entropy (8bit):	6.23028720341431
Encrypted:	false
SSDEEP:	24576:3Mz9DPqpwxHGtBEAd+yvJ+Mz9DPqpwD3sGH2uMwUIl5g+o3XiiJrsVO6lA87rGUs:CYEoJl3UwU0xwSiWVXiyd5ydrWsJeO
MD5:	E75C3BB15987AA8245585E0233DA0444
SHA1:	CE1DBE039379E61165EAB9CEB31B298376408C1E
SHA-256:	019DF48A138B0360D5E4A102B00F09B502AFF66F9CD8E155BDB8FD0BF1FE1842
SHA-512:	43A5895D9BE20C38F9D5C067BE5D3AD41E9430403EFED5131F8F38AEB8E8B4D8116A4DFA6559EE5134DCDAFD040E65FD76EF307A4F3FC07A49E292C22F618972
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5S..q2..q2..q2...}n.p2..xJm.p2..xJ{..2..V..s2..xJk.t2..q2..F2..xJ\|.}2..xJj.p2..o`l.p2..xJi.p2..Richq2..................PE..L.....e...........!.....\....y...... .......p................................y.......y...@..........................Ry......py.P.....y.......................y.<...pv...............................Fy.@............qy..............................text....[.......\.................. ..`.rdata..j.x..p....x..`..............@..@.data........`y......Fy.............@....idata.......py......Hy.............@....rsrc.........y......Ty.............@..@.reloc........y......\y.............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\plugins\skins\is-MCISE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7958528
Entropy (8bit):	6.23028720341431
Encrypted:	false
SSDEEP:	24576:3Mz9DPqpwxHGtBEAd+yvJ+Mz9DPqpwD3sGH2uMwUIl5g+o3XiiJrsVO6lA87rGUs:CYEoJl3UwU0xwSiWVXiyd5ydrWsJeO
MD5:	E75C3BB15987AA8245585E0233DA0444
SHA1:	CE1DBE039379E61165EAB9CEB31B298376408C1E
SHA-256:	019DF48A138B0360D5E4A102B00F09B502AFF66F9CD8E155BDB8FD0BF1FE1842
SHA-512:	43A5895D9BE20C38F9D5C067BE5D3AD41E9430403EFED5131F8F38AEB8E8B4D8116A4DFA6559EE5134DCDAFD040E65FD76EF307A4F3FC07A49E292C22F618972
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5S..q2..q2..q2...}n.p2..xJm.p2..xJ{..2..V..s2..xJk.t2..q2..F2..xJ\|.}2..xJj.p2..o`l.p2..xJi.p2..Richq2..................PE..L.....e...........!.....\....y...... .......p................................y.......y...@..........................Ry......py.P.....y.......................y.<...pv...............................Fy.@............qy..............................text....[.......\.................. ..`.rdata..j.x..p....x..`..............@..@.data........`y......Fy.............@....idata.......py......Hy.............@....rsrc.........y......Ty.............@..@.reloc........y......\y.............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\sadp\Sadp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1044704
Entropy (8bit):	6.833351119103501
Encrypted:	false
SSDEEP:	24576:6p7+FpYpzhkG+LbdMOFwtkObZG5DNT1r12uEF:E7rhELbd3FwtkOA1r12ui
MD5:	D4F370D37FEFA7BABDAE4091845C2795
SHA1:	342B6A41EA73B8C34B02A064F3900FCCEB3D3D45
SHA-256:	B6DDB5EA78D0E20F461FFD8259CFBABC8ED864E24B7179F750D7ECD24C0627CD
SHA-512:	A90ACF334F9371A5393B4CAE29D67BACB0B0233D4CEB277C3818D5FACE81105527DD97A8CCA3F61C97CA83DDB12E050C0F229325448833C8EFE1D9DC7E18436A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h.;...;...;....N..>...}..v...}......}......6.. ...2...1...;..........<...6../...6..,...6..:...6..:...;.:...6..:...Rich;...................PE..L......[...........!.....x....&.....A.........................................1...........@.............................%............0..................R....1.D.......8............................3..@...............X............................text...6v.......x.................. ..`.rdata...,...........\|..............@..@.data....&"......H..................@....rsrc.........0.....................@..@.reloc..D.....1.....................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\sadp\is-TEKSC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1044704
Entropy (8bit):	6.833351119103501
Encrypted:	false
SSDEEP:	24576:6p7+FpYpzhkG+LbdMOFwtkObZG5DNT1r12uEF:E7rhELbd3FwtkOA1r12ui
MD5:	D4F370D37FEFA7BABDAE4091845C2795
SHA1:	342B6A41EA73B8C34B02A064F3900FCCEB3D3D45
SHA-256:	B6DDB5EA78D0E20F461FFD8259CFBABC8ED864E24B7179F750D7ECD24C0627CD
SHA-512:	A90ACF334F9371A5393B4CAE29D67BACB0B0233D4CEB277C3818D5FACE81105527DD97A8CCA3F61C97CA83DDB12E050C0F229325448833C8EFE1D9DC7E18436A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h.;...;...;....N..>...}..v...}......}......6.. ...2...1...;..........<...6../...6..,...6..:...6..:...;.:...6..:...Rich;...................PE..L......[...........!.....x....&.....A.........................................1...........@.............................%............0..................R....1.D.......8............................3..@...............X............................text...6v.......x.................. ..`.rdata...,...........\|..............@..@.data....&"......H..................@....rsrc.........0.....................@..@.reloc..D.....1.....................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	504038
Entropy (8bit):	6.5563812539456645
Encrypted:	false
SSDEEP:	12288:Zgc95f5AURgLJK3xubR706XdQnEFV/v7n:9mURggsbR70cQnEFV/v7n
MD5:	B35E59859B56C31C0ABBC32958F96C04
SHA1:	172321767BBC54F88F482FD1C4C1B0ECE6BE9B96
SHA-256:	6B99B9CB9369E10D0D5B9C02F30236C9C473288B4397A004179747F74EB32A9A
SHA-512:	E6A08C051659A0135D9B44DF7A330DF47D895AF304D5A8FFD90B43672E6572C1B2058EC676FDE48951DA8D10C45EA46474516C641BACCEA65A8B938AD6BEC096
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%.J.j......... ...8.....6.....................`.......................................... ...................... .......@..0............................P..."...................................................................................text...$...........................`..`.data...............................@....bss.....................................edata....... ......................@....idata..0....@......................@....reloc..."...P...$..................@....stab...l............:.................B.stabstr.............T.................B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	6.426761452579602
Encrypted:	false
SSDEEP:	6144:x4siSWNEonsEul5fNbSp4sul7zrUypnFHc6adK4R7Cd/a3va5ivZv14xkZjNfAbq:x4MWNEcsEul51bS+tlXrUyBFHc6adK4x
MD5:	6BC10EEC59B2AB24C24CC544B1A31178
SHA1:	2AA06BA399C7F45E90CB11E32C7C47250B0284D1
SHA-256:	0A906F0002A6637312A56D5FB92434BCFC47FE44636846454226EFE2DF872802
SHA-512:	AF764FAFAE682F433D4C372561DF895AF16E874E867CBAE1D12DBECAE102C3950C565FE6962CAE7F603531E0BF89F3AEB67AC86C5C7B83857A59A7DC3C0C8DE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........qR.u"R.u"R.u"uM."P.u"[.."P.u"[.."Q.u"[.."\.u"[.."P.u"L.."Q.u"R.t".u"L.."}.u"L.."S.u"L.."S.u"L.."S.u"RichR.u"........PE..L...1.LS...........!......................... ...............................`......R...................................p$..,...P.... .......................0..t#..0&..............................(...@............ ...............................text............................... ..`.rdata.. .... ......................@..@.data....1..........................@....rsrc........ ......................@..@.reloc..~$...0...&..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	InnoSetup Log Ezviz Studio {49DF99D3-BC81-439A-8F40-A0529159024C}, version 0x30, 20898 bytes, 061544\user, "C:\Program Files (x86)\Ezviz Studio"
Category:	dropped
Size (bytes):	20898
Entropy (8bit):	5.255648806446745
Encrypted:	false
SSDEEP:	384:DhJ868dXMjybnUSuVJxnygiAMs1gF9kfK+rR8MgIhsttHtBtt:wdlbIh+tHt/t
MD5:	2854A7BF92AC911A323B5A77574F0573
SHA1:	2C60F4828601546400A640D21F57199BD2FD375A
SHA-256:	50CE76B5EB83C97F63453A48A6FC82E5FA6F07E864161C2E29161C57AC284012
SHA-512:	D295C1993E8D887551D737A81D6E62878CEC7D72AE1C6DD48200F27EAFCC9E5FDDD77CC559232C5DA0002DB91DFEB96E14A10EF78C851CCCB0E54005762976AE
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{49DF99D3-BC81-439A-8F40-A0529159024C}..........................................................................................Ezviz Studio....................................................................................................................0........Q..%...........................................................................................................................~........C....061544.user#C:\Program Files (x86)\Ezviz Studio.............3.... ..........m.IFPS.............................................................................................................BOOLEAN.....................................!MAIN....-1..#...dll:files:ISTask.dll.RunTask.........#...dll:files:ISTask.dll.KillTask...................INITIALIZESETUP....16..REGQUERYSTRINGVALUE...........MSGBOX..........EXPANDCONSTANT........REMOVEQUOTES........EXEC.............REGQUERYDWORDVALUE......................CHECKEDWINPCAPINSTA

C:\Program Files (x86)\Ezviz Studio\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	716570
Entropy (8bit):	6.497908445034353
Encrypted:	false
SSDEEP:	12288:50QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv35ELA6XEx9rB:xfKbT5lrPo37AzHTA63/cfU9IEU35364
MD5:	341D1D6681C808128C1C0C8C82C39DFA
SHA1:	8AE352DD7CF5CE1B69EC6C6C3EB55BADE8F6D7A1
SHA-256:	B7B7B384EEFF193993C209F7339C200E82002C90982F6FD8CAFF9AF9F3008457
SHA-512:	D529B537CAE3463AF22AB8C4E38F7198E5D4EF7C69F21C8423F95675E9A99E024FC6BDBA3FEF3299B3B876FB7C83A3ED65AD0552749B616665C4A718E217F03A
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...a..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....a...`...b...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\update_server.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2617544
Entropy (8bit):	7.9969519062261885
Encrypted:	true
SSDEEP:	49152:U2n2fcbD7Gq3LNj321aFIWs8a16THZ9NyoooSdpuFZbdFFhbPKsGukLUgb9:5nqYDK8LHHLa16znQdoSdwvdFDbP10J5
MD5:	21658E7290EAEB93D83403D2E5B5F458
SHA1:	66AC378BA6172B7E84BB269D62CB278E2391FBF2
SHA-256:	93B3CE1A5DCCDC79C472069C9EE0AF74CA6D6ACC6AEB9C3437BE2A1CEA23A588
SHA-512:	7CE0E27FFCAC4FCA5E78B4DE0DC64A15E029BEE2CD51CEB1C02ABDB315904DE501945A3ECB24B26E9E355BF3968CE02B680ECE300CC9E69F3EC8ED13AB8F79B7
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................:......$.............@..........................@......R.(..........@..............................P.......`(............'.............................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....H................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...`(.........................@..P.............@......................@..P........................................................................................................................................

C:\Program Files (x86)\Ezviz Studio\zlib1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.819071831745927
Encrypted:	false
SSDEEP:	1536:lTGKPckiCjU1zpQxIV23/CcNOVFQIOQIOzG7HSE:lpckiZPQ6V23/k3GGzG7HS
MD5:	FDF28DA2ACB985539C24438A3E9576A8
SHA1:	F8E8E68C0BB0C50F3559A28B272FBADC7500DFE7
SHA-256:	CF007ED15815BB20CE747D6534383621E39442004D77C7BBFA8197A38CF665E2
SHA-512:	04B031FEC366A921B6B34BBCE0BF99E9AA14A3B1B7FA5CAA989507FE37B70E45F59A2A043E8D06D7E6D2BADFEF6CE5B9BDAC00D7F0C03F7C3F7D729FA326FB73
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I..(..(..(..\.l.(..(..(...yz.(....`.(...yx.(...yG.(...yF.(..zG.(..z{.(..z\|.(..zy.(..Rich.(..................PE..L....;Vb...........!.........f......<.............LZ.........................`............@.........................p.......D$..<....@.......................P..<.......8...........................@...@............................................text............................... ..`.rdata...W.......X..................@..@.data...X....0......................@....rsrc........@......................@..@.reloc..<....P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\CrashReporter.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364928
Entropy (8bit):	6.429771282212209
Encrypted:	false
SSDEEP:	6144:hIrhX+o48cPCbIHSec57KKfRlhlLrfjDwo3IzXlR2vuPEsUt:h0bIHUnhlLrfP8z1R2vwUt
MD5:	414A1B5801D2E2F7A3A34C7DB7557F25
SHA1:	F127FC2EF714CF372C02F22260A27C37B1D137EC
SHA-256:	A40B0B0BD4F46327CEB2068C06A5FFE37F4809D1E11142E0D591C3C9D3B03105
SHA-512:	0BACC7A829A549788A429AE1D19B26AB665284651224F3BFB58E961DC0869A4496BD97E590ADFF4123234E8C366D687248F0111EDF24C3AE16B56EB9B0EECDFE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..EP..EP..EP..b...OP..b...^P..EP..bR..L({.ZP..L(m..P..[.j.FP..L(j..P..[.z.DP..L(..DP..RichEP..........................PE..L...r.ET.........................................@.........................................................................L........`..,y...........\|..............p................................t..@.......................@....................text............................... ..`.rdata..\...........................@..@.data...\|e.......*..................@....rsrc...,y...`...z..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\ExceptionHandler.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	195072
Entropy (8bit):	6.563035242120268
Encrypted:	false
SSDEEP:	3072:IlNLP9uxYqSjtQD++R7PzqwU/L8MU/ybT5Kz8W+pNema5vr:O+xYqeeCczq2F/oMAW+T8r
MD5:	29E569F412A911C81B9EF470FA75B0BE
SHA1:	7BE1147C6A42C90E2827EDAA1D11318A4FFE4CF7
SHA-256:	6F38A4549EDFF6C016D3BFB346A3FC08C5C55D87D7977F507FE35E066A8AEC53
SHA-512:	CB118D000E83964284D53EEA029409516FA520162F36F328FC9D152A54A2630AFD617B53BE99F8F5E5F0F0101EC77917C7CF67326C0C8F8FD62C13F8A01B8366
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G._...1...1...1....C.1......1.....1.$\|J...1...0..1......1......1......1.Rich..1.................PE..L...C.aT...........!.....Z...................p...............................P............@.................................P...x............................ ..@...`r..................................@............p...............................text...OX.......Z.................. ..`.rdata...\...p...^...^..............@..@.data...$3..........................@....rsrc...............................@..@.reloc..,%... ...&..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\ISTask.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.357541095717686
Encrypted:	false
SSDEEP:	1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
MD5:	86A1311D51C00B278CB7F27796EA442E
SHA1:	AC08AC9D08F8F5380E2A9A65F4117862AA861A19
SHA-256:	E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D
SHA-512:	129E4B8DD2665BCFC5E72B4585343C51127B5D027DBB0234291E7A197BAECA1BAB5ED074E65E5E8C969EE01F9F65CC52C9993037416DE9BFFF2F872E5AEBA7EC
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................<......0.............@..........................`.......................................................@....................... ..h...................................................................................CODE....\........................... ..`DATA....h...........................@...BSS......................................idata..............................@....edata..............................@..P.reloc..h.... ......................@..P.rsrc........@......................@..P.............`......................@..P................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\LocalConfig.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.961031906449987
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCqXT4iaX2T8FtwL6AIJKuADkYFaVt94Uy:TMVBdS4M8v+6AIJxVoNUy
MD5:	5F9DF243D29164E6CF344EF5A1D7C457
SHA1:	DCBBDAE04826A4FDB84AF9E9B430323BE7339B55
SHA-256:	E9C3018DDB6DAD0C407A797D3009AACB14A98DC1212B139D6E761BD289438812
SHA-512:	D84E8390E6C0592EF4C212951F1499D0FDA669DAC8A7BB8D781C79E50FAED47E4A54FAB62994B80B83252EADFD4017479A206FB109A2E46CC50E84CC6763095B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<ServerInfo>..<CenterServerInfo ServerUrl = "https://api.ezvizlife.com" updatetime = "21600"/>..</ServerInfo>..

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	524
Entropy (8bit):	5.024125169592838
Encrypted:	false
SSDEEP:	12:TMHdtXBFN8u3/3XO5WSN4dKF+MHlVI4gVW/wnbE0xSxHyG:2dtXD+u/eVN40+sVI4gAwngJ
MD5:	6BB5D2AAD0AE1B4A82E7DDF7CF58802A
SHA1:	70F7482F5F5C89CE09E26D745C532A9415CD5313
SHA-256:	9E0220511D4EBDB014CC17ECB8319D57E3B0FEA09681A80D8084AA8647196582
SHA-512:	3EA373DACFD3816405F6268AC05886A7DC8709752C6D955EF881B482176F0671BCDC900906FC1EBDC22E9D349F6D5A8423D19E9E7C0E6F9F16B334C68137DF2B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.CRT".. version="9.0.21022.8".. processorArchitecture="x86".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="msvcr90.dll" /> <file name="msvcp90.dll" /> <file name="msvcm90.dll" />..</assembly>..

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\is-2CHDE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655872
Entropy (8bit):	6.890160476095281
Encrypted:	false
SSDEEP:	12288:whr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyyrRzS:ga2g5gmO791I0E5uO9FANpmRyyg
MD5:	E7D91D008FE76423962B91C43C88E4EB
SHA1:	29268EF0CD220AD3C5E9812BEFD3F5759B27A266
SHA-256:	ED0170D3DE86DA33E02BFA1605EEC8FF6010583481B1C530843867C1939D2185
SHA-512:	C3D5DA1631860C92DECF4393D57D8BFF0C7A80758C9B9678D291B449BE536465BDA7A4C917E77B58A82D1D7BFC1F4B3BEE9216D531086659C40C41FEBCDCAE92
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...a...a...a..,....a...a...a...3)..`...3?.^a...3...a...38..a...3>..a...3;..a..Rich.a..................PE..L....=1G...........!.....Z..........@-.......p....Rx.........................0............@.........................`....\|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\is-59L42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	524
Entropy (8bit):	5.024125169592838
Encrypted:	false
SSDEEP:	12:TMHdtXBFN8u3/3XO5WSN4dKF+MHlVI4gVW/wnbE0xSxHyG:2dtXD+u/eVN40+sVI4gAwngJ
MD5:	6BB5D2AAD0AE1B4A82E7DDF7CF58802A
SHA1:	70F7482F5F5C89CE09E26D745C532A9415CD5313
SHA-256:	9E0220511D4EBDB014CC17ECB8319D57E3B0FEA09681A80D8084AA8647196582
SHA-512:	3EA373DACFD3816405F6268AC05886A7DC8709752C6D955EF881B482176F0671BCDC900906FC1EBDC22E9D349F6D5A8423D19E9E7C0E6F9F16B334C68137DF2B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.CRT".. version="9.0.21022.8".. processorArchitecture="x86".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="msvcr90.dll" /> <file name="msvcp90.dll" /> <file name="msvcm90.dll" />..</assembly>..

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\is-DKCBU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	568832
Entropy (8bit):	6.529348877830445
Encrypted:	false
SSDEEP:	12288:iUmYoJC//83zMHZg7/yToyvYXO84hUgiW6QR7t5C3Ooc8SHkC2eRZRzS:iUmYoO83W0y8yeO8L3Ooc8SHkC2e8
MD5:	6DE5C66E434A9C1729575763D891C6C2
SHA1:	A230E64E0A5830544A25890F70CE9C9296245945
SHA-256:	4F7ED27B532888CE72B96E52952073EAB2354160D1156924489054B7FA9B0B1A
SHA-512:	27EC83EE49B752A31A9469E17104ED039D74919A103B625A9250AC2D4D8B8601034D8B3E2FA87AADBAFBDB89B01C1152943E8F9A470293CC7D62C2EEFA389D2C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..qQ.qQ.qQ..*.qQ.#..qQ.qP..qQ..>..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.Rich.qQ.................PE..L....=1G...........!.....$...p......B........@....Hx................................`.....@.........................@C......d8..<....p...................$......D2...................................$..@............................................text...!#.......$.................. ..`.data...h&...@.......(..............@....rsrc........p.......B..............@..@.reloc...B.......D...F..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\is-F48ST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224768
Entropy (8bit):	6.040336415310379
Encrypted:	false
SSDEEP:	6144:ge7iXDX5qmzXOZc/cU4HqsKvts6tifkglMqbO0YLJbc89XTiuq5Kz3OaOyp:ge7iXVDzXOGJb5XTiuq5Kz+
MD5:	4A8BC195ABDC93F0DB5DAB7F5093C52F
SHA1:	B55A206FC91ECC3ADEDA65D286522AA69F04AC88
SHA-256:	B371AF3CE6CB5D0B411919A188D5274DF74D5EE49F6DD7B1CCB5A31466121A18
SHA-512:	197C12825EFA2747AFD10FAFE3E198C1156ED20D75BAD07984CAA83447D0C7D498EF67CEE11004232CA5D4DBBB9AE9D43BFD073002D3D0D8385476876EF48A94
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...`...`...`..{`...`..~`...`..}`...`.@.`...`.j.`...`...`<..`..k`...`..l`..`..z`...`..\|`...`..y`...`Rich...`........PE..L....=1G...........!.....:...................P....?x.........................0.......L....@..........................1..4....%..d...............................d...P...............................P...@...............(...........p...H............text....8.......:.................. ..`.data...\|....P.......>..............@....rsrc................H..............@..@.reloc...!......."...L..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\msvcm90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224768
Entropy (8bit):	6.040336415310379
Encrypted:	false
SSDEEP:	6144:ge7iXDX5qmzXOZc/cU4HqsKvts6tifkglMqbO0YLJbc89XTiuq5Kz3OaOyp:ge7iXVDzXOGJb5XTiuq5Kz+
MD5:	4A8BC195ABDC93F0DB5DAB7F5093C52F
SHA1:	B55A206FC91ECC3ADEDA65D286522AA69F04AC88
SHA-256:	B371AF3CE6CB5D0B411919A188D5274DF74D5EE49F6DD7B1CCB5A31466121A18
SHA-512:	197C12825EFA2747AFD10FAFE3E198C1156ED20D75BAD07984CAA83447D0C7D498EF67CEE11004232CA5D4DBBB9AE9D43BFD073002D3D0D8385476876EF48A94
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...`...`...`..{`...`..~`...`..}`...`.@.`...`.j.`...`...`<..`..k`...`..l`..`..z`...`..\|`...`..y`...`Rich...`........PE..L....=1G...........!.....:...................P....?x.........................0.......L....@..........................1..4....%..d...............................d...P...............................P...@...............(...........p...H............text....8.......:.................. ..`.data...\|....P.......>..............@....rsrc................H..............@..@.reloc...!......."...L..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\msvcp90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	568832
Entropy (8bit):	6.529348877830445
Encrypted:	false
SSDEEP:	12288:iUmYoJC//83zMHZg7/yToyvYXO84hUgiW6QR7t5C3Ooc8SHkC2eRZRzS:iUmYoO83W0y8yeO8L3Ooc8SHkC2e8
MD5:	6DE5C66E434A9C1729575763D891C6C2
SHA1:	A230E64E0A5830544A25890F70CE9C9296245945
SHA-256:	4F7ED27B532888CE72B96E52952073EAB2354160D1156924489054B7FA9B0B1A
SHA-512:	27EC83EE49B752A31A9469E17104ED039D74919A103B625A9250AC2D4D8B8601034D8B3E2FA87AADBAFBDB89B01C1152943E8F9A470293CC7D62C2EEFA389D2C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..qQ.qQ.qQ..*.qQ.#..qQ.qP..qQ..>..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.Rich.qQ.................PE..L....=1G...........!.....$...p......B........@....Hx................................`.....@.........................@C......d8..<....p...................$......D2...................................$..@............................................text...!#.......$.................. ..`.data...h&...@.......(..............@....rsrc........p.......B..............@..@.reloc...B.......D...F..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.CRT\msvcr90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655872
Entropy (8bit):	6.890160476095281
Encrypted:	false
SSDEEP:	12288:whr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyyrRzS:ga2g5gmO791I0E5uO9FANpmRyyg
MD5:	E7D91D008FE76423962B91C43C88E4EB
SHA1:	29268EF0CD220AD3C5E9812BEFD3F5759B27A266
SHA-256:	ED0170D3DE86DA33E02BFA1605EEC8FF6010583481B1C530843867C1939D2185
SHA-512:	C3D5DA1631860C92DECF4393D57D8BFF0C7A80758C9B9678D291B449BE536465BDA7A4C917E77B58A82D1D7BFC1F4B3BEE9216D531086659C40C41FEBCDCAE92
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...a...a...a..,....a...a...a...3)..`...3?.^a...3...a...38..a...3>..a...3;..a..Rich.a..................PE..L....=1G...........!.....Z..........@-.......p....Rx.........................0............@.........................`....\|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\Microsoft.VC90.MFC.manifest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	548
Entropy (8bit):	5.016046602668665
Encrypted:	false
SSDEEP:	12:TMHdtXBFN8u3/3XO5WSN4dKF+nVI4gVW/wnbEJRxJ0xoxF2G:2dtXD+u/eVN40+nVI4gAwnAt
MD5:	CE3AB3BD3FF80FCE88DCB0EA3D48A0C9
SHA1:	C6BA2C252C6D102911015D0211F6CAB48095931C
SHA-256:	F7205C5C0A629D0CC60E30E288E339F08616BE67B55757D4A403A2B54E23922B
SHA-512:	211E247EA82458FD68BCC91A6731E9E3630A9D5901F4BE4AF6099AD15A90CAF2826E14846951FDD7D3B199994FD3AC97CA9E325CF0DFEB9474AEA9B0D6339DD3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.MFC".. version="9.0.21022.8".. processorArchitecture="x86".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="mfc90.dll" /> <file name="mfc90u.dll" /> <file name="mfcm90.dll" /> <file name="mfcm90u.dll" />..</assembly>..

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-1SI6K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	548
Entropy (8bit):	5.016046602668665
Encrypted:	false
SSDEEP:	12:TMHdtXBFN8u3/3XO5WSN4dKF+nVI4gVW/wnbEJRxJ0xoxF2G:2dtXD+u/eVN40+nVI4gAwnAt
MD5:	CE3AB3BD3FF80FCE88DCB0EA3D48A0C9
SHA1:	C6BA2C252C6D102911015D0211F6CAB48095931C
SHA-256:	F7205C5C0A629D0CC60E30E288E339F08616BE67B55757D4A403A2B54E23922B
SHA-512:	211E247EA82458FD68BCC91A6731E9E3630A9D5901F4BE4AF6099AD15A90CAF2826E14846951FDD7D3B199994FD3AC97CA9E325CF0DFEB9474AEA9B0D6339DD3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.MFC".. version="9.0.21022.8".. processorArchitecture="x86".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="mfc90.dll" /> <file name="mfc90u.dll" /> <file name="mfcm90.dll" /> <file name="mfcm90u.dll" />..</assembly>..

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-9841E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1156600
Entropy (8bit):	6.52546095742681
Encrypted:	false
SSDEEP:	24576:HMh/PZa3TrShmbjRbf/zxUK4BpifCqY5TcB2sQL+XmDOl:HMh/PZa3HTjtFUKwhqY5TcyL+XmE
MD5:	462DDCC5EB88F34AED991416F8E354B2
SHA1:	6F4DBB36A8E7E594E12A2A9ED4B71AF0FAA762C1
SHA-256:	287BD98054C5D2C4126298EE50A2633EDC745BC76A1CE04E980F3ECC577CE943
SHA-512:	35D21E545CE6436F5E70851E0665193BB1C696F61161145C92025A090D09E08F28272CBF1E271FF62FF31862544025290E22B15A7ACDE1AEA655560300EFE1EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.R."..."..."......"......."......"...p^.."..\m[.."...pX.."...pN.."...pI.."......"..."...!...pG.>"...p_.."...pY.."...p\.."..Rich."..................PE..L....`1G...........!.....T...N......C+.......p....^x................................g.....@..............................f......x.......x................#.......... ..................................@...............@...........................text....R.......T.................. ..`.data....j...p...H...X..............@....rsrc...x...........................@..@.reloc...1.......2...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-B2SL2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.049630833293433
Encrypted:	false
SSDEEP:	768:kXS5hxqhOz9XNpOb/AXVuips6Pm550971BVO5nkcwo5ArrwlyQ6mrCHrO1MquTSU:kC/IMZHO0lu+s60VwvrrDmrCrO1HuTR
MD5:	D4E7C1546CF3131B7D84B39F8DA9E321
SHA1:	6B096858723C76848B85D63B4DA334299BECED5B
SHA-256:	C4243BA85C2D130B4DEC972CD291916E973D9D60FAC5CEEA63A01837ECC481C2
SHA-512:	4383E2BC34B078819777DA73F1BD4A88B367132E653A7226ED73F43E4387ED32E8C2BCAFD8679EF5E415F0B63422DB05165A9E794F055AA8024FE3E7CABC66B9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...X`1G...........!.....:..........rG.......P.....x.........................0............@.................................L................................ .......R...............................S..@............P..,............R..H............text....8.......:.................. ..`.rdata..^....P.......>..............@..@.data...............................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-KL4HM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1162744
Entropy (8bit):	6.531289155070338
Encrypted:	false
SSDEEP:	24576:ACmuzoNEIkc0FV/IvA+hJpHgbe18MVc/AKDbZOUWJGLaDenEKH:AC9zoNEIkbFV/IvA+hJyq1FVc/FDbZOQ
MD5:	B9030D821E099C79DE1C9125B790E2DA
SHA1:	79189E6F7887CA8F41FB17603BD9C2D46180EFCF
SHA-256:	E30AABB518361FBEAF8068FFC786845EE84ABBF1F71AE7D2733A11286531595A
SHA-512:	2E1EBCBE595C5A1FE09F5933D4BA190081EF343EA313725BB0F8FCBF98079A091AB8C0465EF437B310A1753FFC2D48D9D70EC80D773E7919A6485EF730E93EA1
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y...~H.X......X...~H..I...G.>.[.....;.X...G.8.R...G...F...G.).P...~H.P...Y...;...G.'.....G.?.X...G.9.X...G.<.X...RichY...........................PE..L...*`1G...........!.....j...P......a@.............x.................................x....@.........................P....g......x........................#......h.......................................@...............<............................text...kh.......j.................. ..`.data....l.......J...n..............@....rsrc...............................@..@.reloc...1.......2...h..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\is-Q1919.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.048382351359956
Encrypted:	false
SSDEEP:	768:Q2q4fSp3W9sHSIeXNKIv3dJcZqXIq9BVO5nOC6u58rrYlyQRvVFtTiO1lqNkdZ:9TqpwsH1eTJWZv6FrrsNFtmO1oNk
MD5:	371226B8346F29011137C7AA9E93F2F6
SHA1:	485DE5A0CA0564C12EACC38D1B39F5EF5670A2E2
SHA-256:	5B08FE55E4BBF2FBFD405E2477E023137CFCEB4D115650A5668269C03300A8F8
SHA-512:	119A5E16E3A3F2FF0B5ACB6B5D5777997102A3CAE00D48C0F8921DF5818F5FBDA036974E23C6F77A6B9380C6A1065372E70F8D4E665DFD37E5F90EB27DB7420C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...Y`1G...........!.....:..........rG.......P.....x.........................0......Ko....@.................................\|................................ .......R...............................T..@............P..,............R..H............text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...P...........................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfc90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1156600
Entropy (8bit):	6.52546095742681
Encrypted:	false
SSDEEP:	24576:HMh/PZa3TrShmbjRbf/zxUK4BpifCqY5TcB2sQL+XmDOl:HMh/PZa3HTjtFUKwhqY5TcyL+XmE
MD5:	462DDCC5EB88F34AED991416F8E354B2
SHA1:	6F4DBB36A8E7E594E12A2A9ED4B71AF0FAA762C1
SHA-256:	287BD98054C5D2C4126298EE50A2633EDC745BC76A1CE04E980F3ECC577CE943
SHA-512:	35D21E545CE6436F5E70851E0665193BB1C696F61161145C92025A090D09E08F28272CBF1E271FF62FF31862544025290E22B15A7ACDE1AEA655560300EFE1EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.R."..."..."......"......."......"...p^.."..\m[.."...pX.."...pN.."...pI.."......"..."...!...pG.>"...p_.."...pY.."...p\.."..Rich."..................PE..L....`1G...........!.....T...N......C+.......p....^x................................g.....@..............................f......x.......x................#.......... ..................................@...............@...........................text....R.......T.................. ..`.data....j...p...H...X..............@....rsrc...x...........................@..@.reloc...1.......2...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfc90u.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1162744
Entropy (8bit):	6.531289155070338
Encrypted:	false
SSDEEP:	24576:ACmuzoNEIkc0FV/IvA+hJpHgbe18MVc/AKDbZOUWJGLaDenEKH:AC9zoNEIkbFV/IvA+hJyq1FVc/FDbZOQ
MD5:	B9030D821E099C79DE1C9125B790E2DA
SHA1:	79189E6F7887CA8F41FB17603BD9C2D46180EFCF
SHA-256:	E30AABB518361FBEAF8068FFC786845EE84ABBF1F71AE7D2733A11286531595A
SHA-512:	2E1EBCBE595C5A1FE09F5933D4BA190081EF343EA313725BB0F8FCBF98079A091AB8C0465EF437B310A1753FFC2D48D9D70EC80D773E7919A6485EF730E93EA1
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y...~H.X......X...~H..I...G.>.[.....;.X...G.8.R...G...F...G.).P...~H.P...Y...;...G.'.....G.?.X...G.9.X...G.<.X...RichY...........................PE..L...*`1G...........!.....j...P......a@.............x.................................x....@.........................P....g......x........................#......h.......................................@...............<............................text...kh.......j.................. ..`.data....l.......J...n..............@....rsrc...............................@..@.reloc...1.......2...h..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfcm90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.049630833293433
Encrypted:	false
SSDEEP:	768:kXS5hxqhOz9XNpOb/AXVuips6Pm550971BVO5nkcwo5ArrwlyQ6mrCHrO1MquTSU:kC/IMZHO0lu+s60VwvrrDmrCrO1HuTR
MD5:	D4E7C1546CF3131B7D84B39F8DA9E321
SHA1:	6B096858723C76848B85D63B4DA334299BECED5B
SHA-256:	C4243BA85C2D130B4DEC972CD291916E973D9D60FAC5CEEA63A01837ECC481C2
SHA-512:	4383E2BC34B078819777DA73F1BD4A88B367132E653A7226ED73F43E4387ED32E8C2BCAFD8679EF5E415F0B63422DB05165A9E794F055AA8024FE3E7CABC66B9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...X`1G...........!.....:..........rG.......P.....x.........................0............@.................................L................................ .......R...............................S..@............P..,............R..H............text....8.......:.................. ..`.rdata..^....P.......>..............@..@.data...............................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\Microsoft.VC90.MFC\mfcm90u.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.048382351359956
Encrypted:	false
SSDEEP:	768:Q2q4fSp3W9sHSIeXNKIv3dJcZqXIq9BVO5nOC6u58rrYlyQRvVFtTiO1lqNkdZ:9TqpwsH1eTJWZv6FrrsNFtmO1oNk
MD5:	371226B8346F29011137C7AA9E93F2F6
SHA1:	485DE5A0CA0564C12EACC38D1B39F5EF5670A2E2
SHA-256:	5B08FE55E4BBF2FBFD405E2477E023137CFCEB4D115650A5668269C03300A8F8
SHA-512:	119A5E16E3A3F2FF0B5ACB6B5D5777997102A3CAE00D48C0F8921DF5818F5FBDA036974E23C6F77A6B9380C6A1065372E70F8D4E665DFD37E5F90EB27DB7420C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...Y`1G...........!.....:..........rG.......P.....x.........................0......Ko....@.................................\|................................ .......R...............................T..@............P..,............R..H............text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...P...........................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\ModProperties.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18416
Entropy (8bit):	6.450988905120029
Encrypted:	false
SSDEEP:	192:y0J9H0Iw5hJsY/Pfxq1q7ooB5pgNSN1Og2dGtBj6y+QGf3PzDjLd8462vOoFJN1h:RXKkY/xqs7PgDeYxLM63ES7
MD5:	B614020DF9D482886A5345B7A3A5F0E8
SHA1:	40BE905C32579B5C722E1461A24AA6787520072D
SHA-256:	5B58D06BF0F190E2C9F874EDE46F0771CD1720A69F81546447E88C1A4FE7D212
SHA-512:	F85918A5DE016A3CC11BCEBD508A0A814779DB9B98966D114FA78B36F84555D3AA7EBEB38A1C77F84CA2E5FFE969C1CF1E69DAA6A8AE1835921AF5F6A5BF03D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................l.......z.......}.......j......`...............s.......h.....Rich............................PE..L.....MT............................z........0....@..................................{....@..................................4..P....`...............4.......p..t...P1..............................@3..@............0..0............................text...z........................... ..`.rdata.......0......................@..@.data........P.......*..............@....rsrc........`.......,..............@..@.reloc.......p.......0..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\SPUpDate.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.392205294925466
Encrypted:	false
SSDEEP:	3072:AUN+idqQMdbxdjgSB7jED2zoO4LdOt83o:9NHqQMdbxTSizpIdOt8
MD5:	49A4D94A5A75083AA1E8C02CEF7725FD
SHA1:	AD13905E570264BE42CB2625A65F16E4E98F7F7D
SHA-256:	7B8CA1E3BB486C7478220BD4F013F7A07070615619AC81B3F34E4554756B6992
SHA-512:	B37324F4F3E53E2518760E6FDF384163F4F137084ADE32D56C365E7EAAC9883EAD58A868A9C0277D8B7E55C0723DA86F3855BDE33AD7E193C99184D66AC024F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g....P...P...Pp..P...P..P...P..P...P..P...P..P...P...P...P.7rP...P..P...P..P...P..P...P..P...PRich...P........PE..L...6..U...........!........v......x........@.......................................3....@.............................W....n..................................t...@C...............................R..@............@...............................text...u(......................... ..`.rdata..gG...@...H..................@..@.data.... ...........v..............@...SharedDa.............z..............@....rsrc................\|..............@..@.reloc...!......."..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17392
Entropy (8bit):	6.090714552745069
Encrypted:	false
SSDEEP:	384:QLhZAr9Sc6VOlU3I5urFAepb2pxSldVM63EmLQ:ahZO9Sc6VOlL5urFAOb2ps8633LQ
MD5:	5863EBA0EB8924542F5BD5658371ACB1
SHA1:	261C87B3555CC80065D19FA5A880CA8EC50DBD6B
SHA-256:	EB22E8C572FD3EFFB49559FD908C9C51E3F3993B5AF21DC60B7788300401A856
SHA-512:	53D1F68603E4002C4FFAF5148CDEFE078927405039DED05D1C01E4CE057767AFA0C58100BF50F7D05C2D2736AC5E17CEBB1957C46276A39194F3BF9DA8BFB961
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f................o.......y.......~...............i...............p......Un.......k.....Rich............................PE..L...8..U.....................................0....@..........................p......Q.....@..................................6.......P...............0.......`......P1...............................5..@............0..0............................text...2........................... ..`.rdata.......0......................@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe.hservice (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.013719728828304
Encrypted:	false
SSDEEP:	6:TMVBd5o/UWYy1vfuAmr56HDqhvyrKiID15c1nrRS7uQSi/n:TMHdYhGAe56+94K9c1lCuQJ
MD5:	9453237568F9EA42AC313988378880F8
SHA1:	3EA2B23222BB61533CDCDB135B69ED904309DB89
SHA-256:	E1316108D44FB7B944FAD372D1A8DE2F5A92557104634C510099F357DCADA3ED
SHA-512:	D9C68C0A6A659C466CC4E1FD9094B51C9845C5F0583B7AC65DB8245DEE3FFD16B58D3A7EE3505AB0A144A5EF4B2E5DFB8CC5C60452CF3F4C67931C95BF55ED6F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<hservice>..<service name="SPUpDateServer" disp="shipin7_UpDateServer" dump="true" />..<dso file="SPUpDate.dll" />..<function init="SPUPDATE_Init" uinit="SPUPDATE_Uninit" start="SPUPDATE_Start" stop="SPUPDATE_Stop" error="SPUPDATE_GetLastError" version="SPUPDATE_GetVersion" gtest="SPUPDATE_Gtest" />..</hservice>..

C:\Program Files (x86)\hicloud\update_server\hlog.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1320448
Entropy (8bit):	6.560821552886333
Encrypted:	false
SSDEEP:	24576:ZPMYKwa3m+i+K3fAHIh84xq0xNvEGd28t/H53xNqAT:5MLVuRljvEGI8t/Zh4A
MD5:	F7BAC757D17A077B7DEDBDAB0FEB1E2F
SHA1:	DB5B2D501A2C51AB8B76FEB3731F13AA37F204E9
SHA-256:	4D2A7A0990613206A3AE327F74A2A6F93A58AEDBBC0946D1188608C7177FE447
SHA-512:	D695872FEF7E5354427ABA0EE07BA86CB4D10E1A4BF49D53F9FCED331D52A24391B8D08E19A6A0F992895C7D508AFBAC8C226170E7018AEFC47EEB30ADE0D0CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8}.wV..wV..wV..8...wV......wV......wV......wV......wV.{hR..wV..wW..uV...-..wV......wV......wV..%...wV......wV.Rich.wV.........................PE..L.....T...........!................~........@.......................................9....@..........................q.......#....... .......................0..\....I..................................@............@...............................text....,.......................... ..`.rdata..x5...@...6...2..............@..@.data...p........n...h..............@....rsrc........ ......................@..@.reloc...I...0...J..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\hpr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151607
Entropy (8bit):	6.148486773851591
Encrypted:	false
SSDEEP:	3072:6tYC/rxufRNSVHRJYVmwdpwhAnx8TiIa5h8ELN92msNTt3bwWRS:6Z/rxuDSVgVmwzwan0w6wwsWRS
MD5:	E982D6233FE5E315256D545527FB4EFE
SHA1:	18DAD0A98FB7911581313D4A320190323677C42D
SHA-256:	C0321C4841960960D198B3DE744AF97A28D8E205B53308278539495B6AD1E9AD
SHA-512:	ABDBFCD68387DEE776DAD7CEFF64C2994E2D7335A42D72A1E2EDD0ADFE07E0CD9DFAC6674286F67C1987D15B1429EA19F64F52470F1B9D88F499BFFEEA9B6B46
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.7..id..id..id..cd..idf.gd..id..hdA.id&.4d..id..bd..id].od..id..md..idRich..id................PE..L....dqN...........!................=........................................@......................................@.......X...........p.......................@....................................................................................text...&........................... ..`.rdata..$B.......P..................@..@.data............ ..................@....rsrc...p...........................@..@.reloc...".......0... ..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-109A2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151607
Entropy (8bit):	6.148486773851591
Encrypted:	false
SSDEEP:	3072:6tYC/rxufRNSVHRJYVmwdpwhAnx8TiIa5h8ELN92msNTt3bwWRS:6Z/rxuDSVgVmwzwan0w6wwsWRS
MD5:	E982D6233FE5E315256D545527FB4EFE
SHA1:	18DAD0A98FB7911581313D4A320190323677C42D
SHA-256:	C0321C4841960960D198B3DE744AF97A28D8E205B53308278539495B6AD1E9AD
SHA-512:	ABDBFCD68387DEE776DAD7CEFF64C2994E2D7335A42D72A1E2EDD0ADFE07E0CD9DFAC6674286F67C1987D15B1429EA19F64F52470F1B9D88F499BFFEEA9B6B46
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.7..id..id..id..cd..idf.gd..id..hdA.id&.4d..id..bd..id].od..id..md..idRich..id................PE..L....dqN...........!................=........................................@......................................@.......X...........p.......................@....................................................................................text...&........................... ..`.rdata..$B.......P..................@..@.data............ ..................@....rsrc...p...........................@..@.reloc...".......0... ..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-2Q8UL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	195072
Entropy (8bit):	6.563035242120268
Encrypted:	false
SSDEEP:	3072:IlNLP9uxYqSjtQD++R7PzqwU/L8MU/ybT5Kz8W+pNema5vr:O+xYqeeCczq2F/oMAW+T8r
MD5:	29E569F412A911C81B9EF470FA75B0BE
SHA1:	7BE1147C6A42C90E2827EDAA1D11318A4FFE4CF7
SHA-256:	6F38A4549EDFF6C016D3BFB346A3FC08C5C55D87D7977F507FE35E066A8AEC53
SHA-512:	CB118D000E83964284D53EEA029409516FA520162F36F328FC9D152A54A2630AFD617B53BE99F8F5E5F0F0101EC77917C7CF67326C0C8F8FD62C13F8A01B8366
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G._...1...1...1....C.1......1.....1.$\|J...1...0..1......1......1......1.Rich..1.................PE..L...C.aT...........!.....Z...................p...............................P............@.................................P...x............................ ..@...`r..................................@............p...............................text...OX.......Z.................. ..`.rdata...\...p...^...^..............@..@.data...$3..........................@....rsrc...............................@..@.reloc..,%... ...&..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-6LTAQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14832
Entropy (8bit):	6.289677513443667
Encrypted:	false
SSDEEP:	192:hmdqaPcEXDjJjysN2kRJ2yJN1yhNmW8B980syMrj1EJ3w/S312U:h1GjtVN2kRpxW8hvM63E1U
MD5:	0F5FF2EEF7CCB672743BBA3A881A3A56
SHA1:	5C711AE5929417A244231F02C211B2D9EE188912
SHA-256:	75A0AA3095421757598E7F21EC932AF2F9E9DB30C7B3F0D9D714D0852A807C8D
SHA-512:	D2555C3E1E71444E54D47ADEDF40DA34A98B4BAA12D0492A636E3D67C507A0502BCC0134117B65B96A9113D933FEB41E960DBC6A9865FB3E7D128572B5CF0BD1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................\|....j....z....m................c....{....}....x....Rich....................PE..L......U............................3........ ....@..........................`......v.....@..........................(..d...4#..d....@...............&.......P.......!..............................."..@............ ...............................text............................... ..`.rdata..T.... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..0....P......."..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-CTPA5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.357541095717686
Encrypted:	false
SSDEEP:	1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
MD5:	86A1311D51C00B278CB7F27796EA442E
SHA1:	AC08AC9D08F8F5380E2A9A65F4117862AA861A19
SHA-256:	E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D
SHA-512:	129E4B8DD2665BCFC5E72B4585343C51127B5D027DBB0234291E7A197BAECA1BAB5ED074E65E5E8C969EE01F9F65CC52C9993037416DE9BFFF2F872E5AEBA7EC
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................<......0.............@..........................`.......................................................@....................... ..h...................................................................................CODE....\........................... ..`DATA....h...........................@...BSS......................................idata..............................@....edata..............................@..P.reloc..h.... ......................@..P.rsrc........@......................@..P.............`......................@..P................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-G3PO0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1896
Entropy (8bit):	5.483896820378022
Encrypted:	false
SSDEEP:	48:MHqFfr44CiAPkMv5PEPhMMJHb+jvJuPJMMdWKPV:MHqFT44CBsMB8pMcmvMRM2P
MD5:	DCA3764210D6ACB53209A309561DAD16
SHA1:	6AA5CC0E73C614351E33420794FBD363AE4FC03A
SHA-256:	A8A45430FE46BBACFD533129D62ED0390AA03E0D0C3E63FB4DBD3AA9F6E23047
SHA-512:	FE7A06F1A6B46BE119D3DAEB7BED947B4B27684BCC1EAD898B6D8DEB620E973E42C2041BB68C080AFACFFB8DEDD7AF51B5BAAC60F2FDC2D00093AD0D0608AFF7
Malicious:	false
Preview:	#...................#log4j.rootLogger=DEBUG, stdout, default..log4j.rootLogger=DEBUG, default....#log4j.logger.........................Threshold.....................#...........log4j.appender.stdout=org.apache.log4j.ConsoleAppender ..log4j.appender.stdout.layout=org.apache.log4j.PatternLayout ..log4j.appender.stdout.layout.ConversionPattern=%d{HH:mm:ss,SSS} [%t] %-5p - %m%n....#.............log4j.appender.default=org.apache.log4j.RollingFileAppender..log4j.appender.default.File=C:\\Users\\Public\\update_server\\log\\default.log..log4j.appender.default.MaxFileSize=10MB..log4j.appender.default.MaxBackupIndex=12..log4j.appender.default.Append=true..log4j.appender.default.Threshold=DEBUG..log4j.appender.default.layout=org.apache.log4j.PatternLayout..log4j.appender.default.layout.ConversionPattern=%d [%t] %-5p %.16c - %m%n....#....HPP..log4j.logger.HPP=TRACE, HPP..log4j.appender.HPP=org.apache.log4j.RollingFileAppender..log4j.appender.HPP.File=C:\\Users\\Public\\update_

C:\Program Files (x86)\hicloud\update_server\is-HAH6F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.013719728828304
Encrypted:	false
SSDEEP:	6:TMVBd5o/UWYy1vfuAmr56HDqhvyrKiID15c1nrRS7uQSi/n:TMHdYhGAe56+94K9c1lCuQJ
MD5:	9453237568F9EA42AC313988378880F8
SHA1:	3EA2B23222BB61533CDCDB135B69ED904309DB89
SHA-256:	E1316108D44FB7B944FAD372D1A8DE2F5A92557104634C510099F357DCADA3ED
SHA-512:	D9C68C0A6A659C466CC4E1FD9094B51C9845C5F0583B7AC65DB8245DEE3FFD16B58D3A7EE3505AB0A144A5EF4B2E5DFB8CC5C60452CF3F4C67931C95BF55ED6F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<hservice>..<service name="SPUpDateServer" disp="shipin7_UpDateServer" dump="true" />..<dso file="SPUpDate.dll" />..<function init="SPUPDATE_Init" uinit="SPUPDATE_Uninit" start="SPUPDATE_Start" stop="SPUPDATE_Stop" error="SPUPDATE_GetLastError" version="SPUPDATE_GetVersion" gtest="SPUPDATE_Gtest" />..</hservice>..

C:\Program Files (x86)\hicloud\update_server\is-HQ624.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1320448
Entropy (8bit):	6.560821552886333
Encrypted:	false
SSDEEP:	24576:ZPMYKwa3m+i+K3fAHIh84xq0xNvEGd28t/H53xNqAT:5MLVuRljvEGI8t/Zh4A
MD5:	F7BAC757D17A077B7DEDBDAB0FEB1E2F
SHA1:	DB5B2D501A2C51AB8B76FEB3731F13AA37F204E9
SHA-256:	4D2A7A0990613206A3AE327F74A2A6F93A58AEDBBC0946D1188608C7177FE447
SHA-512:	D695872FEF7E5354427ABA0EE07BA86CB4D10E1A4BF49D53F9FCED331D52A24391B8D08E19A6A0F992895C7D508AFBAC8C226170E7018AEFC47EEB30ADE0D0CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8}.wV..wV..wV..8...wV......wV......wV......wV......wV.{hR..wV..wW..uV...-..wV......wV......wV..%...wV......wV.Rich.wV.........................PE..L.....T...........!................~........@.......................................9....@..........................q.......#....... .......................0..\....I..................................@............@...............................text....,.......................... ..`.rdata..x5...@...6...2..............@..@.data...p........n...h..............@....rsrc........ ......................@..@.reloc...I...0...J..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-I4HHJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17392
Entropy (8bit):	6.090714552745069
Encrypted:	false
SSDEEP:	384:QLhZAr9Sc6VOlU3I5urFAepb2pxSldVM63EmLQ:ahZO9Sc6VOlL5urFAOb2ps8633LQ
MD5:	5863EBA0EB8924542F5BD5658371ACB1
SHA1:	261C87B3555CC80065D19FA5A880CA8EC50DBD6B
SHA-256:	EB22E8C572FD3EFFB49559FD908C9C51E3F3993B5AF21DC60B7788300401A856
SHA-512:	53D1F68603E4002C4FFAF5148CDEFE078927405039DED05D1C01E4CE057767AFA0C58100BF50F7D05C2D2736AC5E17CEBB1957C46276A39194F3BF9DA8BFB961
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f................o.......y.......~...............i...............p......Un.......k.....Rich............................PE..L...8..U.....................................0....@..........................p......Q.....@..................................6.......P...............0.......`......P1...............................5..@............0..0............................text...2........................... ..`.rdata.......0......................@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-J9FD8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364928
Entropy (8bit):	6.429771282212209
Encrypted:	false
SSDEEP:	6144:hIrhX+o48cPCbIHSec57KKfRlhlLrfjDwo3IzXlR2vuPEsUt:h0bIHUnhlLrfP8z1R2vwUt
MD5:	414A1B5801D2E2F7A3A34C7DB7557F25
SHA1:	F127FC2EF714CF372C02F22260A27C37B1D137EC
SHA-256:	A40B0B0BD4F46327CEB2068C06A5FFE37F4809D1E11142E0D591C3C9D3B03105
SHA-512:	0BACC7A829A549788A429AE1D19B26AB665284651224F3BFB58E961DC0869A4496BD97E590ADFF4123234E8C366D687248F0111EDF24C3AE16B56EB9B0EECDFE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..EP..EP..EP..b...OP..b...^P..EP..bR..L({.ZP..L(m..P..[.j.FP..L(j..P..[.z.DP..L(..DP..RichEP..........................PE..L...r.ET.........................................@.........................................................................L........`..,y...........\|..............p................................t..@.......................@....................text............................... ..`.rdata..\...........................@..@.data...\|e.......*..................@....rsrc...,y...`...z..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-LSKSS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.392205294925466
Encrypted:	false
SSDEEP:	3072:AUN+idqQMdbxdjgSB7jED2zoO4LdOt83o:9NHqQMdbxTSizpIdOt8
MD5:	49A4D94A5A75083AA1E8C02CEF7725FD
SHA1:	AD13905E570264BE42CB2625A65F16E4E98F7F7D
SHA-256:	7B8CA1E3BB486C7478220BD4F013F7A07070615619AC81B3F34E4554756B6992
SHA-512:	B37324F4F3E53E2518760E6FDF384163F4F137084ADE32D56C365E7EAAC9883EAD58A868A9C0277D8B7E55C0723DA86F3855BDE33AD7E193C99184D66AC024F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g....P...P...Pp..P...P..P...P..P...P..P...P..P...P...P...P.7rP...P..P...P..P...P..P...P..P...PRich...P........PE..L...6..U...........!........v......x........@.......................................3....@.............................W....n..................................t...@C...............................R..@............@...............................text...u(......................... ..`.rdata..gG...@...H..................@..@.data.... ...........v..............@...SharedDa.............z..............@....rsrc................\|..............@..@.reloc...!......."..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-N0DHA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.961031906449987
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCqXT4iaX2T8FtwL6AIJKuADkYFaVt94Uy:TMVBdS4M8v+6AIJxVoNUy
MD5:	5F9DF243D29164E6CF344EF5A1D7C457
SHA1:	DCBBDAE04826A4FDB84AF9E9B430323BE7339B55
SHA-256:	E9C3018DDB6DAD0C407A797D3009AACB14A98DC1212B139D6E761BD289438812
SHA-512:	D84E8390E6C0592EF4C212951F1499D0FDA669DAC8A7BB8D781C79E50FAED47E4A54FAB62994B80B83252EADFD4017479A206FB109A2E46CC50E84CC6763095B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<ServerInfo>..<CenterServerInfo ServerUrl = "https://api.ezvizlife.com" updatetime = "21600"/>..</ServerInfo>..

C:\Program Files (x86)\hicloud\update_server\is-NAN0P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	706559
Entropy (8bit):	6.484697769206479
Encrypted:	false
SSDEEP:	12288:x0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv35ELAV2XEx9r+:5fKbT5lrPo37AzHTA63/cfU9IEU353gR
MD5:	98AAA09642582B38EC32E028F847D849
SHA1:	9A5C9D58E404228EDFC78D71FFDD5748BE48C632
SHA-256:	832D8E1C9B776F533A91710F2C561B0B033E2DE01A007ED5DFAE1F6DD77031AF
SHA-512:	63FB98B7D777A4E44C5008CE7B8B98F0D8F2A35A5894A7E235B8864B8C0AB84DA495D227BA658DA438F8563DEDF3296887CFD9C2A3EE892B2F1B93A3E8B3E5D8
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...v.......1.......@....@..............................................@...............................%...`...;..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....;...`...<...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-NITAN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	285184
Entropy (8bit):	6.621724518888642
Encrypted:	false
SSDEEP:	6144:nAJI58v2j/iU9ky9Q0sZY3EwFkmD5PcGR1KiNVsYyebA:CI58vYa4h9/Unm1PcYKZYy
MD5:	0073978BECAD70799D49AA1A427E22EF
SHA1:	A05FB430937513E5C0990171622F83F1E1F98358
SHA-256:	5363EC382D8B75E7087CDC6186E73D5B3CD33BF53009B9F3954DD1161AF19C56
SHA-512:	EE05BFED0E1F837BD4766A581264EA45371C7DB6CD955DA493DD24DFF98A7D050E96DBC3B074B552D3F7B0FFE0341DC46254A3BB858F4317F2511CA7726BD1AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............a.a.a.7.v..a..u..a..d..a..s..a.a.`.....a..c..a..r..a.3t..a..q..a.Rich.a.........................PE..L......U...........!.....v...........~...............................................................................2..c....&.......P.......................`...(...................................&..@............................................text...zt.......v.................. ..`.rdata..#............z..............@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc..6*...`...,..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-OM9H2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.264203583220857
Encrypted:	false
SSDEEP:	3:nnWsRdLAdNKAnWM+SmmL4Aov:nWwdL4N/WbSL4Nv
MD5:	D9A1768F47F4D3BDF535B06735F04804
SHA1:	0B8D73AC148B5D3400680BB6795C07B904A00C67
SHA-256:	28CABBF2514BB09DBFAB83B60EDCA035C93F3B20D6A77B97133402894D2766C9
SHA-512:	DE401A9B40370D404F9C96030291F81AFE49C0BA4FD4E3DB9CA51FD871D99B650B7523FAEA008F623C82A251004CC27564EB50DB8CC7F7F92029C79273BE33D5
Malicious:	false
Preview:	taskkill /f /im startUp.exe..taskkill /f /im SPUpDateServer.exe..

C:\Program Files (x86)\hicloud\update_server\is-R6CG1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18416
Entropy (8bit):	6.450988905120029
Encrypted:	false
SSDEEP:	192:y0J9H0Iw5hJsY/Pfxq1q7ooB5pgNSN1Og2dGtBj6y+QGf3PzDjLd8462vOoFJN1h:RXKkY/xqs7PgDeYxLM63ES7
MD5:	B614020DF9D482886A5345B7A3A5F0E8
SHA1:	40BE905C32579B5C722E1461A24AA6787520072D
SHA-256:	5B58D06BF0F190E2C9F874EDE46F0771CD1720A69F81546447E88C1A4FE7D212
SHA-512:	F85918A5DE016A3CC11BCEBD508A0A814779DB9B98966D114FA78B36F84555D3AA7EBEB38A1C77F84CA2E5FFE969C1CF1E69DAA6A8AE1835921AF5F6A5BF03D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................l.......z.......}.......j......`...............s.......h.....Rich............................PE..L.....MT............................z........0....@..................................{....@..................................4..P....`...............4.......p..t...P1..............................@3..@............0..0............................text...z........................... ..`.rdata.......0......................@..@.data........P.......*..............@....rsrc........`.......,..............@..@.reloc.......p.......0..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-VEV33.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1204736
Entropy (8bit):	6.80921105797272
Encrypted:	false
SSDEEP:	24576:VYtiKx6ZNfNtJRTKnsk+qWUIy2po5uJ1vjyOU:VYBKNVtJRTKsk+qdIy2po0JRjyOU
MD5:	07570F69CA94F2771A97F5A197D1558D
SHA1:	250378908B10A48628C5E2D17806ADA78B68B94E
SHA-256:	1E7C225AA7BDDAFB8B7AF62440B7A3F0EF837C865903C579EBF96D4D4B7FDFEA
SHA-512:	4760BBF8D6CA1ADE200B663483AC9859DBED0A6FE602B6CA8C646237C6BF320D579377D15A13DD02CF827AD151C02B261796457BFD14DA0771EB0673685B0433
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\...2...2...2.....2.....2.....2...3.x.2..$I...2....2.....2.....2.....2.Rich..2.........PE..L......U...........!................l...................................................................................=...l...................................,.......................................@...............p............................text............................... ..`.rdata...s.......t..................@..@.data...L....p...`...T..............@....rsrc...............................@..@.reloc..~...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\is-VQDR6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	6.449118975816472
Encrypted:	false
SSDEEP:	6144:U8gZwLcuTb8eHUqU/Dd1t2brivTrBJlClWhZ9doXmBj/BgLYa5Y5brWSZJ2sBhT1:UuLcuTb8eHUqU/Djt2brirrBJlCEhZ95
MD5:	8FCAFF6E6785ACB340DA34B5ED512CFD
SHA1:	5A63F20EB336E5A16142FAE1D765B50FBC851B47
SHA-256:	D42C33F4FAA35185AD88D62D941986C61585C47EA6D292271CD06BC40D78B06C
SHA-512:	5BD38B1A9CA2170680C2F74B5E3214C87F5AB6770D5674A24AF743B2AF32F2A0E20EF8E659539CE9894FF2B68B7C1EA378B74A2F93D1E3C7A75CC09E6601217A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D...........lQ........................+._...........................Rich...................PE..L.....U...........!.....V...,......._.......p...................................................................... ....)......P............................... (...v..................................@............p...............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data....3...@...0...$..............@....rsrc................T..............@..@.reloc..).......*...\..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\kill_process.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.264203583220857
Encrypted:	false
SSDEEP:	3:nnWsRdLAdNKAnWM+SmmL4Aov:nWwdL4N/WbSL4Nv
MD5:	D9A1768F47F4D3BDF535B06735F04804
SHA1:	0B8D73AC148B5D3400680BB6795C07B904A00C67
SHA-256:	28CABBF2514BB09DBFAB83B60EDCA035C93F3B20D6A77B97133402894D2766C9
SHA-512:	DE401A9B40370D404F9C96030291F81AFE49C0BA4FD4E3DB9CA51FD871D99B650B7523FAEA008F623C82A251004CC27564EB50DB8CC7F7F92029C79273BE33D5
Malicious:	false
Preview:	taskkill /f /im startUp.exe..taskkill /f /im SPUpDateServer.exe..

C:\Program Files (x86)\hicloud\update_server\libcurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	285184
Entropy (8bit):	6.621724518888642
Encrypted:	false
SSDEEP:	6144:nAJI58v2j/iU9ky9Q0sZY3EwFkmD5PcGR1KiNVsYyebA:CI58vYa4h9/Unm1PcYKZYy
MD5:	0073978BECAD70799D49AA1A427E22EF
SHA1:	A05FB430937513E5C0990171622F83F1E1F98358
SHA-256:	5363EC382D8B75E7087CDC6186E73D5B3CD33BF53009B9F3954DD1161AF19C56
SHA-512:	EE05BFED0E1F837BD4766A581264EA45371C7DB6CD955DA493DD24DFF98A7D050E96DBC3B074B552D3F7B0FFE0341DC46254A3BB858F4317F2511CA7726BD1AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............a.a.a.7.v..a..u..a..d..a..s..a.a.`.....a..c..a..r..a.3t..a..q..a.Rich.a.........................PE..L......U...........!.....v...........~...............................................................................2..c....&.......P.......................`...(...................................&..@............................................text...zt.......v.................. ..`.rdata..#............z..............@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc..6*...`...,..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1204736
Entropy (8bit):	6.80921105797272
Encrypted:	false
SSDEEP:	24576:VYtiKx6ZNfNtJRTKnsk+qWUIy2po5uJ1vjyOU:VYBKNVtJRTKsk+qdIy2po0JRjyOU
MD5:	07570F69CA94F2771A97F5A197D1558D
SHA1:	250378908B10A48628C5E2D17806ADA78B68B94E
SHA-256:	1E7C225AA7BDDAFB8B7AF62440B7A3F0EF837C865903C579EBF96D4D4B7FDFEA
SHA-512:	4760BBF8D6CA1ADE200B663483AC9859DBED0A6FE602B6CA8C646237C6BF320D579377D15A13DD02CF827AD151C02B261796457BFD14DA0771EB0673685B0433
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\...2...2...2.....2.....2.....2...3.x.2..$I...2....2.....2.....2.....2.Rich..2.........PE..L......U...........!................l...................................................................................=...l...................................,.......................................@...............p............................text............................... ..`.rdata...s.......t..................@..@.data...L....p...`...T..............@....rsrc...............................@..@.reloc..~...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\log4cxx.properties

Download File

Process:	C:\Program Files (x86)\hicloud\update_server\ModProperties.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	5.468157333131078
Encrypted:	false
SSDEEP:	48:MHqFfr44CiAPcaZ5PEP7pHb+jvJuPzxdWKPCv:MHqFT44CB0af8T9mvMrTQv
MD5:	94C0C0832645E4A5D1AB0A1C7E172562
SHA1:	E45787E979260B470FEEC397ED794949DEFB72ED
SHA-256:	C37F86798407A674F348869F7CA2611F6E8BFE593C63BEFDD36B92221962EF8B
SHA-512:	506160EE16E35B262161342668ECB911A1D1DC9447770BA0376EBCC2F681A9D37BA55CB41854E162AF70B7C8465ECB74CA8D3CA831A4A33F08DF8A3B68058BC1
Malicious:	false
Preview:	#...................#log4j.rootLogger=DEBUG, stdout, default..log4j.rootLogger=DEBUG, default....#log4j.logger.........................Threshold.....................#...........log4j.appender.stdout=org.apache.log4j.ConsoleAppender ..log4j.appender.stdout.layout=org.apache.log4j.PatternLayout ..log4j.appender.stdout.layout.ConversionPattern=%d{HH:mm:ss,SSS} [%t] %-5p - %m%n....#.............log4j.appender.default=org.apache.log4j.RollingFileAppender..log4j.appender.default.File=C:/ProgramData/hik/log/update_server/default.log..log4j.appender.default.MaxFileSize=10MB..log4j.appender.default.MaxBackupIndex=12..log4j.appender.default.Append=true..log4j.appender.default.Threshold=DEBUG..log4j.appender.default.layout=org.apache.log4j.PatternLayout..log4j.appender.default.layout.ConversionPattern=%d [%t] %-5p %.16c - %m%n....#....HPP..log4j.logger.HPP=TRACE, HPP..log4j.appender.HPP=org.apache.log4j.RollingFileAppender..log4j.appender.HPP.File=C:/ProgramData/hik/log/updat

C:\Program Files (x86)\hicloud\update_server\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	6.449118975816472
Encrypted:	false
SSDEEP:	6144:U8gZwLcuTb8eHUqU/Dd1t2brivTrBJlClWhZ9doXmBj/BgLYa5Y5brWSZJ2sBhT1:UuLcuTb8eHUqU/Djt2brirrBJlCEhZ95
MD5:	8FCAFF6E6785ACB340DA34B5ED512CFD
SHA1:	5A63F20EB336E5A16142FAE1D765B50FBC851B47
SHA-256:	D42C33F4FAA35185AD88D62D941986C61585C47EA6D292271CD06BC40D78B06C
SHA-512:	5BD38B1A9CA2170680C2F74B5E3214C87F5AB6770D5674A24AF743B2AF32F2A0E20EF8E659539CE9894FF2B68B7C1EA378B74A2F93D1E3C7A75CC09E6601217A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D...........lQ........................+._...........................Rich...................PE..L.....U...........!.....V...,......._.......p...................................................................... ....)......P............................... (...v..................................@............p...............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data....3...@...0...$..............@....rsrc................T..............@..@.reloc..).......*...\..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\startUp.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14832
Entropy (8bit):	6.289677513443667
Encrypted:	false
SSDEEP:	192:hmdqaPcEXDjJjysN2kRJ2yJN1yhNmW8B980syMrj1EJ3w/S312U:h1GjtVN2kRpxW8hvM63E1U
MD5:	0F5FF2EEF7CCB672743BBA3A881A3A56
SHA1:	5C711AE5929417A244231F02C211B2D9EE188912
SHA-256:	75A0AA3095421757598E7F21EC932AF2F9E9DB30C7B3F0D9D714D0852A807C8D
SHA-512:	D2555C3E1E71444E54D47ADEDF40DA34A98B4BAA12D0492A636E3D67C507A0502BCC0134117B65B96A9113D933FEB41E960DBC6A9865FB3E7D128572B5CF0BD1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................\|....j....z....m................c....{....}....x....Rich....................PE..L......U............................3........ ....@..........................`......v.....@..........................(..d...4#..d....@...............&.......P.......!..............................."..@............ ...............................text............................... ..`.rdata..T.... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..0....P......."..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\hicloud\update_server\tmp.tmp

Download File

Process:	C:\Program Files (x86)\hicloud\update_server\ModProperties.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	5.468157333131078
Encrypted:	false
SSDEEP:	48:MHqFfr44CiAPcaZ5PEP7pHb+jvJuPzxdWKPCv:MHqFT44CB0af8T9mvMrTQv
MD5:	94C0C0832645E4A5D1AB0A1C7E172562
SHA1:	E45787E979260B470FEEC397ED794949DEFB72ED
SHA-256:	C37F86798407A674F348869F7CA2611F6E8BFE593C63BEFDD36B92221962EF8B
SHA-512:	506160EE16E35B262161342668ECB911A1D1DC9447770BA0376EBCC2F681A9D37BA55CB41854E162AF70B7C8465ECB74CA8D3CA831A4A33F08DF8A3B68058BC1
Malicious:	false
Preview:	#...................#log4j.rootLogger=DEBUG, stdout, default..log4j.rootLogger=DEBUG, default....#log4j.logger.........................Threshold.....................#...........log4j.appender.stdout=org.apache.log4j.ConsoleAppender ..log4j.appender.stdout.layout=org.apache.log4j.PatternLayout ..log4j.appender.stdout.layout.ConversionPattern=%d{HH:mm:ss,SSS} [%t] %-5p - %m%n....#.............log4j.appender.default=org.apache.log4j.RollingFileAppender..log4j.appender.default.File=C:/ProgramData/hik/log/update_server/default.log..log4j.appender.default.MaxFileSize=10MB..log4j.appender.default.MaxBackupIndex=12..log4j.appender.default.Append=true..log4j.appender.default.Threshold=DEBUG..log4j.appender.default.layout=org.apache.log4j.PatternLayout..log4j.appender.default.layout.ConversionPattern=%d [%t] %-5p %.16c - %m%n....#....HPP..log4j.logger.HPP=TRACE, HPP..log4j.appender.HPP=org.apache.log4j.RollingFileAppender..log4j.appender.HPP.File=C:/ProgramData/hik/log/updat

C:\Program Files (x86)\hicloud\update_server\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	InnoSetup Log update_server {1D08522D-308D-4615-AEA9-44021FD7445A}, version 0x30, 5748 bytes, 061544\user, "C:\Program Files (x86)\hicloud\update_server"
Category:	dropped
Size (bytes):	5748
Entropy (8bit):	5.126337762144628
Encrypted:	false
SSDEEP:	96:03Vk44mhihjTOs8edW47ICSss/LVuFnts/scsyYKmaZq45bndHl2r:S3QjTOshNICSsAVuFTr
MD5:	088BAB9DE8608F1A46D940B5A3AB34E8
SHA1:	65E2C5224D169DE13ADF3C6F941E8256E93FF5A5
SHA-256:	16581D04A038AD9CBE37BC168CF9E529F779AD2C4D987905FB64DA67D2380B71
SHA-512:	E4147BBEB10234F5F3007901FCC2BDA94F63C2DAD18D26BB6A75E187DEB6A1D07B575E9EA4EE19E96FB51552B475EF7B387F64838DE3D770A724980AD88281C2
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{1D08522D-308D-4615-AEA9-44021FD7445A}..........................................................................................update_server...................................................................................................................0...$...t...%................................................................................................................1N$..........rm......L....061544.user,C:\Program Files (x86)\hicloud\update_server.................. .....~....5.IFPS.............................................................................................................BOOLEAN.........................'...........!MAIN....-1..#...dll:files:ISTask.dll.RunTask.........#...dll:files:ISTask.dll.KillTask.......(...........INITIALIZESETUP....16..CHECKFORMUTEXES........CREATEMUTEX.......6...........CURSTEPCHANGED....-1 @18..REGQUERYSTRINGVALUE...........REMOVEQUOTES........EXEC......................

C:\Program Files (x86)\hicloud\update_server\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	706559
Entropy (8bit):	6.484697769206479
Encrypted:	false
SSDEEP:	12288:x0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv35ELAV2XEx9r+:5fKbT5lrPo37AzHTA63/cfU9IEU353gR
MD5:	98AAA09642582B38EC32E028F847D849
SHA1:	9A5C9D58E404228EDFC78D71FFDD5748BE48C632
SHA-256:	832D8E1C9B776F533A91710F2C561B0B033E2DE01A007ED5DFAE1F6DD77031AF
SHA-512:	63FB98B7D777A4E44C5008CE7B8B98F0D8F2A35A5894A7E235B8864B8C0AB84DA495D227BA658DA438F8563DEDF3296887CFD9C2A3EE892B2F1B93A3E8B3E5D8
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...v.......1.......@....@..............................................@...............................%...`...;..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....;...`...<...d..............@..P.....................*..............@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hicloud\Ezviz Studio\Ezviz Studio.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Apr 19 07:15:51 2024, mtime=Fri Apr 19 07:15:51 2024, atime=Thu Dec 21 11:24:22 2023, length=4524608, window=hide
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	4.656363464556262
Encrypted:	false
SSDEEP:	24:8mtG+/WESdOE9HrNvAhhQ0/tdRFdLUUCKdMqyFm:8mtTJSdO4LN4hu0ldRFdgeyF
MD5:	C0830025149095A2AC571F953B1E0FC7
SHA1:	801A5C62F686772FF074F8B23F0AE428FCD42CCB
SHA-256:	8B0CD71164A73991EB2A830B5FD96095AEB02E295B6DA2FE470EBA980DA26A81
SHA-512:	FC463D8B6F251C362F642B23E12C06061A8BD024549EB655EA963C479B4D174BF20A0570B1EB48AFFDA66E1D10811C1401AE22AF975A5BD15EF783454FAAABD7
Malicious:	false
Preview:	L..................F.... ...S...1...'...1.......4..@.E..........................P.O. .:i.....+00.../C:\.....................1......X.A..PROGRA~2.........O.I.X.A....................V......6..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....b.1......X.B..EZVIZS~1..J......X.A.X.B..........................P...E.z.v.i.z. .S.t.u.d.i.o.....l.2.@.E..W.c .EZVIZS~1.EXE..P......X.A.X.A.............................E.z.v.i.z.S.t.u.d.i.o...e.x.e.......b...............-.......a...........).0......C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe..E.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.E.z.v.i.z. .S.t.u.d.i.o.\.E.z.v.i.z.S.t.u.d.i.o...e.x.e.#.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.E.z.v.i.z. .S.t.u.d.i.o.........*................@Z\|...K.J.........`.......X.......061544...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hicloud\Ezviz Studio\Uninstall Uninstall Ezviz Studio.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Apr 19 07:15:51 2024, mtime=Fri Apr 19 07:15:51 2024, atime=Fri Apr 19 07:15:34 2024, length=716570, window=hide
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	4.677581053628509
Encrypted:	false
SSDEEP:	24:8mVVEOdOE9lV6yAIhQ8d/2dLUUCvqyFm:8mVSOdO4lViIu8d/2dguyF
MD5:	55C6D2419AAB387D1560338218CA0186
SHA1:	AC8F5E2C81D8113E920544A9DF46489C12C7BEA7
SHA-256:	FADE25D2CFEAE735CDD3B0A5217432A1B2DD95C42BC0495525F424D917A76833
SHA-512:	9C295AE697687B656AC531D51290FD357B1DAEDD5C76485229B27DB2FBB9DC98374B5E56C348A9AEBD674C1DF5693880B2348A7ADDF3E0788A3A7879664CDF64
Malicious:	false
Preview:	L..................F.... ...(...1...(...1.......1................................P.O. .:i.....+00.../C:\.....................1......X.A..PROGRA~2.........O.I.X.B....................V......<o.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....b.1......X.B..EZVIZS~1..J......X.A.X.B..........................8..E.z.v.i.z. .S.t.u.d.i.o.....f.2......X.A .unins000.exe..J......X.A.X.A..........................^..u.n.i.n.s.0.0.0...e.x.e......._...............-.......^...........).0......C:\Program Files (x86)\Ezviz Studio\unins000.exe..B.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.E.z.v.i.z. .S.t.u.d.i.o.\.u.n.i.n.s.0.0.0...e.x.e.#.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.E.z.v.i.z. .S.t.u.d.i.o.........................@Z\|...K.J.........`.......X.......061544...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hicloud\update_server\Uninstall update_server.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Apr 19 07:16:07 2024, mtime=Fri Apr 19 07:16:07 2024, atime=Fri Apr 19 07:16:05 2024, length=706559, window=hide
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	4.685277888529227
Encrypted:	false
SSDEEP:	24:8BCVEOdOE4iR7WgPpkAPkCd/GlboUUCPqyFm:80SOdOAwgPpzPZd/Glb9OyF
MD5:	53A8ED17F06C2B0EA479A653B02C7737
SHA1:	7EBFBE13E7DB91A978A83A99AB853AA65ADB3FC3
SHA-256:	162551BADF8CD6A7E9FB443DF3CCB5C912D2B3F1DBDC5FFA1D405EF19A979738
SHA-512:	5D3595D1B7EF1744AFC3A18C540767CF1E8A686126715D8DD007E2B60561F6CFF4DA7A81BED285FE711115697D4CC1239E6838105EB95C70AA70DDF7A4D19572
Malicious:	false
Preview:	L..................F.... ...9oU.1.....W.1...Qfi.1................................P.O. .:i.....+00.../C:\.....................1......X.A..PROGRA~2.........O.I.X.B....................V......<o.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....V.1......X.B..hicloud.@......X.B.X.B.....C.....................dW.h.i.c.l.o.u.d.....d.1......X.B..UPDATE~1..L......X.B.X.B.....C........................u.p.d.a.t.e._.s.e.r.v.e.r.....f.2......X.B .unins000.exe..J......X.B.X.B.....C.....................@..u.n.i.n.s.0.0.0...e.x.e.......h...............-.......g...........).0......C:\Program Files (x86)\hicloud\update_server\unins000.exe..K.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.h.i.c.l.o.u.d.\.u.p.d.a.t.e._.s.e.r.v.e.r.\.u.n.i.n.s.0.0.0...e.x.e.........*................@Z\|...K.J.........`.......X.......061544...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,..................1SPS.XF.L8C....&.m.q......

C:\ProgramData\hik\log\update_server\SPUPDATE.log

Download File

Process:	C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	13613
Entropy (8bit):	5.835613364111652
Encrypted:	false
SSDEEP:	384:kmKPKgmKbKQrmKpK/mKwKNmKyK8mKnKdmKNKWfUTPmKWbKJsmmKGKMmKKzKi8mK3:kmKPKgmKbKQrmKpK/mKwKNmKyK8mKnKF
MD5:	32A17711EF065E6B9C2475261126724E
SHA1:	72543BC7DFDCD80E0D77BBF644C3996207AC7ACB
SHA-256:	C8AD99CE14BE7BCEF798D964634534DB82404EABF79080C2087F53892F5105E1
SHA-512:	203402FBC864EFF9710A25AAD613F4E3AB65CBB67988D3C03A381BFDF29364178B1DD080AC769F2766BF0D2007D4133863165F767729331B37549AFB97459741
Malicious:	false
Preview:	2024-04-19 10:16:10,310 [0x00001ec0] DEBUG SPUPDATE - SPUPDATE_Init ....2024-04-19 10:16:10,310 [0x00001ec0] ERROR SPUPDATE - GetVisionNodeInfo success ,path:SOFTWARE\shipin7\Ezviz_client,Vision:2.3.0...2024-04-19 10:16:10,310 [0x00001ec0] ERROR SPUPDATE - GetVisionNodeInfo success ,path:SOFTWARE\shipin7\shipin7_update_server,Vision:1.0.1.20...2024-04-19 10:16:10,310 [0x00001ec0] DEBUG SPUPDATE - SPUPDATE_GetVersion ....2024-04-19 10:16:10,310 [0x00001ec0] DEBUG SPUPDATE - SPUPDATE_Start start...2024-04-19 10:16:10,310 [0x00001ec0] DEBUG SPUPDATE - SPIpcServe ..........2024-04-19 10:16:10,310 [0x00001ec0] DEBUG SPUPDATE - SPUPDATE_Start end...2024-04-19 10:16:10,310 [0x00001ed8] DEBUG SPUPDATE - ....................2024-04-19 10:16:10,310 [0x00001ed8] ERROR SPUPDATE - GetVisionNodeInfo success ,path:SOFTWARE\shipin7\Ezviz_client,Vision:2.3.0...2024-04-19 10:16:10,310 [0x00001ed8] ERROR SPUPDATE - GetVisionNodeInfo success ,path:SOFTWARE\shipin7\shipin7_update_server,Vision:1.0.1.20

C:\ProgramData\hik\log\update_server\default.log

Download File

Process:	C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	13613
Entropy (8bit):	5.835613364111652
Encrypted:	false
SSDEEP:	384:kmKPKgmKbKQrmKpK/mKwKNmKyK8mKnKdmKNKWfUTPmKWbKJsmmKGKMmKKzKi8mK3:kmKPKgmKbKQrmKpK/mKwKNmKyK8mKnKF
MD5:	32A17711EF065E6B9C2475261126724E
SHA1:	72543BC7DFDCD80E0D77BBF644C3996207AC7ACB
SHA-256:	C8AD99CE14BE7BCEF798D964634534DB82404EABF79080C2087F53892F5105E1
SHA-512:	203402FBC864EFF9710A25AAD613F4E3AB65CBB67988D3C03A381BFDF29364178B1DD080AC769F2766BF0D2007D4133863165F767729331B37549AFB97459741
Malicious:	false
Preview:	2024-04-19 10:16:10,310 [0x00001ec0] DEBUG SPUPDATE - SPUPDATE_Init ....2024-04-19 10:16:10,310 [0x00001ec0] ERROR SPUPDATE - GetVisionNodeInfo success ,path:SOFTWARE\shipin7\Ezviz_client,Vision:2.3.0...2024-04-19 10:16:10,310 [0x00001ec0] ERROR SPUPDATE - GetVisionNodeInfo success ,path:SOFTWARE\shipin7\shipin7_update_server,Vision:1.0.1.20...2024-04-19 10:16:10,310 [0x00001ec0] DEBUG SPUPDATE - SPUPDATE_GetVersion ....2024-04-19 10:16:10,310 [0x00001ec0] DEBUG SPUPDATE - SPUPDATE_Start start...2024-04-19 10:16:10,310 [0x00001ec0] DEBUG SPUPDATE - SPIpcServe ..........2024-04-19 10:16:10,310 [0x00001ec0] DEBUG SPUPDATE - SPUPDATE_Start end...2024-04-19 10:16:10,310 [0x00001ed8] DEBUG SPUPDATE - ....................2024-04-19 10:16:10,310 [0x00001ed8] ERROR SPUPDATE - GetVisionNodeInfo success ,path:SOFTWARE\shipin7\Ezviz_client,Vision:2.3.0...2024-04-19 10:16:10,310 [0x00001ed8] ERROR SPUPDATE - GetVisionNodeInfo success ,path:SOFTWARE\shipin7\shipin7_update_server,Vision:1.0.1.20

C:\Users\Public\Desktop\Ezviz Studio.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Apr 19 07:15:51 2024, mtime=Fri Apr 19 07:16:03 2024, atime=Thu Dec 21 11:24:22 2023, length=4524608, window=hide
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	4.676523004197233
Encrypted:	false
SSDEEP:	24:8mtI+d/VEOdOE9QrNvAhhQ0/BdRFdLUUCKdMqyFm:8mtI+1SOdO4UN4hu0JdRFdgeyF
MD5:	25EC44EF24D1D24641B29F1489F01923
SHA1:	991CF798137EA2C9D0C3FFD2A0ABE063F35D6C0D
SHA-256:	D0252FFF8D39EC58363E449C73F09FD45A195AA7209BAF843502D5296935FB19
SHA-512:	DF567DD8AB1706823CFEF9964CAD73CF535C96D0CE7EBAD8D73A916310BEFC5C755EF51A57818CB222C167CFFF31B573322FE1F69A91FE968D856532F3AECF51
Malicious:	false
Preview:	L..................F.... ...S...1...:.".1.......4..@.E..........................P.O. .:i.....+00.../C:\.....................1......X.A..PROGRA~2.........O.I.X.B....................V......<o.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....b.1......X.B..EZVIZS~1..J......X.A.X.B..........................8..E.z.v.i.z. .S.t.u.d.i.o.....l.2.@.E..W.c .EZVIZS~1.EXE..P......X.A.X.A.............................E.z.v.i.z.S.t.u.d.i.o...e.x.e.......b...............-.......a...........).0......C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe..9.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.E.z.v.i.z. .S.t.u.d.i.o.\.E.z.v.i.z.S.t.u.d.i.o...e.x.e.#.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.E.z.v.i.z. .S.t.u.d.i.o.........................@Z\|...K.J.........`.......X.......061544...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.

C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\ISTask.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.357541095717686
Encrypted:	false
SSDEEP:	1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
MD5:	86A1311D51C00B278CB7F27796EA442E
SHA1:	AC08AC9D08F8F5380E2A9A65F4117862AA861A19
SHA-256:	E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D
SHA-512:	129E4B8DD2665BCFC5E72B4585343C51127B5D027DBB0234291E7A197BAECA1BAB5ED074E65E5E8C969EE01F9F65CC52C9993037416DE9BFFF2F872E5AEBA7EC
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................<......0.............@..........................`.......................................................@....................... ..h...................................................................................CODE....\........................... ..`DATA....h...........................@...BSS......................................idata..............................@....edata..............................@..P.reloc..h.... ......................@..P.rsrc........@......................@..P.............`......................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-2VGCC.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\ISTask.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.357541095717686
Encrypted:	false
SSDEEP:	1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
MD5:	86A1311D51C00B278CB7F27796EA442E
SHA1:	AC08AC9D08F8F5380E2A9A65F4117862AA861A19
SHA-256:	E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D
SHA-512:	129E4B8DD2665BCFC5E72B4585343C51127B5D027DBB0234291E7A197BAECA1BAB5ED074E65E5E8C969EE01F9F65CC52C9993037416DE9BFFF2F872E5AEBA7EC
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................<......0.............@..........................`.......................................................@....................... ..h...................................................................................CODE....\........................... ..`DATA....h...........................@...BSS......................................idata..............................@....edata..............................@..P.reloc..h.... ......................@..P.rsrc........@......................@..P.............`......................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-3IGQ5.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp

Download File

Process:	C:\Users\user\Desktop\EzvizStudioSetups.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	706048
Entropy (8bit):	6.489986622577446
Encrypted:	false
SSDEEP:	12288:x0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv35ELA6XEx9rY:5fKbT5lrPo37AzHTA63/cfU9IEU3536p
MD5:	3A19CEEF46D5B5A68F039F505AFB5407
SHA1:	512DB70BBADC6132B3568264CC069318ECF53038
SHA-256:	DFE7E2A4B70F224FFB879541120F90D074D1D2B4B548A09091B04A268FCB7017
SHA-512:	3C6188C61A9F5ECDCE3BF34DEA5CAD2B62C7F888C1A9606E2BBC037A7BAF3C29E15C99F03374FA86F7AB9ABDD43C2D8BCFBCA382F722F7F1C1AD1C95D135E59B
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...a..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....a...`...b...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp

Download File

Process:	C:\Program Files (x86)\Ezviz Studio\update_server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	696320
Entropy (8bit):	6.476932651749198
Encrypted:	false
SSDEEP:	12288:p0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv35ELAV2XEx9rz:BfKbT5lrPo37AzHTA63/cfU9IEU353gC
MD5:	9D321C7096F4BCAEB6F3D8D1636E1744
SHA1:	C7797576432F72891986E81AFD1BE1C3AADBB79B
SHA-256:	43202B0DE2E718D35CDF7EB8B34DD35BF3FAE85C0ECD2108830230A121284322
SHA-512:	A4C3A0BB3090A8192ADE70F83A1B3A4A74ACFE3307FCA7BBC70681EA93E88907ECAE60023C9D608729DD179E6FFB991212ECB1040B2483B97EFAF812EF731624
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...v.......1.......@....@..............................................@...............................%...`...;..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....;...`...<...d..............@..P.....................*..............@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999981562528791
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	EzvizStudioSetups.exe
File size:	46'356'824 bytes
MD5:	1c3069311cc648d664f9325cdcbf3fde
SHA1:	49e68542d9769901cd3e544389a39b22ca2d2a9f
SHA256:	8bf31bd97688fe481b0dca7b21733e04f92da65bb5d1726f9c00a22effe5bdf2
SHA512:	fe03df80e84da122bc5f3236e5dba86290f97f5f33772cddcace6742fe0e45ca88495e4f32d19acc950b79d553af9d7f926a9ad3884622cdab88e97bf3342841
SSDEEP:	786432:MjoHntksot6j9W0oJdNxB3dl3HDVabCzHr5DWxr5/8NJ2Ddw6tsso:AYn2sSMcPx9jUCHtWxrl8D7d
TLSH:	DEA733735210C5A2D863F2B76D13E65388DBF28A3E0ECB08756BA9F726543913A335C5
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	a233331327213318

Static PE Info

General

Entrypoint:	0x409b24
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	04/01/2023 00:00:00 08/01/2024 23:59:59
Subject Chain	CN=\u676d\u5dde\u8424\u77f3\u8f6f\u4ef6\u6709\u9650\u516c\u53f8, O=\u676d\u5dde\u8424\u77f3\u8f6f\u4ef6\u6709\u9650\u516c\u53f8, L=\u676d\u5dde\u5e02, S=\u6d59\u6c5f\u7701, C=CN
Version:	3
Thumbprint MD5:	4F3B1F2EF71C98563D518DADF5BD2C26
Thumbprint SHA-1:	5361628C9FE96232070C3E1326F18D898F9923DE
Thumbprint SHA-256:	9762CD219D9D1ABE3960D2F5E4BD5C13C50A19C9E114271912992FED881E00B3
Serial:	0BFEB8FB4A9FE2BB90649C7B62625B82

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F03D53D7F77h
call 00007F03D53D917Eh
call 00007F03D53DB3A9h
call 00007F03D53DB3F0h
call 00007F03D53DDCE3h
call 00007F03D53DDE4Ah
xor eax, eax
push ebp
push 0040A1DBh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040A1A4h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007F03D53DE870h
call 00007F03D53DE3D7h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F03D53DB9D9h
mov edx, dword ptr [ebp-10h]
mov eax, 0040CDE4h
call 00007F03D53D8028h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CDE4h]
mov dl, 01h
mov eax, 004072ECh
call 00007F03D53DC268h
mov dword ptr [0040CDE8h], eax
xor edx, edx
push ebp
push 0040A15Ch
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F03D53DE8E0h
mov dword ptr [0040CDF0h], eax
mov eax, dword ptr [0040CDF0h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F03D53DEA1Ah
mov eax, dword ptr [0040CDF0h]
mov edx, 00000028h
call 00007F03D53DC669h
mov edx, dword ptr [0040CDF0h]
cmp eax, dword ptr [edx+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x4e54	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2c33918	0x2040
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0x0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9244	0x9400	00d95da090f9b045cc52199c7b36d118	False	0.6099820523648649	data	6.529731839731562	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x24c	0x400	05e73e67429288e06500812b62979d5f	False	0.3076171875	data	2.734223999371757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe48	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8b4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x4e54	0x5000	73fb4b189ce5d3b8e15945f83109be21	False	0.271484375	data	5.681632784581054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x112f4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.21804979253112033
RT_ICON	0x1389c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.3126172607879925
RT_STRING	0x14944	0x2f2	data			0.35543766578249336
RT_STRING	0x14c38	0x30c	data			0.3871794871794872
RT_STRING	0x14f44	0x2ce	data			0.42618384401114207
RT_STRING	0x15214	0x68	data			0.75
RT_STRING	0x1527c	0xb4	data			0.6277777777777778
RT_STRING	0x15330	0xae	data			0.5344827586206896
RT_RCDATA	0x153e0	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x1540c	0x22	data	English	United States	0.9117647058823529
RT_VERSION	0x15430	0x4b8	COM executable for DOS	English	United States	0.2913907284768212
RT_MANIFEST	0x158e8	0x56b	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4268204758471521

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 10:16:11.461159945 CEST	49739	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:11.461215973 CEST	443	49739	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:11.461318016 CEST	49739	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:11.745263100 CEST	49739	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:11.745306015 CEST	443	49739	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.113243103 CEST	443	49739	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.113320112 CEST	49739	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.118526936 CEST	49739	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.118541002 CEST	443	49739	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.118937969 CEST	443	49739	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.119453907 CEST	49739	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.164115906 CEST	443	49739	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.397177935 CEST	443	49739	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.397427082 CEST	443	49739	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.397497892 CEST	49739	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.397923946 CEST	49739	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.397948027 CEST	443	49739	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.445632935 CEST	49740	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.445730925 CEST	443	49740	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.445821047 CEST	49740	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.446230888 CEST	49740	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.446264982 CEST	443	49740	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.682061911 CEST	443	49740	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.682172060 CEST	49740	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.685538054 CEST	49740	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.685576916 CEST	443	49740	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.685988903 CEST	443	49740	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.686299086 CEST	49740	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.732125044 CEST	443	49740	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.959904909 CEST	443	49740	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.960007906 CEST	443	49740	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:12.960478067 CEST	49740	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.960722923 CEST	49740	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:12.960758924 CEST	443	49740	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:13.038399935 CEST	49741	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:13.038436890 CEST	443	49741	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:13.038506031 CEST	49741	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:13.038866997 CEST	49741	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:13.038880110 CEST	443	49741	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:13.275716066 CEST	443	49741	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:13.275805950 CEST	49741	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:13.280807972 CEST	49741	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:13.280816078 CEST	443	49741	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:13.281622887 CEST	443	49741	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:13.282027960 CEST	49741	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:13.328115940 CEST	443	49741	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:13.549400091 CEST	443	49741	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:13.549576044 CEST	443	49741	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:13.549637079 CEST	49741	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:13.556217909 CEST	49741	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:13.556231022 CEST	443	49741	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:14.179986954 CEST	49742	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:14.180017948 CEST	443	49742	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:14.180114985 CEST	49742	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:15.299674034 CEST	49742	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:15.299706936 CEST	443	49742	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:15.541182995 CEST	443	49742	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:15.541273117 CEST	49742	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:15.542069912 CEST	49742	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:15.542083025 CEST	443	49742	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:15.542658091 CEST	443	49742	54.158.49.118	192.168.2.4
Apr 19, 2024 10:16:15.542726040 CEST	49742	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:16:15.543529034 CEST	49742	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:30.652823925 CEST	49745	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:30.652859926 CEST	443	49745	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:30.652923107 CEST	49745	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:30.653512955 CEST	49745	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:30.653527975 CEST	443	49745	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:30.891858101 CEST	443	49745	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:30.891928911 CEST	49745	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:30.897254944 CEST	49745	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.015388012 CEST	49746	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.015420914 CEST	443	49746	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.015490055 CEST	49746	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.015820026 CEST	49746	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.015836000 CEST	443	49746	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.250349998 CEST	443	49746	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.250418901 CEST	49746	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.253798962 CEST	49746	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.253806114 CEST	443	49746	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.254196882 CEST	443	49746	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.254527092 CEST	49746	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.300122976 CEST	443	49746	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.524629116 CEST	443	49746	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.524787903 CEST	443	49746	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.524863958 CEST	49746	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.524943113 CEST	49746	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.524962902 CEST	443	49746	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.532128096 CEST	49747	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.532171965 CEST	443	49747	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.532253027 CEST	49747	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.532473087 CEST	49747	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.532499075 CEST	443	49747	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.771410942 CEST	443	49747	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.771533966 CEST	49747	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.774456024 CEST	49747	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.774476051 CEST	443	49747	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.775559902 CEST	443	49747	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:41.775831938 CEST	49747	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:41.820116997 CEST	443	49747	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:42.048007965 CEST	443	49747	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:42.048122883 CEST	443	49747	54.158.49.118	192.168.2.4
Apr 19, 2024 10:17:42.048232079 CEST	49747	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:42.048233032 CEST	49747	443	192.168.2.4	54.158.49.118
Apr 19, 2024 10:17:42.048320055 CEST	49747	443	192.168.2.4	54.158.49.118

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 10:16:11.279510021 CEST	52570	53	192.168.2.4	1.1.1.1
Apr 19, 2024 10:16:11.385932922 CEST	53	52570	1.1.1.1	192.168.2.4
Apr 19, 2024 10:17:16.539390087 CEST	50758	53	192.168.2.4	1.1.1.1
Apr 19, 2024 10:17:16.645514011 CEST	53	50758	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 10:16:11.279510021 CEST	192.168.2.4	1.1.1.1	0x17f1	Standard query (0)	api.ezvizlife.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 10:17:16.539390087 CEST	192.168.2.4	1.1.1.1	0x806d	Standard query (0)	api.ezvizlife.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 10:16:11.385932922 CEST	1.1.1.1	192.168.2.4	0x17f1	No error (0)	api.ezvizlife.com	ezvizlife-portal-1078988341.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 10:16:11.385932922 CEST	1.1.1.1	192.168.2.4	0x17f1	No error (0)	ezvizlife-portal-1078988341.us-east-1.elb.amazonaws.com		54.158.49.118	A (IP address)	IN (0x0001)	false
Apr 19, 2024 10:16:11.385932922 CEST	1.1.1.1	192.168.2.4	0x17f1	No error (0)	ezvizlife-portal-1078988341.us-east-1.elb.amazonaws.com		54.175.206.249	A (IP address)	IN (0x0001)	false
Apr 19, 2024 10:17:16.645514011 CEST	1.1.1.1	192.168.2.4	0x806d	No error (0)	api.ezvizlife.com	ezvizlife-portal-1078988341.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 10:17:16.645514011 CEST	1.1.1.1	192.168.2.4	0x806d	No error (0)	ezvizlife-portal-1078988341.us-east-1.elb.amazonaws.com		54.158.49.118	A (IP address)	IN (0x0001)	false
Apr 19, 2024 10:17:16.645514011 CEST	1.1.1.1	192.168.2.4	0x806d	No error (0)	ezvizlife-portal-1078988341.us-east-1.elb.amazonaws.com		54.175.206.249	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ezvizlife.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	54.158.49.118	443	7884	C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 08:16:12 UTC	149	OUT	POST /api/other/version/check HTTP/1.1 Host: api.ezvizlife.com Accept: / Content-Length: 32 Content-Type: application/x-www-form-urlencoded
2024-04-19 08:16:12 UTC	32	OUT	Data Raw: 73 65 73 73 69 6f 6e 49 64 3d 26 63 6c 69 65 6e 74 54 79 70 65 3d 31 30 26 72 65 67 69 6f 6e 3d Data Ascii: sessionId=&clientType=10&region=
2024-04-19 08:16:12 UTC	159	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Date: Fri, 19 Apr 2024 08:16:12 GMT Server: Tengine Content-Length: 335 Connection: Close
2024-04-19 08:16:12 UTC	335	IN	Data Raw: 7b 22 72 65 73 75 6c 74 43 6f 64 65 22 3a 22 30 22 2c 22 76 65 72 73 69 6f 6e 52 65 73 70 22 3a 7b 22 6e 65 77 65 73 74 56 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 31 2e 31 37 22 2c 22 75 70 64 61 74 65 54 79 70 65 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 54 79 70 65 22 3a 32 2c 22 75 70 64 61 74 65 55 72 6c 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 55 72 6c 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 65 53 69 7a 65 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 53 69 7a 65 22 3a 6e 75 6c 6c 2c 22 63 68 61 6e 67 65 4c 6f 67 22 3a 6e 75 6c 6c 2c 22 6f 70 74 69 6f 6e 31 22 3a 22 46 43 42 33 31 36 41 35 41 32 37 43 42 34 31 32 35 46 46 32 38 44 36 46 43 36 38 33 37 45 45 38 22 2c 22 6f 70 74 69 6f 6e 32 22 3a 22 31 22 2c 22 6c 69 6d 69 74 56 65 72 73 69 6f 6e 22 3a 22 Data Ascii: {"resultCode":"0","versionResp":{"newestVersion":"1.0.1.17","updateType":null,"updataType":2,"updateUrl":null,"updataUrl":null,"updateSize":null,"updataSize":null,"changeLog":null,"option1":"FCB316A5A27CB4125FF28D6FC6837EE8","option2":"1","limitVersion":"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	54.158.49.118	443	7884	C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 08:16:12 UTC	149	OUT	POST /api/other/version/check HTTP/1.1 Host: api.ezvizlife.com Accept: / Content-Length: 31 Content-Type: application/x-www-form-urlencoded
2024-04-19 08:16:12 UTC	31	OUT	Data Raw: 73 65 73 73 69 6f 6e 49 64 3d 26 63 6c 69 65 6e 74 54 79 70 65 3d 39 26 72 65 67 69 6f 6e 3d Data Ascii: sessionId=&clientType=9&region=
2024-04-19 08:16:12 UTC	159	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Date: Fri, 19 Apr 2024 08:16:12 GMT Server: Tengine Content-Length: 424 Connection: Close
2024-04-19 08:16:12 UTC	424	IN	Data Raw: 7b 22 72 65 73 75 6c 74 43 6f 64 65 22 3a 22 30 22 2c 22 76 65 72 73 69 6f 6e 52 65 73 70 22 3a 7b 22 6e 65 77 65 73 74 56 65 72 73 69 6f 6e 22 3a 22 32 2e 33 2e 30 2e 30 22 2c 22 75 70 64 61 74 65 54 79 70 65 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 54 79 70 65 22 3a 32 2c 22 75 70 64 61 74 65 55 72 6c 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 55 72 6c 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 65 53 69 7a 65 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 53 69 7a 65 22 3a 6e 75 6c 6c 2c 22 63 68 61 6e 67 65 4c 6f 67 22 3a 6e 75 6c 6c 2c 22 6f 70 74 69 6f 6e 31 22 3a 22 31 43 33 30 36 39 33 31 31 43 43 36 34 38 44 36 36 34 46 39 33 32 35 43 44 43 42 46 33 46 44 45 22 2c 22 6f 70 74 69 6f 6e 32 22 3a 22 32 22 2c 22 6c 69 6d 69 74 56 65 72 73 69 6f 6e 22 3a 22 31 Data Ascii: {"resultCode":"0","versionResp":{"newestVersion":"2.3.0.0","updateType":null,"updataType":2,"updateUrl":null,"updataUrl":null,"updateSize":null,"updataSize":null,"changeLog":null,"option1":"1C3069311CC648D664F9325CDCBF3FDE","option2":"2","limitVersion":"1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	54.158.49.118	443	7884	C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 08:16:13 UTC	149	OUT	POST /api/other/version/check HTTP/1.1 Host: api.ezvizlife.com Accept: / Content-Length: 32 Content-Type: application/x-www-form-urlencoded
2024-04-19 08:16:13 UTC	32	OUT	Data Raw: 73 65 73 73 69 6f 6e 49 64 3d 26 63 6c 69 65 6e 74 54 79 70 65 3d 31 30 26 72 65 67 69 6f 6e 3d Data Ascii: sessionId=&clientType=10&region=
2024-04-19 08:16:13 UTC	159	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Date: Fri, 19 Apr 2024 08:16:13 GMT Server: Tengine Content-Length: 335 Connection: Close
2024-04-19 08:16:13 UTC	335	IN	Data Raw: 7b 22 72 65 73 75 6c 74 43 6f 64 65 22 3a 22 30 22 2c 22 76 65 72 73 69 6f 6e 52 65 73 70 22 3a 7b 22 6e 65 77 65 73 74 56 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 31 2e 31 37 22 2c 22 75 70 64 61 74 65 54 79 70 65 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 54 79 70 65 22 3a 32 2c 22 75 70 64 61 74 65 55 72 6c 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 55 72 6c 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 65 53 69 7a 65 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 53 69 7a 65 22 3a 6e 75 6c 6c 2c 22 63 68 61 6e 67 65 4c 6f 67 22 3a 6e 75 6c 6c 2c 22 6f 70 74 69 6f 6e 31 22 3a 22 46 43 42 33 31 36 41 35 41 32 37 43 42 34 31 32 35 46 46 32 38 44 36 46 43 36 38 33 37 45 45 38 22 2c 22 6f 70 74 69 6f 6e 32 22 3a 22 31 22 2c 22 6c 69 6d 69 74 56 65 72 73 69 6f 6e 22 3a 22 Data Ascii: {"resultCode":"0","versionResp":{"newestVersion":"1.0.1.17","updateType":null,"updataType":2,"updateUrl":null,"updataUrl":null,"updateSize":null,"updataSize":null,"changeLog":null,"option1":"FCB316A5A27CB4125FF28D6FC6837EE8","option2":"1","limitVersion":"

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49746	54.158.49.118	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 08:17:41 UTC	149	OUT	POST /api/other/version/check HTTP/1.1 Host: api.ezvizlife.com Accept: / Content-Length: 31 Content-Type: application/x-www-form-urlencoded
2024-04-19 08:17:41 UTC	31	OUT	Data Raw: 73 65 73 73 69 6f 6e 49 64 3d 26 63 6c 69 65 6e 74 54 79 70 65 3d 39 26 72 65 67 69 6f 6e 3d Data Ascii: sessionId=&clientType=9&region=
2024-04-19 08:17:41 UTC	159	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Date: Fri, 19 Apr 2024 08:17:41 GMT Server: Tengine Content-Length: 424 Connection: Close
2024-04-19 08:17:41 UTC	424	IN	Data Raw: 7b 22 72 65 73 75 6c 74 43 6f 64 65 22 3a 22 30 22 2c 22 76 65 72 73 69 6f 6e 52 65 73 70 22 3a 7b 22 6e 65 77 65 73 74 56 65 72 73 69 6f 6e 22 3a 22 32 2e 33 2e 30 2e 30 22 2c 22 75 70 64 61 74 65 54 79 70 65 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 54 79 70 65 22 3a 32 2c 22 75 70 64 61 74 65 55 72 6c 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 55 72 6c 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 65 53 69 7a 65 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 53 69 7a 65 22 3a 6e 75 6c 6c 2c 22 63 68 61 6e 67 65 4c 6f 67 22 3a 6e 75 6c 6c 2c 22 6f 70 74 69 6f 6e 31 22 3a 22 31 43 33 30 36 39 33 31 31 43 43 36 34 38 44 36 36 34 46 39 33 32 35 43 44 43 42 46 33 46 44 45 22 2c 22 6f 70 74 69 6f 6e 32 22 3a 22 32 22 2c 22 6c 69 6d 69 74 56 65 72 73 69 6f 6e 22 3a 22 31 Data Ascii: {"resultCode":"0","versionResp":{"newestVersion":"2.3.0.0","updateType":null,"updataType":2,"updateUrl":null,"updataUrl":null,"updateSize":null,"updataSize":null,"changeLog":null,"option1":"1C3069311CC648D664F9325CDCBF3FDE","option2":"2","limitVersion":"1

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49747	54.158.49.118	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 08:17:41 UTC	149	OUT	POST /api/other/version/check HTTP/1.1 Host: api.ezvizlife.com Accept: / Content-Length: 32 Content-Type: application/x-www-form-urlencoded
2024-04-19 08:17:41 UTC	32	OUT	Data Raw: 73 65 73 73 69 6f 6e 49 64 3d 26 63 6c 69 65 6e 74 54 79 70 65 3d 31 30 26 72 65 67 69 6f 6e 3d Data Ascii: sessionId=&clientType=10&region=
2024-04-19 08:17:42 UTC	159	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Date: Fri, 19 Apr 2024 08:17:41 GMT Server: Tengine Content-Length: 335 Connection: Close
2024-04-19 08:17:42 UTC	335	IN	Data Raw: 7b 22 72 65 73 75 6c 74 43 6f 64 65 22 3a 22 30 22 2c 22 76 65 72 73 69 6f 6e 52 65 73 70 22 3a 7b 22 6e 65 77 65 73 74 56 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 31 2e 31 37 22 2c 22 75 70 64 61 74 65 54 79 70 65 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 54 79 70 65 22 3a 32 2c 22 75 70 64 61 74 65 55 72 6c 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 55 72 6c 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 65 53 69 7a 65 22 3a 6e 75 6c 6c 2c 22 75 70 64 61 74 61 53 69 7a 65 22 3a 6e 75 6c 6c 2c 22 63 68 61 6e 67 65 4c 6f 67 22 3a 6e 75 6c 6c 2c 22 6f 70 74 69 6f 6e 31 22 3a 22 46 43 42 33 31 36 41 35 41 32 37 43 42 34 31 32 35 46 46 32 38 44 36 46 43 36 38 33 37 45 45 38 22 2c 22 6f 70 74 69 6f 6e 32 22 3a 22 31 22 2c 22 6c 69 6d 69 74 56 65 72 73 69 6f 6e 22 3a 22 Data Ascii: {"resultCode":"0","versionResp":{"newestVersion":"1.0.1.17","updateType":null,"updataType":2,"updateUrl":null,"updataUrl":null,"updateSize":null,"updataSize":null,"changeLog":null,"option1":"FCB316A5A27CB4125FF28D6FC6837EE8","option2":"1","limitVersion":"

Target ID:	0
Start time:	10:15:34
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\EzvizStudioSetups.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\EzvizStudioSetups.exe"
Imagebase:	0x400000
File size:	46'356'824 bytes
MD5 hash:	1C3069311CC648D664F9325CDCBF3FDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:15:34
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-8UC5Q.tmp\EzvizStudioSetups.tmp" /SL5="$2047E,46096349,63488,C:\Users\user\Desktop\EzvizStudioSetups.exe"
Imagebase:	0x400000
File size:	706'048 bytes
MD5 hash:	3A19CEEF46D5B5A68F039F505AFB5407
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:16:03
Start date:	19/04/2024
Path:	C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe" /q
Imagebase:	0x9b0000
File size:	69'960 bytes
MD5 hash:	191F9AAA1C9DC443D70096D556C046BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:16:05
Start date:	19/04/2024
Path:	C:\Program Files (x86)\Ezviz Studio\update_server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Ezviz Studio\update_server.exe" /VERYSILENT
Imagebase:	0x400000
File size:	2'617'544 bytes
MD5 hash:	21658E7290EAEB93D83403D2E5B5F458
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:16:05
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-LVOEO.tmp\update_server.tmp" /SL5="$104C2,2352971,53760,C:\Program Files (x86)\Ezviz Studio\update_server.exe" /VERYSILENT
Imagebase:	0x7ff7bb700000
File size:	696'320 bytes
MD5 hash:	9D321C7096F4BCAEB6F3D8D1636E1744
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:16:09
Start date:	19/04/2024
Path:	C:\Program Files (x86)\hicloud\update_server\ModProperties.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hicloud\update_server\ModProperties.exe" update_server
Imagebase:	0xae0000
File size:	18'416 bytes
MD5 hash:	B614020DF9D482886A5345B7A3A5F0E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:16:09
Start date:	19/04/2024
Path:	C:\Program Files (x86)\hicloud\update_server\startUp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hicloud\update_server\startUp.exe"
Imagebase:	0x210000
File size:	14'832 bytes
MD5 hash:	0F5FF2EEF7CCB672743BBA3A881A3A56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	10:16:10
Start date:	19/04/2024
Path:	C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe"
Imagebase:	0xc50000
File size:	17'392 bytes
MD5 hash:	5863EBA0EB8924542F5BD5658371ACB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	10:16:11
Start date:	19/04/2024
Path:	C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Ezviz Studio\EzvizStudio.exe"
Imagebase:	0xf30000
File size:	4'524'608 bytes
MD5 hash:	FD309D34FEDEE887AE36EC54730C89CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:16:19
Start date:	19/04/2024
Path:	C:\Program Files (x86)\hicloud\update_server\startUp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hicloud\update_server\startUp.exe"
Imagebase:	0x210000
File size:	14'832 bytes
MD5 hash:	0F5FF2EEF7CCB672743BBA3A881A3A56
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	22.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	1502
Total number of Limit Nodes:	28

Executed Functions

Function 00409A14 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409A26
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409A31
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409A72
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409AA4
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409AB4

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: c2769086b94dacb7810d1409196c7497058a42c32b70979fc979e51038c0ff67
Instruction ID: 05782b2e5a8588c9c74d05110837466633af9a4b7a19298b20ab433fd050a55e
Opcode Fuzzy Hash: c2769086b94dacb7810d1409196c7497058a42c32b70979fc979e51038c0ff67
Instruction Fuzzy Hash: D0216FB13003846BD6309A698C85E67B7DC9F85360F18492AFA85E62C3D73DED40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040515C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction ID: b78bf48cff894a3999656c5243e329942f020ab22272e2e872fdbeeaebf0035e
Opcode Fuzzy Hash: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction Fuzzy Hash: EDE09271B0021426D711A9699C86AEB735DDB58310F0006BFB904EB3C6EDB49E8046ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409FB4 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A010
SetWindowLongA.USER32(0002047E,000000FC,004097FC), ref: 0040A027

Part of subcall function 00406ADC: GetCommandLineA.KERNEL32(00000000,00406B20,?,?,?,?,00000000,?,0040A098,?), ref: 00406AF4

Part of subcall function 00409888: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,022B0240,00409974,00000000,0040995B), ref: 004098F8
Part of subcall function 00409888: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,022B0240,00409974,00000000), ref: 0040990C
Part of subcall function 00409888: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
Part of subcall function 00409888: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
Part of subcall function 00409888: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,022B0240,00409974), ref: 00409940

RemoveDirectoryA.KERNEL32(00000000,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A113
73A25CF0.USER32(0002047E,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A127

Strings

SA, xrefs: 0040A041, 0040A050
InnoSetupLdrWindow, xrefs: 0040A004
STATIC, xrefs: 0040A009
/SL5="$%x,%d,%d,, xrefs: 0040A067

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC$SA
API String ID: 978128352-2103023539
Opcode ID: f35d8c1ce23740e5e47570a4a7ea1aa6b0c7a4e1336b706dbfad7c34b6de0a74
Instruction ID: 994b03bd5abc72cbe06dd2c14f0861f5fc0fad0f3ad24bd21fe84be6bde737e4
Opcode Fuzzy Hash: f35d8c1ce23740e5e47570a4a7ea1aa6b0c7a4e1336b706dbfad7c34b6de0a74
Instruction Fuzzy Hash: 57411A70A00205DFD715EBA9EE86B9A7BA5EB84304F10427BF510B73E2DB789801DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409FD8 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409460: GetLastError.KERNEL32(00000000,00409503,?,0040B240,?,022B0240), ref: 00409484

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A010
SetWindowLongA.USER32(0002047E,000000FC,004097FC), ref: 0040A027

Part of subcall function 00406ADC: GetCommandLineA.KERNEL32(00000000,00406B20,?,?,?,?,00000000,?,0040A098,?), ref: 00406AF4

Part of subcall function 00409888: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,022B0240,00409974,00000000,0040995B), ref: 004098F8
Part of subcall function 00409888: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,022B0240,00409974,00000000), ref: 0040990C
Part of subcall function 00409888: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
Part of subcall function 00409888: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
Part of subcall function 00409888: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,022B0240,00409974), ref: 00409940

RemoveDirectoryA.KERNEL32(00000000,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A113
73A25CF0.USER32(0002047E,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A127

Strings

SA, xrefs: 0040A041, 0040A050
InnoSetupLdrWindow, xrefs: 0040A004
STATIC, xrefs: 0040A009
/SL5="$%x,%d,%d,, xrefs: 0040A067

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryErrorExitLastLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC$SA
API String ID: 240127915-2103023539
Opcode ID: 41e9b17cc1901837085009e7774581f9f675215498936b1d5fec870b95540319
Instruction ID: cbbd3698a6e5ddb8e812fa6c760aedb007618753dcf5685e5a94b93d1743052f
Opcode Fuzzy Hash: 41e9b17cc1901837085009e7774581f9f675215498936b1d5fec870b95540319
Instruction Fuzzy Hash: 04412B70A00205DBC715EBA9EE86B9E3BA5EB84304F10427BF510B73E2DB789801DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00408FC8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00409061,?,?,?,?,00000000,?,00409B53), ref: 00408FE8
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408FEE
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,Wow64DisableWow64FsRedirection,00000000,00409061,?,?,?,?,00000000,?,00409B53), ref: 00409002
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00409008

Strings

shell32.dll, xrefs: 00409034
Wow64RevertWow64FsRedirection, xrefs: 00408FF8
kernel32.dll, xrefs: 00408FE3, 00408FFD
Wow64DisableWow64FsRedirection, xrefs: 00408FDE

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 17e7db4c528402608d9f53e260f8b79ce616995abb8d95c1af2dd02ed3ed6c5c
Instruction ID: 9fcc65c531327f2d7efb14c601a25e4e420c6304718e48176e9e04a6a3b299d5
Opcode Fuzzy Hash: 17e7db4c528402608d9f53e260f8b79ce616995abb8d95c1af2dd02ed3ed6c5c
Instruction Fuzzy Hash: 6701DF70208300AEEB10AB76DC47B563AA8E782714F60843BF504B22C3CA7C5C44CA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00409888 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,022B0240,00409974,00000000,0040995B), ref: 004098F8
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,022B0240,00409974,00000000), ref: 0040990C
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,022B0240,00409974), ref: 00409940

Part of subcall function 00409460: GetLastError.KERNEL32(00000000,00409503,?,0040B240,?,022B0240), ref: 00409484

Strings

D, xrefs: 004098D2

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 3e364823df46f41b243604843b678d585e88c5cad38ef85377b023b87dae9783
Instruction ID: 0c6d97fba1df7b16fba7b9ed0c132cba9133a3324ac8f072eb64155fee6ae1b7
Opcode Fuzzy Hash: 3e364823df46f41b243604843b678d585e88c5cad38ef85377b023b87dae9783
Instruction Fuzzy Hash: AC1130B16142086EDB10FBE68C52F9EBBACEF49718F50013EB614F62C7DA785D048669

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00409D26 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409D8A

Strings

SA, xrefs: 00409E09, 00409E5B, 00409E77, 00409EBF
$u@, xrefs: 00409E3E
.tmp, xrefs: 00409DD0

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Message
String ID: $u@$.tmp$SA
API String ID: 2030045667-3518010877
Opcode ID: 76a7687ccf1c1f3f155fed8792e4b2e0c469f7c74cc7371f2538726c547644a2
Instruction ID: fbeaf51a7290a35b1d20cf1acd7fffd14229a7cea4ec7fe779b7d8bf1d8f9ef0
Opcode Fuzzy Hash: 76a7687ccf1c1f3f155fed8792e4b2e0c469f7c74cc7371f2538726c547644a2
Instruction Fuzzy Hash: 7041A170604201DFD311EF19DE92A5A7BA6FB49304B11453AF801B73E2CB79AC01DAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00409D41 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409D8A

Strings

SA, xrefs: 00409E09, 00409E5B, 00409E77, 00409EBF
$u@, xrefs: 00409E3E
.tmp, xrefs: 00409DD0

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Message
String ID: $u@$.tmp$SA
API String ID: 2030045667-3518010877
Opcode ID: 4be92c8e37dddd0a3a50cfadddd3e7ce3c10b6794e32ae209eae1f209508f25f
Instruction ID: 7aabf0afbc79ebbbc3d3aa4d6af75c8ddef5afe13af9357e4f9bebdf666c2db7
Opcode Fuzzy Hash: 4be92c8e37dddd0a3a50cfadddd3e7ce3c10b6794e32ae209eae1f209508f25f
Instruction Fuzzy Hash: 66418070600201DFC711EF69DE92A5A7BB6FB49304B11457AF801B73E2CB79AC01DAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Uniqueness

Uniqueness Score: -1.00%

Function 00409254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00409343,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040929A
GetLastError.KERNEL32(00000000,00000000,?,00000000,00409343,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004092A3

Strings

.tmp, xrefs: 00409283

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 7647810fba1c1a7df54c129ecd6d2966c744d5805a6f131b99297333171aebfe
Instruction ID: 381de743b5e558d6c5ac88c9815bc56a2e764fefa580558ac3af8d983805238d
Opcode Fuzzy Hash: 7647810fba1c1a7df54c129ecd6d2966c744d5805a6f131b99297333171aebfe
Instruction Fuzzy Hash: 3C214975A002089BDB01EFE1C9429DEB7B9EB48304F10457BE901B73C2DA7CAF058AA5

Uniqueness

Uniqueness Score: -1.00%

Function 004093FC Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040941B
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040942B
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040943E
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 00409448

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: fb2155ff6e4859bec8591c3fde2b363a3ebb44483e144ae34e4cc697df15f474
Instruction ID: 2c3041558bff2c9731999a3fdaa5bf7f611e1c5313eca5e15d372d414c244bd5
Opcode Fuzzy Hash: fb2155ff6e4859bec8591c3fde2b363a3ebb44483e144ae34e4cc697df15f474
Instruction Fuzzy Hash: 32F0B472A0811457CB34B5EF9981A6F638DEAD1368751813BF904F3383D578CD0392AD

Uniqueness

Uniqueness Score: -1.00%

Function 00408EE0 Relevance: 3.0, APIs: 2, Instructions: 42
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(00000000,00000000,00408F3D,?,0000000D,00000000), ref: 00408F17
GetLastError.KERNEL32(00000000,00000000,00408F3D,?,0000000D,00000000), ref: 00408F1F

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 3b1a080efc38f6a00fe619da50c0df6cd471c35a4e7d9ee13917e5cf65062608
Instruction ID: 347d5d3a4f376e63cbb9019fe75b0976320091a2070a9b9a83531334af51675b
Opcode Fuzzy Hash: 3b1a080efc38f6a00fe619da50c0df6cd471c35a4e7d9ee13917e5cf65062608
Instruction Fuzzy Hash: A3F0C271A04708AFCB01EFB69D4189EB3E8EB88314B5045BBF854F33C2EA395E009598

Uniqueness

Uniqueness Score: -1.00%

Function 0040A161 Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveDirectoryA.KERNEL32(00000000,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A113
73A25CF0.USER32(0002047E,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A127

Part of subcall function 004093FC: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040941B
Part of subcall function 004093FC: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040943E
Part of subcall function 004093FC: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 00409448

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast$DirectoryRemoveSleep
String ID:
API String ID: 936953547-0
Opcode ID: 6aaed9f502bdba01af7e6ebabe6af313ac24c77e8368f813f0c0da7e185410e5
Instruction ID: 3fa009acc415daa351a55d2b5950970e0f8674877f0f6eafd0212b86f5367797
Opcode Fuzzy Hash: 6aaed9f502bdba01af7e6ebabe6af313ac24c77e8368f813f0c0da7e185410e5
Instruction Fuzzy Hash: 89F0F470641201DBD725EB69EED9B1537A5EF84305F00413BA101BB6F1CB7C9891EB4E

Uniqueness

Uniqueness Score: -1.00%

Function 00406F00 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406F0A
LoadLibraryA.KERNEL32(00000000,00000000,00406F54,?,00000000,00406F72,?,00008000), ref: 00406F39

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 280b78466cfb49ac5d1a4d8de4e82968344a77d2278ba686a31885ea79f0a63b
Instruction ID: 61c75ae37e4b7eabf140846b9e9d3e90831ba1beb5fed57b889ca027c52d2016
Opcode Fuzzy Hash: 280b78466cfb49ac5d1a4d8de4e82968344a77d2278ba686a31885ea79f0a63b
Instruction Fuzzy Hash: 49F08270614704BEDB029FB69C6282BBBFCE749B0475348B6F904A26D2E53C5D208568

Uniqueness

Uniqueness Score: -1.00%

Function 004075CC Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 004075EB
GetLastError.KERNEL32(?,?,?,00000000), ref: 004075F3

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,022A03AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 4b4e93de333a3cce642c2996d73c93b1535ff8d1f0695df8178d397978e57373
Instruction ID: cda5b13584bb414d1d7c0d7cef5a43535e1b929ad68122291bf656bee98e9d77
Opcode Fuzzy Hash: 4b4e93de333a3cce642c2996d73c93b1535ff8d1f0695df8178d397978e57373
Instruction Fuzzy Hash: A0E092766081016FD601D55EC881B9B33DCDFC5365F00453ABA54EB2D1D675AC0087B6

Uniqueness

Uniqueness Score: -1.00%

Function 0040758C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 004075A3
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 004075B2

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 60e63bc2ff5526e1bd28c8a7098a19329bed0093cf160d1b5924f83231400461
Instruction ID: 6d0e635579d8ef6deec62af0acb898b5effba2491802df9b0589d4017bc118ea
Opcode Fuzzy Hash: 60e63bc2ff5526e1bd28c8a7098a19329bed0093cf160d1b5924f83231400461
Instruction Fuzzy Hash: 4FE012B1A181147AEB24965A9CC5FAB6BDCCBC5314F14847BF904DB282D678DC04877B

Uniqueness

Uniqueness Score: -1.00%

Function 00407524 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 0040753B
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 00407547

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,022A03AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 0dd762855ce75d8d861d21fe55c1929f9bb0fd02210f0b496c114b023f039fab
Instruction ID: cd7afd6369a15af5fc7b0f7528e30ca6696358c0ea2e6c45e94f6e0b4d50a73a
Opcode Fuzzy Hash: 0dd762855ce75d8d861d21fe55c1929f9bb0fd02210f0b496c114b023f039fab
Instruction Fuzzy Hash: 0EE04FB1600210AFEB10EEB98C81B9672DC9F48364F048576EA14DF2C6D274DC00C766

Uniqueness

Uniqueness Score: -1.00%

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Uniqueness

Uniqueness Score: -1.00%

Function 004051D0 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405306), ref: 004051EF

Part of subcall function 00404C2C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404C49

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction ID: c760dbbb10683706500036a577470844d35ac6ab0c013c9c95042e4326961867
Opcode Fuzzy Hash: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction Fuzzy Hash: 3B313D75E00119ABCB00EF95C8C19EEB779FF84304F158977E815BB285E739AE058B98

Uniqueness

Uniqueness Score: -1.00%

Function 004074D6 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407518

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce86d0b46b6749cbb1c8065cdd94f6338fa023cacd1506a2c152e65e14b54ccf
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: ce86d0b46b6749cbb1c8065cdd94f6338fa023cacd1506a2c152e65e14b54ccf
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004074D8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407518

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5c7f1f50133f8918f9d70925a1da877e635501982028b62cfe689d085d452769
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 5c7f1f50133f8918f9d70925a1da877e635501982028b62cfe689d085d452769
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040693C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406984,?,?,?,?,00000000,?,00406999,00406CC7,00000000,00406D0C,?,?,?), ref: 00406967

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 53f9965764e037d0eade91fd77cfc00c47722664131d9e88e47f7f2d0abdeb71
Instruction ID: a5d31a369ac9c1460ce21b6bb4ed2cb839aeaeb50f5f76e03c39097c5263300d
Opcode Fuzzy Hash: 53f9965764e037d0eade91fd77cfc00c47722664131d9e88e47f7f2d0abdeb71
Instruction Fuzzy Hash: A9E065712043047FD701EA629C52959B7ACDB89708B924476B501A6682D5785E108568

Uniqueness

Uniqueness Score: -1.00%

Function 00407628 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040763F

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,022A03AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 2449abf237b154253dcf2b231e0da589e0eb2b5517b9a23d8c49629d5bbf5411
Instruction ID: 68b513bd5595dc6b38f1d245c0222f257f742b1e6f06676187839ef0e6677733
Opcode Fuzzy Hash: 2449abf237b154253dcf2b231e0da589e0eb2b5517b9a23d8c49629d5bbf5411
Instruction Fuzzy Hash: 93E01A727081106BEB10E65EDCC0EABA7DCDFC5764F04547BBA08EB291D674AC049676

Uniqueness

Uniqueness Score: -1.00%

Function 004071E4 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0040904B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,Wow64DisableWow64FsRedirection,00000000,00409061), ref: 00407203

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 606059c89ae6d8e8cf07aa2f3a49422b1cb7a18355834490beef1a35ac41266b
Instruction ID: 095b59eb22c1ada42cfe979e419102ec0d22498c88dfceb067fba30b4837873c
Opcode Fuzzy Hash: 606059c89ae6d8e8cf07aa2f3a49422b1cb7a18355834490beef1a35ac41266b
Instruction Fuzzy Hash: 8DE0D8A0B8830125F22514544C87B77110E53C0700F50847EB710ED3D3D6BEA90641AF

Uniqueness

Uniqueness Score: -1.00%

Function 0040760C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,022B8000,00409F6B,00000000), ref: 00407613

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,022A03AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 2ff8edb08080e924c2b395f282aa3d8258573adb5ced5672aaac345b41159427
Instruction ID: 5d9383f6f08d3e81a9fa52c4aba0b6319cc61be016c813106cdb36ce464f185a
Opcode Fuzzy Hash: 2ff8edb08080e924c2b395f282aa3d8258573adb5ced5672aaac345b41159427
Instruction Fuzzy Hash: 39C04CB1A0450047DB40A6BE99C1A0662DC5A483157045576BA08DB297D679E8009665

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406F79), ref: 00406F6C

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b3342c3bee8ef6d4bfebdffece25c86b3cab89117035339c57c774ddff03cb9f
Instruction ID: 754ecbd0d3eeca534395493226652c0236480d823d7569c9efe771d01927bad3
Opcode Fuzzy Hash: b3342c3bee8ef6d4bfebdffece25c86b3cab89117035339c57c774ddff03cb9f
Instruction Fuzzy Hash: 97B09B7661C2015DE705D6D5745193863F4D7C47103A1457BF104D25C0D57CD4144518

Uniqueness

Uniqueness Score: -1.00%

Function 00406F77 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406F79), ref: 00406F6C

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8c0feaa3b8caa60bdda2d34a80aa64328f40d718bb3766066fe9d436f42a4d4e
Instruction ID: 7c61e226393e4972c06343dd54fa3db727d2c771c967085a02b7622724de7152
Opcode Fuzzy Hash: 8c0feaa3b8caa60bdda2d34a80aa64328f40d718bb3766066fe9d436f42a4d4e
Instruction Fuzzy Hash: BAA022A8C00002B2CE00E2F08080A3C23282A8C3003C00AAA322EB20C0C03CC000822A

Uniqueness

Uniqueness Score: -1.00%

Function 004068D0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,004068CC,?,004065A9,?,?,00406CE7,00000000,00406D0C,?,?,?,?,00000000,00000000), ref: 004068D2

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 17375083e06acd4281245791c958798094bb343357575ce1856f87173c3dc77f
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 17375083e06acd4281245791c958798094bb343357575ce1856f87173c3dc77f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00407DFC Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407E8C

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173b8e8880a2d8bc8916495ece18949fbab6e5abf9cd9f38168eb99c200b7a3e
Instruction ID: 2791b199587b26d82634b85145401aad68464bde91e43c5b6ac1b5c6de7462a2
Opcode Fuzzy Hash: 173b8e8880a2d8bc8916495ece18949fbab6e5abf9cd9f38168eb99c200b7a3e
Instruction Fuzzy Hash: 7A1172716042449BDB00EE19C881B5B3794AF84359F1484BAF958AB2C6DB38EC04CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Uniqueness

Uniqueness Score: -1.00%

Function 004074A8 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 004074B8

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e9d4eabf3352258034a438adb9f93a7799ac96b59790047b66948ab7235a5e89
Instruction ID: 0172511661962fd54a17c381567595eb1d39a1afdb2a9088c563811225ee2893
Opcode Fuzzy Hash: e9d4eabf3352258034a438adb9f93a7799ac96b59790047b66948ab7235a5e89
Instruction Fuzzy Hash: FDD05E81B00A6017D215E2BE498864696C85F88745B08847AFA84E73D1D67CAC008399

Uniqueness

Uniqueness Score: -1.00%

Function 00407DA4 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E82), ref: 00407DBB

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5b9bfc86dfec920811477731d59a81a0154f8da7388717baf7e2e0d063c75e3e
Instruction ID: 99ab645fda39969175de1cb99313e8e2edaeef7f3c7532f72142fb74a6686f70
Opcode Fuzzy Hash: 5b9bfc86dfec920811477731d59a81a0154f8da7388717baf7e2e0d063c75e3e
Instruction Fuzzy Hash: 0AD0E9B17553055BDB90EEB95CC5B123BD87B48601F5044B66904EB29AE674E8109614

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040936C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040937B
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00409381
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0040939A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004093C1
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004093C6
ExitWindowsEx.USER32(00000002,00000000), ref: 004093D7

Strings

SeShutdownPrivilege, xrefs: 00409393

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 2b7c2d1c4f590a8974f253569f8503172d2d606641626e35aa9b2bf4c08caf06
Instruction ID: 611fb1cec5075bd7f6e538fe0f9c98e62950726bb4ce6d0bef13c3fa82a74cfd
Opcode Fuzzy Hash: 2b7c2d1c4f590a8974f253569f8503172d2d606641626e35aa9b2bf4c08caf06
Instruction Fuzzy Hash: 95F0627068430276E610A6718C47F67228C5B88B08F50483ABE51FA1C3D7BCCC044A6F

Uniqueness

Uniqueness Score: -1.00%

Function 00409AD0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409ADA
SizeofResource.KERNEL32(00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 00409AED
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4,?,00000000), ref: 00409AFF
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4), ref: 00409B10

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 400a5822642c04a340576dade1617737d9942a0be047b9803f81a1d9eeffe18d
Instruction ID: bd400d834a0aeaf6767d0a45abc69bca8fb82328816d2df24890c915d48f9c17
Opcode Fuzzy Hash: 400a5822642c04a340576dade1617737d9942a0be047b9803f81a1d9eeffe18d
Instruction Fuzzy Hash: 87E05AD035434625EA6036E718D2B2B62085FA471DF00013FBB00792D3DDBC8C04452E

Uniqueness

Uniqueness Score: -1.00%

Function 004051A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction ID: dec8dcb9893e8432c944e1b70884c8cc40709e939aac0c2d0d2241257bb7fc31
Opcode Fuzzy Hash: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction Fuzzy Hash: D3D05EB631E6502AE210519B2D85EBB4EACCAC57A4F14443BF648DB242D2248C069776

Uniqueness

Uniqueness Score: -1.00%

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Uniqueness

Uniqueness Score: -1.00%

Function 00405C44 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00406540,00000000,0040654E,?,?,?,?,?,00409B44), ref: 00405C52

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: b3c8fce3f516c1eeee7654ac00498b0e6f5204205adccd6d1250d5bfc2945711
Instruction ID: 6a84e84a5bdb2c7c5b206d002f2a3fc227ad50a79849cf1aa773f1ea3c1cbc6a
Opcode Fuzzy Hash: b3c8fce3f516c1eeee7654ac00498b0e6f5204205adccd6d1250d5bfc2945711
Instruction Fuzzy Hash: 5AC0126040470186E7109B319C42B1672D4A744310F4805396DA4953C2E73C81018A5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408330 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: 956cfbd081f07b2254a6d3089f19d76ceb57970edf417c817245e325156cd300
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: 4432E875E04219DFCB14CF99CA80AADB7B2BF88314F24816AD845B7385DB34AE42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00406F84 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00406FAD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00406FB3
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00407001

Strings

Locale, xrefs: 00406FF0
Control Panel\Desktop\ResourceLocale, xrefs: 00407010
GetUserDefaultUILanguage, xrefs: 00406FA3
kernel32.dll, xrefs: 00406FA8
.DEFAULT\Control Panel\International, xrefs: 00406FD8

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 60a9e4a616bde9d3650d5374f7b0e792bef98a6345d6610fa7bc99ac1ec5f133
Instruction ID: 4848c3cc747176469ce0ef08a48ea257d9f62360c4c8e5a9f2e1a14c28c6fa3b
Opcode Fuzzy Hash: 60a9e4a616bde9d3650d5374f7b0e792bef98a6345d6610fa7bc99ac1ec5f133
Instruction Fuzzy Hash: C3217370E04209ABDB10EBB5CD51B9F77A8EB44304F60857BA500F72C1DB7CAA05879E

Uniqueness

Uniqueness Score: -1.00%

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405314 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040555C,?,?,?,?,00000000,00000000,00000000,?,0040653B,00000000,0040654E), ref: 0040532E

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Part of subcall function 004051A8: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Strings

AMPM, xrefs: 004054F9
:mm:ss, xrefs: 0040552A
m/d/yy, xrefs: 004053FD
:mm, xrefs: 00405510
mmmm d, yyyy, xrefs: 0040541F

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction ID: f22f4b18e1885e1925b87b286fa486de3d96a381b4aec2b7527aff107c54c5fa
Opcode Fuzzy Hash: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction Fuzzy Hash: 8E514234B00648ABDB00EBA59C91B9F776ADB89304F50957BB514BB3C6CA3DCA058B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: e5c78b39f57021be2b84baee447ab27339ef0409ceaef8bd5dd3a85dcd2f6a98
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: e5c78b39f57021be2b84baee447ab27339ef0409ceaef8bd5dd3a85dcd2f6a98
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409B3A), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409B3A), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2127235850.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2127201817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127260052.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127283068.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: EzvizStudioSetups.tmpPID: 7428, Parent PID: 7400COMMON

Execution Graph

Execution Coverage:	18.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	88

Executed Functions

Function 00488444 Relevance: 136.6, APIs: 22, Strings: 55, Instructions: 1871COMMON

Download Yara Rule

Strings

GETINIBOOL, xrefs: 0048862F
FILEEXISTS, xrefs: 0048848B
REGQUERYDWORDVALUE, xrefs: 00489251
SETINIINT, xrefs: 004887AD
REGDELETEKEYIFEMPTY, xrefs: 00488EF3
REGQUERYBINARYVALUE, xrefs: 0048932E
SETINISTRING, xrefs: 0048873E
GETWINDIR, xrefs: 00488B16
FILEORDIREXISTS, xrefs: 004884FD
REGWRITESTRINGVALUE, xrefs: 0048944D
REGDELETEKEYINCLUDINGSUBKEYS, xrefs: 00488E98
GETCMDTAIL, xrefs: 00488943
ADDBACKSLASH, xrefs: 004889C1
STRINGCHANGEEX, xrefs: 00488C1D
REMOVEQUOTES, xrefs: 00488AA1
REGKEYEXISTS, xrefs: 00488D79
STRINGCHANGE, xrefs: 00488BB6
REGGETVALUENAMES, xrefs: 00489060
DELETEINISECTION, xrefs: 004888D1
REGGETSUBKEYNAMES, xrefs: 00488FF3
REGWRITEBINARYVALUE, xrefs: 00489823
REGDELETEVALUE, xrefs: 00488F4E
GETSYSTEMDIR, xrefs: 00488B3E
INIKEYEXISTS, xrefs: 0048869A
REGQUERYMULTISTRINGVALUE, xrefs: 0048918F
REMOVEBACKSLASHUNLESSROOT, xrefs: 00488A31
GETENV, xrefs: 0048890B
ISINISECTIONEMPTY, xrefs: 004886F6
CONVERTPERCENTSTRING, xrefs: 00488D38
DELETEINIENTRY, xrefs: 00488883
REMOVEBACKSLASH, xrefs: 004889F9
REGVALUEEXISTS, xrefs: 00488DF6
GETTEMPDIR, xrefs: 00488B8E
DIREXISTS, xrefs: 004884C4
ADDQUOTES, xrefs: 00488A69
GETSYSWOW64DIR, xrefs: 00488B66
GETINIINT, xrefs: 004885AA
GETUILANGUAGE, xrefs: 0048997F
CHARLENGTH, xrefs: 004899DC
REGWRITEDWORDVALUE, xrefs: 0048974F
REGWRITEMULTISTRINGVALUE, xrefs: 00489645
GETINISTRING, xrefs: 00488536
SETNTFSCOMPRESSION, xrefs: 00489A1D
SETINIBOOL, xrefs: 00488818
PARAMCOUNT, xrefs: 0048896B
PARAMSTR, xrefs: 0048898F
USINGWINNT, xrefs: 00488C91
GETSHORTNAME, xrefs: 00488AD9
FONTEXISTS, xrefs: 0048994B
REGQUERYSTRINGVALUE, xrefs: 004890CD
REGWRITEEXPANDSTRINGVALUE, xrefs: 00489564
FILECOPY, xrefs: 00488CB5
ISADMINLOGGEDON, xrefs: 00489903
ADDPERIOD, xrefs: 004899A4
ISPOWERUSERLOGGEDON, xrefs: 00489927

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID:
String ID: ADDBACKSLASH$ADDPERIOD$ADDQUOTES$CHARLENGTH$CONVERTPERCENTSTRING$DELETEINIENTRY$DELETEINISECTION$DIREXISTS$FILECOPY$FILEEXISTS$FILEORDIREXISTS$FONTEXISTS$GETCMDTAIL$GETENV$GETINIBOOL$GETINIINT$GETINISTRING$GETSHORTNAME$GETSYSTEMDIR$GETSYSWOW64DIR$GETTEMPDIR$GETUILANGUAGE$GETWINDIR$INIKEYEXISTS$ISADMINLOGGEDON$ISINISECTIONEMPTY$ISPOWERUSERLOGGEDON$PARAMCOUNT$PARAMSTR$REGDELETEKEYIFEMPTY$REGDELETEKEYINCLUDINGSUBKEYS$REGDELETEVALUE$REGGETSUBKEYNAMES$REGGETVALUENAMES$REGKEYEXISTS$REGQUERYBINARYVALUE$REGQUERYDWORDVALUE$REGQUERYMULTISTRINGVALUE$REGQUERYSTRINGVALUE$REGVALUEEXISTS$REGWRITEBINARYVALUE$REGWRITEDWORDVALUE$REGWRITEEXPANDSTRINGVALUE$REGWRITEMULTISTRINGVALUE$REGWRITESTRINGVALUE$REMOVEBACKSLASH$REMOVEBACKSLASHUNLESSROOT$REMOVEQUOTES$SETINIBOOL$SETINIINT$SETINISTRING$SETNTFSCOMPRESSION$STRINGCHANGE$STRINGCHANGEEX$USINGWINNT
API String ID: 0-3658119371
Opcode ID: 1f14d61b7a5d52fdf141eebfabc5151eab6d40e8db8212f4da4e77aab49c8a96
Instruction ID: 936434b6cf74013ef055cbb55979cf012bc570ba37b1a9c085d549fc9f4523a8
Opcode Fuzzy Hash: 1f14d61b7a5d52fdf141eebfabc5151eab6d40e8db8212f4da4e77aab49c8a96
Instruction Fuzzy Hash: 4AD25174B006559BDB04FB79C8825AEB6A5AF49704F14883FF402E738ADE38ED06C759

Uniqueness

Uniqueness Score: -1.00%

Function 0046C5C4 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 959COMMON

Download Yara Rule

Strings

-- File entry --, xrefs: 0046C617
Uninstaller requires administrator: %s, xrefs: 0046D091
Will register the file (a DLL/OCX) later., xrefs: 0046D41E
Version of our file: (none), xrefs: 0046CA18
Time stamp of our file: (failed to read), xrefs: 0046C8C3
Existing file's MD5 sum matches our file. Skipping., xrefs: 0046CBD1
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 0046CDB2
Couldn't read time stamp. Skipping., xrefs: 0046CC51
Dest file is protected by Windows File Protection., xrefs: 0046C809
Skipping due to "onlyifdoesntexist" flag., xrefs: 0046C8EA
InUn, xrefs: 0046D061
Time stamp of existing file: (failed to read), xrefs: 0046C953
Non-default bitness: 64-bit, xrefs: 0046C7CB
Existing file has a later time stamp. Skipping., xrefs: 0046CCEB
Stripped read-only attribute., xrefs: 0046CDE3
Same time stamp. Skipping., xrefs: 0046CC71
Existing file is a newer version. Skipping., xrefs: 0046CB1E
Dest filename: %s, xrefs: 0046C7B0
Time stamp of our file: %s, xrefs: 0046C8B7
Same version. Skipping., xrefs: 0046CC01
User opted not to overwrite the existing file. Skipping., xrefs: 0046CD69
IF, xrefs: 0046D613
Skipping due to "onlyifdestfileexists" flag., xrefs: 0046CE16
, xrefs: 0046CAEB, 0046CCBC, 0046CD3A
Existing file's MD5 sum is different from our file. Proceeding., xrefs: 0046CBE0
Version of our file: %u.%u.%u.%u, xrefs: 0046CA0C
@, xrefs: 0046C6CC
Incrementing shared file count (64-bit)., xrefs: 0046D48B
Time stamp of existing file: %s, xrefs: 0046C947
Version of existing file: (none), xrefs: 0046CC16
.tmp, xrefs: 0046CED3
Failed to strip read-only attribute., xrefs: 0046CDEF
Incrementing shared file count (32-bit)., xrefs: 0046D4A4
Dest file exists., xrefs: 0046C8D7
Non-default bitness: 32-bit, xrefs: 0046C7D7
Failed to read existing file's MD5 sum. Proceeding., xrefs: 0046CBEC
Existing file is protected by Windows File Protection. Skipping., xrefs: 0046CD08
Version of existing file: %u.%u.%u.%u, xrefs: 0046CA98
Will register the file (a type library) later., xrefs: 0046D412
Installing the file., xrefs: 0046CE25

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's MD5 sum is different from our file. Proceeding.$Existing file's MD5 sum matches our file. Skipping.$Failed to read existing file's MD5 sum. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing the file.$IF$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-3571605357
Opcode ID: 56835e39ca076e047aa2f6d3f33d3104a8d2048e3cdf3cb1758606d2133742c4
Instruction ID: bbba4ebc422fcc932ed0245fa1df0834f4a6a16cbc4990aadff4421ccbeeb5a2
Opcode Fuzzy Hash: 56835e39ca076e047aa2f6d3f33d3104a8d2048e3cdf3cb1758606d2133742c4
Instruction Fuzzy Hash: 54928630E042889FCB11DFA5C485BEDBBB5AF05308F5440ABE844B7392D7789E45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423B7C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639ea8a65e5d1045f234ad22cb926eca84f4100e1c8e0f878663b87099c3501d
Instruction ID: 08d2eb01bbb0ed60fc7aa7cee5e011afdc801c2d0a550085eeb8675b0aa62de6
Opcode Fuzzy Hash: 639ea8a65e5d1045f234ad22cb926eca84f4100e1c8e0f878663b87099c3501d
Instruction Fuzzy Hash: ACE19A30B00124EBC710DF69E585A5EB7B0FF48704FA441AAE645AB352CB7DEE81DB09

Uniqueness

Uniqueness Score: -1.00%

Function 004227CC Relevance: 18.3, APIs: 12, Instructions: 255
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 00422964
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422B2E), ref: 00422974

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 2abb7be38f07bdbff59ebe84ec25c0135aec20ab9609bb353edf566cfea0727e
Instruction ID: 22a298226f26ad5282d2b06c056c5494fcfa573f7ff451a3aba74327ab4f92ef
Opcode Fuzzy Hash: 2abb7be38f07bdbff59ebe84ec25c0135aec20ab9609bb353edf566cfea0727e
Instruction Fuzzy Hash: A6917271B04214FFD710EBA9DA86F9D77F4AB09314F5104BAF504AB3A2C778AE409B58

Uniqueness

Uniqueness Score: -1.00%

Function 00463B8C Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1645windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00490078: GetWindowRect.USER32(00000000), ref: 0049008E

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00463F5B

Part of subcall function 0041D620: GetObjectA.GDI32(?,00000018,00463F75), ref: 0041D64B

Part of subcall function 004639E8: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00463A85
Part of subcall function 004639E8: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00463AAB
Part of subcall function 004639E8: SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00463B07
Part of subcall function 004639E8: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00463B2D

Part of subcall function 004633A4: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00464010,00000000,00000000,00000000,0000000C,00000000), ref: 004633BC

Part of subcall function 004902D4: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 004902DE

Part of subcall function 0048FFC8: 73A1A570.USER32(00000000,?,?,?), ref: 0048FFEA
Part of subcall function 0048FFC8: SelectObject.GDI32(?,00000000), ref: 00490010
Part of subcall function 0048FFC8: 73A1A480.USER32(00000000,?,0049006E,00490067,?,00000000,?,?,?), ref: 00490061

Part of subcall function 004902C4: MulDiv.KERNEL32(0000004B,?,00000006), ref: 004902CE

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00464BD3
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00464BE4
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00464BFC

Part of subcall function 00429FCC: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 00429FE2

Strings

STOPIMAGE, xrefs: 00463F50
, xrefs: 0046401D
(Default), xrefs: 004651E7

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Menu$AppendExtractFileIconInfoObject$A480A570BitmapCallbackDispatcherLoadMessageRectSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE
API String ID: 1965080796-770201673
Opcode ID: 80f7aee92de1e31dca4f16c75dc9a4f5f3520f9015eb7726ec2554a956d9f7b2
Instruction ID: 9b804f360638e7ec9479bb78d72ee5234d78dd0d5496d892e29c920f99ca9afd
Opcode Fuzzy Hash: 80f7aee92de1e31dca4f16c75dc9a4f5f3520f9015eb7726ec2554a956d9f7b2
Instruction Fuzzy Hash: 7DF2C6386105218FCB00EF69D8D9F9973F5BF89304F1541B6E9049B36ADB78AC46CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A964 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,00000000,?,00000000,13I,?,00000000,00000000,?,?,0047BCC8,?,?,00000000), ref: 0047A9C4
FindNextFileA.KERNEL32(000000FF,?,00000000,?,?,00000000,?,00000000,13I,?,00000000,00000000,?,?,0047BCC8,?), ref: 0047AA0D
FindClose.KERNEL32(000000FF,000000FF,?,00000000,?,?,00000000,?,00000000,13I,?,00000000,00000000,?,?,0047BCC8), ref: 0047AA1A
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,00000000,?,00000000,13I,?,00000000,00000000,?,?,0047BCC8,?), ref: 0047AA66
FindNextFileA.KERNEL32(000000FF,?,00000000,0047AB33,?,00000000,?,00000000,?,?,00000000,?,00000000,13I,?,00000000), ref: 0047AB0F
FindClose.KERNEL32(000000FF,0047AB3A,0047AB33,?,00000000,?,00000000,?,?,00000000,?,00000000,13I,?,00000000,00000000), ref: 0047AB2D

Strings

13I, xrefs: 0047A98E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: 13I
API String ID: 3541575487-562285233
Opcode ID: 14a22c9b19f9f593fc8f290ef9588bdea0a1845b81f46d5d148d05f04d7c5859
Instruction ID: 4e67e333ed9d0cc1fab42887fed5e7c2c21fb1f12194a2671a08295e0f582913
Opcode Fuzzy Hash: 14a22c9b19f9f593fc8f290ef9588bdea0a1845b81f46d5d148d05f04d7c5859
Instruction Fuzzy Hash: C7517E71900648AFCB11EFA6CC45ADEB7BCEB88315F1084BAA508E7341D6389F95CF19

Uniqueness

Uniqueness Score: -1.00%

Function 004547F8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,0045492C), ref: 00454828
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0045482E
GetDiskFreeSpaceExA.KERNELBASE(00000000,?,?,00000000,00000000,0045490A,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,0045492C), ref: 00454879

Strings

GetDiskFreeSpaceExA, xrefs: 0045481E
kernel32.dll, xrefs: 00454823

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1197914913-3712701948
Opcode ID: eac562a1060f7fadf38ecb16a1882514189a9ad3f183d6e31b82e056aa49acf1
Instruction ID: 4ed4d427c84f2e0797dfbcbbf1775a844099e9a297d380e2836bd8fb6971dfff
Opcode Fuzzy Hash: eac562a1060f7fadf38ecb16a1882514189a9ad3f183d6e31b82e056aa49acf1
Instruction Fuzzy Hash: DA316275A04249AFCF01EFA5C8829EFB7B8EF89704F504567E800F7252D6385D098B68

Uniqueness

Uniqueness Score: -1.00%

Function 00470C84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00470DEE,?,?,00000001,00497154), ref: 00470CDD
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00470DEE,?,?,00000001,00497154), ref: 00470DBA
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00470DEE,?,?,00000001,00497154), ref: 00470DC8

Strings

unins???.*, xrefs: 00470CC7
unins, xrefs: 00470D30

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: b8508960964e18f228b5b6a455ee562c9244d5bac447fc9a6e43c63091bc2de7
Instruction ID: efef7a00cc11a416bc55dd6669f4c7d8ef89bbc17b889cc882c0d169e59b9d03
Opcode Fuzzy Hash: b8508960964e18f228b5b6a455ee562c9244d5bac447fc9a6e43c63091bc2de7
Instruction Fuzzy Hash: A63113756012489FCB50EB65C981BDE77B9AF44304F5084B6A448AB3A2D738AF818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00451668 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004516CB,?,?,-00000001,00000000), ref: 004516A5
GetLastError.KERNEL32(00000000,?,00000000,004516CB,?,?,-00000001,00000000), ref: 004516AD

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 4992d9c4ac3d79ff7e7521af778fd9e97c747edc218e3ac35a14e929c70b5f16
Instruction ID: 1035efb27f9b4b466a521b4d59d966f000d53702a43f221aaee312fb08fd4d5a
Opcode Fuzzy Hash: 4992d9c4ac3d79ff7e7521af778fd9e97c747edc218e3ac35a14e929c70b5f16
Instruction Fuzzy Hash: 9EF04931A00304BB8B10EB769C5159EB7ECDB4532571046BBFC14D32A2DA784D048458

Uniqueness

Uniqueness Score: -1.00%

Function 004084D0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004964C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: db4c94cdf382ee3399fd393310c0d3b07f3e4771964ce669c16d021a31866df8
Instruction ID: 1ce02aaae6ec4ade8b295bae84213e8e13784b7c216e354617812bc232f4da8b
Opcode Fuzzy Hash: db4c94cdf382ee3399fd393310c0d3b07f3e4771964ce669c16d021a31866df8
Instruction Fuzzy Hash: 59E0D87170021467D711E95A9C869F7B35CA758314F00427FB949EB3C2EDB8DE4046ED

Uniqueness

Uniqueness Score: -1.00%

Function 00423AF4 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,004240C1,?,00000000,004240CC), ref: 00423B1E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: f78a68ed826797f4bf69a42243cc74bd686c7ff48922d06499da9bfac42a5011
Instruction ID: 62037174fb3a4e63d39f4d80a9d1e591ad15120c94b51c82d4663250cb3dbf53
Opcode Fuzzy Hash: f78a68ed826797f4bf69a42243cc74bd686c7ff48922d06499da9bfac42a5011
Instruction Fuzzy Hash: A0F0C579205608AFCB40DF9DC588D4AFBE8FB4C260B158295B988CB321C234FE808F94

Uniqueness

Uniqueness Score: -1.00%

Function 00453F88 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 00453F9E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: e5c4147ce8d30c90c427c53b97d0de2aa7d796d22412cffb07543fa3924af9c1
Instruction ID: 1680b636b72d7d7da35d26ad3489112d7b5719c0f4c6eb10b1da13dd6a5c5f2b
Opcode Fuzzy Hash: e5c4147ce8d30c90c427c53b97d0de2aa7d796d22412cffb07543fa3924af9c1
Instruction Fuzzy Hash: CAD0C2B260420053C300AEA9AC82697769C8B84316F10483F7C85CA3C3E67CDB4C569A

Uniqueness

Uniqueness Score: -1.00%

Function 0042EEF4 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042EF10

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 526567439b164cf8a1cedbeebbc24c6bfdc41ebf56c0565ee429dfc079ee367e
Instruction ID: 914d3360e1f6a3e7d3a1e305f80b88d129d6a01b97e8a9d2bd08e0dbdb8f1123
Opcode Fuzzy Hash: 526567439b164cf8a1cedbeebbc24c6bfdc41ebf56c0565ee429dfc079ee367e
Instruction Fuzzy Hash: 16D0A77120010C7FCB00DE99D940C6F33AC9B88700BA0C805F508C7205C734EC1087B4

Uniqueness

Uniqueness Score: -1.00%

Function 0046AF80 Relevance: 68.7, APIs: 1, Strings: 38, Instructions: 412
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046AD6C: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,00497154,?,0046B06F,?,00000000,0046B4F7,?,_is1), ref: 0046AD8F

RegCloseKey.ADVAPI32(?,0046B4FE,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046B549,?,?,00000001,00497154), ref: 0046B4F1

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046AFC2
NoRepair, xrefs: 0046B411
Inno Setup: App Path, xrefs: 0046B092
Inno Setup: User Info: Serial, xrefs: 0046B1E4
URLUpdateInfo, xrefs: 0046B372
RegisterPreviousData, xrefs: 0046B4A7
NoModify, xrefs: 0046B3FD
Inno Setup: Icon Group, xrefs: 0046B0C1
Inno Setup: Selected Components, xrefs: 0046B13C
Contact, xrefs: 0046B3AC
_is1, xrefs: 0046AFC8
Inno Setup: User, xrefs: 0046B0FE
" /SILENT, xrefs: 0046B2B7
Inno Setup: User Info: Name, xrefs: 0046B1BA
HelpLink, xrefs: 0046B355
URLInfoAbout, xrefs: 0046B31B
InstallDate, xrefs: 0046B430
MinorVersion, xrefs: 0046B46E
Inno Setup: Deselected Tasks, xrefs: 0046B1A2
Inno Setup: Deselected Components, xrefs: 0046B15B
DisplayVersion, xrefs: 0046B2E1
Inno Setup: Setup Version, xrefs: 0046B05D
MajorVersion, xrefs: 0046B45C
DisplayIcon, xrefs: 0046B250
ModifyPath, xrefs: 0046B3E9
UninstallString, xrefs: 0046B28A
Comments, xrefs: 0046B3C9
Inno Setup: Setup Type, xrefs: 0046B11D
Inno Setup: No Icons, xrefs: 0046B0DF
HelpTelephone, xrefs: 0046B338
QuietUninstallString, xrefs: 0046B2C4
InstallLocation, xrefs: 0046B0B2
Inno Setup: User Info: Organization, xrefs: 0046B1CF
Readme, xrefs: 0046B38F
Inno Setup: Selected Tasks, xrefs: 0046B183
5.3.5 (a), xrefs: 0046B062
Publisher, xrefs: 0046B2FE
DisplayName, xrefs: 0046B233

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.3.5 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3132538880-4162757603
Opcode ID: 74ada5f7f4b3b84f6d30dbb7f605c502c19f4e02ec6191c5605d87bebef11242
Instruction ID: 6b8bd6052d7011f0313b6456d796e8b41d00091cb6ba677f30044cb60bcfab9c
Opcode Fuzzy Hash: 74ada5f7f4b3b84f6d30dbb7f605c502c19f4e02ec6191c5605d87bebef11242
Instruction Fuzzy Hash: DBF14374A001099BCB14EB55D8819AEB7B9EB44304F60C07BEC11AB7A5EB7CBD41CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0047E1E8 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0047E1F9
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0047E206
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047E214
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0047E21C
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 0047E228
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 0047E249
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 0047E25C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0047E262
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047E279

Strings

advapi32.dll, xrefs: 0047E257
IsWow64Process, xrefs: 0047E216
GetSystemWow64DirectoryA, xrefs: 0047E243
GetNativeSystemInfo, xrefs: 0047E200
kernel32.dll, xrefs: 0047E1F4
RegDeleteKeyExA, xrefs: 0047E252

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 4e477b3967b851c9eac5dc78f32453af4a94d1867c0ed92fe90c0839294704c9
Instruction ID: 2d47f8cf15d4e27fa0f1176fe36efced94cd1240a4270aaae3bb705869ea135a
Opcode Fuzzy Hash: 4e477b3967b851c9eac5dc78f32453af4a94d1867c0ed92fe90c0839294704c9
Instruction Fuzzy Hash: 6E11B155104741A4DA1073B79D45FEB164C8B09718F188BFB6C8CA62D3D67CC84996BF

Uniqueness

Uniqueness Score: -1.00%

Function 0046F4B0 Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 585
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,00000000,0046FAA9,?,?,?,?,00000000,0046FC03,?,?,00000001), ref: 0046F638
RegCloseKey.ADVAPI32(?,?,00000000,?,00000002,00000000,00000000,0046FAA9,?,?,?,?,00000000,0046FC03,?,?), ref: 0046F641

Part of subcall function 0046F304: GetLastError.KERNEL32(00000000,00000000,00000000,0046F3D8,?,?,00000001,00497154), ref: 0046F391

RegDeleteValueA.ADVAPI32(?,00000000,00000000,0046FA98,?,?,00000000,0046FAA9,?,?,?,?,00000000,0046FC03,?,?), ref: 0046F75F

Part of subcall function 0042DC1C: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC48

Part of subcall function 0046F304: GetLastError.KERNEL32(00000000,00000000,00000000,0046F3D8,?,?,00000001,00497154), ref: 0046F3A7

Strings

{olddata}, xrefs: 0046F7F7, 0046F88E
break, xrefs: 0046F8CF
Failed to parse "qword" value, xrefs: 0046F9EB
olddata, xrefs: 0046F862, 0046F8C1
Cannot access 64-bit registry keys on this version of Windows, xrefs: 0046F58E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: DeleteErrorLastValue$CloseCreate
String ID: Cannot access 64-bit registry keys on this version of Windows$Failed to parse "qword" value$break$olddata${olddata}
API String ID: 2638610037-3092547568
Opcode ID: 9db23c8cc13e5308f4faf33745cb621f546c7df7267e2e73403dd9afb70e57ea
Instruction ID: 46b4255f78c2f73338f7f4888f5fcbb62f489d65516d599404acd81fcda8c62c
Opcode Fuzzy Hash: 9db23c8cc13e5308f4faf33745cb621f546c7df7267e2e73403dd9afb70e57ea
Instruction Fuzzy Hash: 35322E74E00248AFDB14DFA9D481BDEBBF4AF08304F444066F954AB3A2DB78AD45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00465560 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,0046577A,?,?,00000001,00000000,00000000,00465795,?,00000000,00000000,?), ref: 00465763

Strings

Inno Setup: User Info: Name, xrefs: 0046571F
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 004655BF
Inno Setup: Setup Type, xrefs: 00465672
Inno Setup: Selected Components, xrefs: 00465682
Inno Setup: Selected Tasks, xrefs: 004656CF
Inno Setup: Deselected Tasks, xrefs: 004656F1
Inno Setup: Deselected Components, xrefs: 004656A4
Inno Setup: Icon Group, xrefs: 0046563E
Inno Setup: User Info: Organization, xrefs: 00465732
%s\%s_is1, xrefs: 004655DD
Inno Setup: App Path, xrefs: 00465622
Inno Setup: User Info: Serial, xrefs: 00465745
Inno Setup: No Icons, xrefs: 0046564B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 94c9d62fb1d7e435db0e42792cab2a1aa0121b794f6c09036552146ff74fe873
Instruction ID: 8cdb4376706b2a9b24b9b35df1ecfc56159c4b319484bfede528e66c14f5fdf6
Opcode Fuzzy Hash: 94c9d62fb1d7e435db0e42792cab2a1aa0121b794f6c09036552146ff74fe873
Instruction Fuzzy Hash: 4951B630A00B04DBCB11EB65D951BDEBBF5EF84304F5084BAE845A7391E738AE05CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0046E8BC Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 319
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0046EA4F
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046EB46
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 0046EB5C
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046EB81

Strings

target.lnk, xrefs: 0046EBCB
Filename: %s, xrefs: 0046E9F1
Desktop.ini, xrefs: 0046EC02
.url, xrefs: 0046E98B
{group}\, xrefs: 0046E913
.pif, xrefs: 0046E968, 0046EACA
.lnk, xrefs: 0046E945

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 7abe2462af80aab380856dba1a1f84fa715764636b05e62e9a7eb2e252f3fb8a
Instruction ID: 9b3c0a2ebe02865d096d3d92589461d85e8d30d772736a84054ea4ba39fb763a
Opcode Fuzzy Hash: 7abe2462af80aab380856dba1a1f84fa715764636b05e62e9a7eb2e252f3fb8a
Instruction Fuzzy Hash: FBD12274A00249AFDB01DF95D885FDEBBF5AF08314F54402AF900B7392D678AE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004237E4 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F334: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED14,?,004237FF,00423B7C,0041ED14), ref: 0041F352

GetClassInfoA.USER32(00400000,004235EC), ref: 0042380F
RegisterClassA.USER32(00494630), ref: 00423827
GetSystemMetrics.USER32(00000000), ref: 00423849
GetSystemMetrics.USER32(00000001), ref: 00423858
SetWindowLongA.USER32(004105C0,000000FC,004235FC), ref: 004238B4
SendMessageA.USER32(004105C0,00000080,00000001,00000000), ref: 004238D5
GetSystemMenu.USER32(004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C,0041ED14), ref: 004238E0
DeleteMenu.USER32(00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C,0041ED14), ref: 004238EF
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 004238FC
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000), ref: 00423912

Strings

5B, xrefs: 00423803, 00423884

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: 5B
API String ID: 183575631-3738334870
Opcode ID: e5b5147e0e34996107640ab488c5a955b3283bc40e3e9afea641ea9dff5fb6f0
Instruction ID: 4eea79998965153292ad411f177aff7c9d901da1d54039d3c3496ec011b6d66c
Opcode Fuzzy Hash: e5b5147e0e34996107640ab488c5a955b3283bc40e3e9afea641ea9dff5fb6f0
Instruction Fuzzy Hash: C53161B17402106AEB10AF65EC82F6A36989715709F11017BBA41AF2D7C67DED04876C

Uniqueness

Uniqueness Score: -1.00%

Function 00477ECC Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 00477FCE

Strings

Failed to get address of SHGetFolderPath function, xrefs: 00477FDF
SHGetFolderPathA, xrefs: 00477FC3
] I, xrefs: 00477F15, 00477F5A, 00477F42, 00477F4A
shell32.dll, xrefs: 00477F79
Failed to get version numbers of _shfoldr.dll, xrefs: 00477F24
SHFOLDERDLL, xrefs: 00477F0B
shfolder.dll, xrefs: 00477F31, 00477F6A
_isetup\_shfoldr.dll, xrefs: 00477EFE
Failed to load DLL "%s", xrefs: 00477FB1

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$] I$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-953201679
Opcode ID: 3a61dcf9b9bd17d64e1f1d53dccfc62cf8d1677eca963567b862213e4dcef6d3
Instruction ID: be8cea5b208f70f3497dc675e9b67cc11d28b3b7ca4846f22d5268085fe32373
Opcode Fuzzy Hash: 3a61dcf9b9bd17d64e1f1d53dccfc62cf8d1677eca963567b862213e4dcef6d3
Instruction Fuzzy Hash: D5312530A04249DBCB00EB95D9859DEB7B4EB54308F51C87BE508E7351DB789E08CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00454C98 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 00454E69
756FE550.OLE32(00494A58,00000000,00000001,00494774,?,00000000,00454F64), ref: 00454CDA

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

756FE550.OLE32(00494764,00000000,00000001,00494774,?,00000000,00454F64), ref: 00454D00

Strings

CoCreateInstance, xrefs: 00454D0B
IPropertyStore::Commit, xrefs: 00454E4E
IShellLink::QueryInterface, xrefs: 00454E8D
IPropertyStore::SetValue, xrefs: 00454DE9, 00454E35
IPersistFile::Save, xrefs: 00454EEB

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: E550String$AllocByteCharFreeMultiWide
String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue$IShellLink::QueryInterface
API String ID: 2757340368-2052886881
Opcode ID: 5948eefd91c64643e410a8502d34ef97e64b0715af901c2b07599baa63df0646
Instruction ID: 0b21da03975bca805d8248ee8d2b37e628922fffcf98328ca7261b0fae796446
Opcode Fuzzy Hash: 5948eefd91c64643e410a8502d34ef97e64b0715af901c2b07599baa63df0646
Instruction Fuzzy Hash: AA915071A00104AFDB50DFA9C885F9E77F8AF89709F50406AF904EB262DB78DD48CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00477BA0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00477D13,?,?,00000000,00496628,00000000,00000000,?,00492BF5,00000000,00492D9E,?,00000000), ref: 00477C33
GetLastError.KERNEL32(00000000,00000000,00000000,00477D13,?,?,00000000,00496628,00000000,00000000,?,00492BF5,00000000,00492D9E,?,00000000), ref: 00477C3C

Strings

_isetup, xrefs: 00477C1E
o1I, xrefs: 00477C47, 00477C54
e1I, xrefs: 00477CF8, 00477C6A, 00477C74
\_setup64.tmp, xrefs: 00477CCB
REGDLL_EXE, xrefs: 00477CB0
\_RegDLL.tmp, xrefs: 00477CA0
Created temporary directory: , xrefs: 00477BD5

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $REGDLL_EXE$\_RegDLL.tmp$\_setup64.tmp$_isetup$e1I$o1I
API String ID: 1375471231-477672290
Opcode ID: d45a903d43fec4a0e1a7f7fcdc92163926cd1004247d32c9d76ae8d725548c38
Instruction ID: 656792ce42a3b8ee986284f240f9f7d4df8ffa0b35947b5a09b08d7327d2a589
Opcode Fuzzy Hash: d45a903d43fec4a0e1a7f7fcdc92163926cd1004247d32c9d76ae8d725548c38
Instruction Fuzzy Hash: 89412674A042099FCB11EF95D882ADEB7B5EF48309F50857BE81477392D738AE05CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042EF34 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0042EF63
GetFocus.USER32 ref: 0042EF6B
RegisterClassA.USER32(004947AC), ref: 0042EF8C
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F060,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042EFCA
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F010
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F021
SetFocus.USER32(00000000,00000000,0042F043,?,?,?,00000001,00000000,?,00456ACA,00000000,00496628), ref: 0042F028

Strings

TWindowDisabler-Window, xrefs: 0042EFC3, 0042F009
(fI, xrefs: 0042F03A, 0042EFF3, 0042F000

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: (fI$TWindowDisabler-Window
API String ID: 3167913817-2792019125
Opcode ID: 0ce36a94734e1bdaba5589c0876522723a0f5aad4d49ed3e360a5c17dbea6856
Instruction ID: 77e24118650528b8c543fe6d0d23e90f8f7024fb04e3d66e63b834f41b798fd0
Opcode Fuzzy Hash: 0ce36a94734e1bdaba5589c0876522723a0f5aad4d49ed3e360a5c17dbea6856
Instruction Fuzzy Hash: 35219571740710BAE220EF62DD02F1A76A4EB05B04FA2453BF604BB2D2D7BC6D54C6AD

Uniqueness

Uniqueness Score: -1.00%

Function 00401A90 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(00496420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(00496420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(00496420,00401B6F), ref: 00401B62

Strings

@dI, xrefs: 00401ADB, 00401AF5, 00401AFD
PdI, xrefs: 00401B07
|dI, xrefs: 00401B11

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: @dI$PdI$|dI
API String ID: 3782394904-4088903152
Opcode ID: d7983087b8bcbabcafc2c9d8a305f4a93e6fa46b606c4ef3e584c6169f95cf8d
Instruction ID: bf2c7a4256457c5f50c71aa29f18f829c6f6e2c919ab822836d088e606c14c70
Opcode Fuzzy Hash: d7983087b8bcbabcafc2c9d8a305f4a93e6fa46b606c4ef3e584c6169f95cf8d
Instruction Fuzzy Hash: 5D118F30A403405EEB15ABE99D82F263BE59761B4CF56407BF80067AF1D77C9850C76E

Uniqueness

Uniqueness Score: -1.00%

Function 0047C34C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 170windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 0047C4F4
FreeLibrary.KERNEL32(00000000), ref: 0047C508
SendNotifyMessageA.USER32(0002047E,00000496,00002710,00000000), ref: 0047C57A

Strings

Deinitializing Setup., xrefs: 0047C36A
Restarting Windows., xrefs: 0047C555
DeinitializeSetup, xrefs: 0047C405
GetCustomSetupExitCode, xrefs: 0047C3A9
Not restarting Windows because Setup is being run from the debugger., xrefs: 0047C529

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 92171cca56d0dca6374151b9cd3c9dce62e592a579c39f6bda26daffea02fc36
Instruction ID: 90f5f2579ebd2cd042589c700d0c35de107af6cb7106057c8f5cc839c7e64824
Opcode Fuzzy Hash: 92171cca56d0dca6374151b9cd3c9dce62e592a579c39f6bda26daffea02fc36
Instruction Fuzzy Hash: 5851B130614200AFD721DB79DC95BAA7BE4EB59314F50C57BEC08C72A2DB38A845CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00451DF8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451E91,?,?,?,?,00000000,?,00493224), ref: 00451E18
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451E1E
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451E91,?,?,?,?,00000000,?,00493224), ref: 00451E32
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451E38

Strings

kernel32.dll, xrefs: 00451E13, 00451E2D
Wow64RevertWow64FsRedirection, xrefs: 00451E28
Wow64DisableWow64FsRedirection, xrefs: 00451E0E
shell32.dll, xrefs: 00451E64

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: b69695f4757dcfd3a81ec6ab30e1db3e18e2299280acd1b52451f71d5d608202
Instruction ID: bff3e1d123b44789eb661b74cfa9bb81be17ee1d1842bcd010c9e5766072ccdb
Opcode Fuzzy Hash: b69695f4757dcfd3a81ec6ab30e1db3e18e2299280acd1b52451f71d5d608202
Instruction Fuzzy Hash: E4018470200744AED701AB62AC03B6B3A98D754B5AF91447BFC04A61A3D7BC5D089E2D

Uniqueness

Uniqueness Score: -1.00%

Function 0046E048 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 263fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0046E219,?,00000000,?,00000001,00000000,0046E3E7,?,00000000,?,00000000,?,0046E5A2), ref: 0046E1F5
FindClose.KERNEL32(000000FF,0046E220,0046E219,?,00000000,?,00000001,00000000,0046E3E7,?,00000000,?,00000000,?,0046E5A2,?), ref: 0046E213
FindNextFileA.KERNEL32(000000FF,?,00000000,0046E33B,?,00000000,?,00000001,00000000,0046E3E7,?,00000000,?,00000000,?,0046E5A2), ref: 0046E317
FindClose.KERNEL32(000000FF,0046E342,0046E33B,?,00000000,?,00000001,00000000,0046E3E7,?,00000000,?,00000000,?,0046E5A2,?), ref: 0046E335

Strings

sF, xrefs: 0046E29F, 0046E2A2
sF, xrefs: 0046E08E, 0046E0A5
IF, xrefs: 0046E3D9, 0046E357, 0046E381, 0046E38F, 0046E3A7, 0046E36E, 0046E121, 0046E1C4, 0046E15C, 0046E173, 0046E181, 0046E138, 0046E141, 0046E1C7

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: IF$sF$sF
API String ID: 2066263336-2713198477
Opcode ID: 7c2e05bd8a9cb4b68ab53d8a8dc38ced3e86c8d43e7820161bf454f2c779ccee
Instruction ID: 1230aeaf309185c7ec03d96dbdc6ad6414d2784c2265a1c5d62d22ef3a6f047c
Opcode Fuzzy Hash: 7c2e05bd8a9cb4b68ab53d8a8dc38ced3e86c8d43e7820161bf454f2c779ccee
Instruction Fuzzy Hash: 51B13D3490425D9FCF11DFA6C881ADEBBF9BF49304F5081AAE808A7391D7389A46CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00430314 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 0043031C
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 0043032B
GetCurrentThreadId.KERNEL32 ref: 00430345
GlobalAddAtomA.KERNEL32(00000000), ref: 00430366

Strings

commdlg_help, xrefs: 00430317
WndProcPtr%.8X%.8X, xrefs: 00430357
commdlg_FindReplace, xrefs: 00430326

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: d957c5322606f91c3a63daffd078634db936568746c689a8806e8aa63a5fc16b
Instruction ID: 0713c644b5c0c2c8d9555e19a872e1a2a1cf9f6f22ed51b2a28eccd68185566a
Opcode Fuzzy Hash: d957c5322606f91c3a63daffd078634db936568746c689a8806e8aa63a5fc16b
Instruction Fuzzy Hash: 9CF082704483808BD700EB75C842B197AE0EB98708F01467FB898A62E1D77A8500CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 00453A04 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00000080,COMMAND.COM" /C ,?,00453C20,00453C20,00000031,00453C20,00000000), ref: 00453BAC
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00000080,COMMAND.COM" /C ,?,00453C20,00453C20,00000031,00453C20), ref: 00453BB9

Part of subcall function 00453970: WaitForInputIdle.USER32(00000001,00000032), ref: 0045399C
Part of subcall function 00453970: MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 004539BE
Part of subcall function 00453970: GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 004539CD
Part of subcall function 00453970: CloseHandle.KERNEL32(00000001,004539FA,004539F3,?,00000031,00000080,00000000,?,?,00453D4B,00000080,0000003C,00000000,00453D61), ref: 004539ED

Strings

.bat, xrefs: 00453A94
COMMAND.COM" /C , xrefs: 00453B18
cmd.exe" /C ", xrefs: 00453AE1
.cmd, xrefs: 00453AAF
D, xrefs: 00453B4C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: f57898f041d5935b6d6281ba22f513b48aa01852584ab8b260475cc68ecf2797
Instruction ID: 0d4c244814a61e6a9f40f8d6579175ec88b371b5f0bc4768c512e06936e56e52
Opcode Fuzzy Hash: f57898f041d5935b6d6281ba22f513b48aa01852584ab8b260475cc68ecf2797
Instruction Fuzzy Hash: 0D51767460035DABCB01EFA5C842B9EBBB9AF44346F50443BB844B7283D7789F098B58

Uniqueness

Uniqueness Score: -1.00%

Function 004235FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042368C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 004236B9
OemToCharA.USER32(?,?), ref: 004236CC
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 0042370C

Strings

MAINICON, xrefs: 00423681
2, xrefs: 0042365A

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: b8e4f3de8f6e7962c855b1bbff0a6ea575b20ad32e9f870a500b7efad52da8d9
Instruction ID: d7f5d394b2ec06d520cb0a4b60bf3498b9d8aa77ab50e693133e7ce4a757069a
Opcode Fuzzy Hash: b8e4f3de8f6e7962c855b1bbff0a6ea575b20ad32e9f870a500b7efad52da8d9
Instruction Fuzzy Hash: DC31A2B0A042559ADF10EF29D8C57C67BE8AF14308F4441BAE844DB393D7BED988CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00418EA8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418EAD
GlobalAddAtomA.KERNEL32(00000000), ref: 00418ECE
GetCurrentThreadId.KERNEL32 ref: 00418EE9
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F0A

Part of subcall function 00423038: 73A1A570.USER32(00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 0042308E
Part of subcall function 00423038: EnumFontsA.GDI32(00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 004230A1
Part of subcall function 00423038: 73A24620.GDI32(00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230A9
Part of subcall function 00423038: 73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230B4

Part of subcall function 004235FC: LoadIconA.USER32(00400000,MAINICON), ref: 0042368C
Part of subcall function 004235FC: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 004236B9
Part of subcall function 004235FC: OemToCharA.USER32(?,?), ref: 004236CC
Part of subcall function 004235FC: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 0042370C

Part of subcall function 0041F088: GetVersion.KERNEL32(?,00418F60,00000000,?,?,?,00000001), ref: 0041F096
Part of subcall function 0041F088: SetErrorMode.KERNEL32(00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0B2
Part of subcall function 0041F088: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0BE
Part of subcall function 0041F088: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0CC
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F0FC
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F125
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F13A
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F14F
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F164
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F179
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F18E
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F1A3
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F1B8
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F1CD

Strings

ControlOfs%.8X%.8X, xrefs: 00418EFB
Delphi%.8X, xrefs: 00418EBF

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$A24620A480A570EnumFileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 3864787166-2767913252
Opcode ID: 1c5da02b922e4aac06326fd948070b9cb60db65944391413fb0283cc291dbe50
Instruction ID: b4a2cca2d4326696562d23f03e9beb5cdbbc64ba536a620a3ee3ba5bc66bdef7
Opcode Fuzzy Hash: 1c5da02b922e4aac06326fd948070b9cb60db65944391413fb0283cc291dbe50
Instruction Fuzzy Hash: 9A1160B06142409AC700FF2A984274A7AE0EB64309F41843FF448DB2A1DB3D9945CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004135AC Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 004135D4
GetWindowLongA.USER32(?,000000F0), ref: 004135DF
GetWindowLongA.USER32(?,000000F4), ref: 004135F1
SetWindowLongA.USER32(?,000000F4,?), ref: 00413604
SetPropA.USER32(?,00000000,00000000), ref: 0041361B
SetPropA.USER32(?,00000000,00000000), ref: 00413632

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 86a15e674b3ea48860a72e4751bd866d9c55aec508b8b4782c27e449c12c4e66
Instruction ID: 44bb5ba5a57c54889193f85f1a8a28b74f903b4ef320443ee5f093ebf11223bc
Opcode Fuzzy Hash: 86a15e674b3ea48860a72e4751bd866d9c55aec508b8b4782c27e449c12c4e66
Instruction Fuzzy Hash: B611C975500244BFDB00DF99DC85E9A3BE8BB19364F114266B928DB2A1D738D9908B68

Uniqueness

Uniqueness Score: -1.00%

Function 004540C4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045425B,?,00000000,0045429B), ref: 004541A1

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00454124
WININIT.INI, xrefs: 004541D0
PendingFileRenameOperations, xrefs: 00454140
PendingFileRenameOperations2, xrefs: 00454170

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 3b606e1cfbb150bd088f74f1063c905db1383d3fd6ed35e0c09aba21d543f6f9
Instruction ID: 8ceaccac1fe58e6261fec66e20af0929b63452d54162f6f6a325dab65676f0d5
Opcode Fuzzy Hash: 3b606e1cfbb150bd088f74f1063c905db1383d3fd6ed35e0c09aba21d543f6f9
Instruction Fuzzy Hash: 0051BA30E001189FDB10DF62DC519DEB7B9EFC4348F5085B7F814AB292DB78AA85CA58

Uniqueness

Uniqueness Score: -1.00%

Function 004639E8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00463A85
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00463AAB

Part of subcall function 00463928: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 004639C0
Part of subcall function 00463928: DestroyCursor.USER32(00000000), ref: 004639D6

SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00463B07
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00463B2D

Strings

c:\directory, xrefs: 00463A80

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Icon$ExtractFileInfo$CursorDestroyDraw
String ID: c:\directory
API String ID: 2926980410-3984940477
Opcode ID: 1a7901e35b7efb8855ed844898b1e62419ded63c9a28a762335ba207438abc47
Instruction ID: 671f662d79a6b5497fd1efd513546b718c4d5ac7f56db0c83477fb4c85f01fd4
Opcode Fuzzy Hash: 1a7901e35b7efb8855ed844898b1e62419ded63c9a28a762335ba207438abc47
Instruction Fuzzy Hash: 5C417F70640288AFD711DF55DC8AFDEBBE8EB48705F1040A6F904DB382D679EE808B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,?), ref: 0042DC88
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DE0B,00000000,0042DE23,?,?,?,?,00000006,?,00000000,00491FBA), ref: 0042DCA3
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DCA9

Strings

RegDeleteKeyExA, xrefs: 0042DC99
advapi32.dll, xrefs: 0042DC9E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: 1ac9f45d9403d68368f5ea09b308c2771ffc131f1d77a79e4eddddbac772e20e
Instruction ID: 479eeeb2458f1cbf9b477f45b3eef1c6296245770f751ec8fb172f928072974a
Opcode Fuzzy Hash: 1ac9f45d9403d68368f5ea09b308c2771ffc131f1d77a79e4eddddbac772e20e
Instruction Fuzzy Hash: 57E06DF0B45230AAD620676B7D4AFA327299B64725F54403BB105A619182FD4C40DE5C

Uniqueness

Uniqueness Score: -1.00%

Function 0047D994 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,0047DCA9,?,?,00000001,?), ref: 0047DAA5
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 0047DB1A

Strings

Need to restart Windows? %s, xrefs: 0047DB57
, xrefs: 0047DBD7

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 3e22ee14f3f5d1664d53e548fd637f0a900ad5636ab224251b622ae2201e353e
Instruction ID: 90cd12f1ce5866ea51d49213f29bb353ee2a99eceb2f679e27348fc142a0b483
Opcode Fuzzy Hash: 3e22ee14f3f5d1664d53e548fd637f0a900ad5636ab224251b622ae2201e353e
Instruction Fuzzy Hash: FD91B170A142448FCB11EB69D882B9E77F1AF55308F5080BBE8049B366DB78AD09DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0046B8B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

GetLastError.KERNEL32(00000000,0046BAB1,?,?,00000001,00497154), ref: 0046B98E
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046BA08
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046BA2D

Strings

Creating directory: %s, xrefs: 0046B976

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: f1ef7acfe29b7a673b9fcf15271b3cde238e02975db7534259ca97311ec57d1b
Instruction ID: 7ea54ca36873d6337a8b148a308a739efa0342075aaa82460d6101fa077cad05
Opcode Fuzzy Hash: f1ef7acfe29b7a673b9fcf15271b3cde238e02975db7534259ca97311ec57d1b
Instruction Fuzzy Hash: 40512F74E00258ABDB01DFE5C482BDEB7F5EF48304F50856AE851A7382D7785E44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004537C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00453876
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,0045393C), ref: 004538E0

Strings

SfcIsFileProtected, xrefs: 00453870
sfc.dll, xrefs: 00453838

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: 9e3a1317458504cf0b4866f9773363e1e3fe743d4d1484e92b4ef5958820482c
Instruction ID: 8896df26e74b4f53e6f77957fc07a02fe6ad1856ac683947f167e21e68caa71d
Opcode Fuzzy Hash: 9e3a1317458504cf0b4866f9773363e1e3fe743d4d1484e92b4ef5958820482c
Instruction Fuzzy Hash: 9D4167B0A042189FEB10DF55DC85B9D77B8AB04346F5041BBB908A7293D7785F48CE5C

Uniqueness

Uniqueness Score: -1.00%

Function 0045262C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0045271B,?,?,00000000,00496628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00452672
GetLastError.KERNEL32(00000000,00000000,?,00000000,0045271B,?,?,00000000,00496628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045267B

Strings

o1I, xrefs: 00452700, 004526B1, 004526BB
.tmp, xrefs: 0045265B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp$o1I
API String ID: 1375471231-2043145612
Opcode ID: 39f560f490c28bb26193b68fab643e582c5ba21350e082ae8330393a6182c15a
Instruction ID: 89aaa5dd644a1bfb9c6e4ab11305a67587a6d25824e33790291d603b6c08dcc0
Opcode Fuzzy Hash: 39f560f490c28bb26193b68fab643e582c5ba21350e082ae8330393a6182c15a
Instruction Fuzzy Hash: 14216575A002089BDB01EFA1C9929DFB7B8EF58305F50457BEC01B7342DA7CAE058AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00451118 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,] I), ref: 00451138
74D41500.VERSION(00000000,?,00000000,?,00000000,004511B3,?,00000000,?,?,?,] I), ref: 00451165
74D41540.VERSION(?,004511DC,?,?,00000000,?,00000000,?,00000000,004511B3,?,00000000,?,?,?,] I), ref: 0045117F

Strings

] I, xrefs: 0045111E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: D41500D41520D41540
String ID: ] I
API String ID: 2153611984-27375975
Opcode ID: ae97c8c8a0c1eba3379072f8b46b7e7df9da348ac85090545a8034cef28368fb
Instruction ID: c2ad28a97d73236a39d00b1522cfa6caf261f6f5eba90309d69346832355d152
Opcode Fuzzy Hash: ae97c8c8a0c1eba3379072f8b46b7e7df9da348ac85090545a8034cef28368fb
Instruction Fuzzy Hash: 5D219235A00508AFDB01DAA98C41EBFB7FCEB49340F5544BAFD00E3392D6799E058769

Uniqueness

Uniqueness Score: -1.00%

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Runtime error at 00000000, xrefs: 00404DBE, 00404DD1
Error, xrefs: 00404DB9

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 8c8c0f2434a4a7f5450b7d1f87c82a5e4d49965682bc3ad0c70a84493f0d02f9
Instruction ID: 7ca15834b35bf0f9f7e67f0c6f6a322a9a8b6c98d325c36795369cb21074e1e4
Opcode Fuzzy Hash: 8c8c0f2434a4a7f5450b7d1f87c82a5e4d49965682bc3ad0c70a84493f0d02f9
Instruction Fuzzy Hash: 9221B360A442418ADB11E7B9ECC1B163F919BE5348F06817BE700B73E6C67C884587AE

Uniqueness

Uniqueness Score: -1.00%

Function 004543FC Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,00454467,?,00000001,00000000), ref: 0045445A

Strings

PendingFileRenameOperations, xrefs: 0045442C
PendingFileRenameOperations2, xrefs: 0045443B
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00454408

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 4d74768cc722451e6c2d7b21cab6517138d2d42bcabe4ec3ebcd03ef8cae5871
Instruction ID: f6b2750a9208994f71abef58e55a78fed862e8850860690132b194e4ac46e676
Opcode Fuzzy Hash: 4d74768cc722451e6c2d7b21cab6517138d2d42bcabe4ec3ebcd03ef8cae5871
Instruction Fuzzy Hash: C0F062313442046FDB04D6A6EC12B5B73ADD7C5B19FA0446AFC009A682DA79AD48D51C

Uniqueness

Uniqueness Score: -1.00%

Function 004211E4 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 004212D1
SetMenu.USER32(00000000,00000000), ref: 004212EE
SetMenu.USER32(00000000,00000000), ref: 00421323
SetMenu.USER32(00000000,00000000), ref: 0042133F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 828adb1f4503573b8b19ec7e50c880e5d7ba93b5c851f867c46ca8f401a21855
Instruction ID: 658f50d7c39b10a4f0c402205ec9e9078e39c2738942e4c3e39302bb3a71e335
Opcode Fuzzy Hash: 828adb1f4503573b8b19ec7e50c880e5d7ba93b5c851f867c46ca8f401a21855
Instruction Fuzzy Hash: 7641BE307002645BEB20AA7AA88579B37914F65308F4845BFFC44EF3A7CA7DCC4582AD

Uniqueness

Uniqueness Score: -1.00%

Function 00417188 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004171D0
SetCursor.USER32(00000000), ref: 00417213
GetLastActivePopup.USER32(?), ref: 0041723D
GetForegroundWindow.USER32(?), ref: 00417244

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 5c878ef1f1aeb2db91bf3432714928a7f2f2769f3bd036598b9914e69cbbf5aa
Instruction ID: 86e626badbabc243afb65fecb2564bdd41232683b3d9035b7095670fd5686afe
Opcode Fuzzy Hash: 5c878ef1f1aeb2db91bf3432714928a7f2f2769f3bd036598b9914e69cbbf5aa
Instruction Fuzzy Hash: BA2183313086018ACB20AB69D889AD737F1AF45714F0645ABF8589B392D73DDC86CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00416AB2 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416AF4
SetTextColor.GDI32(?,00000000), ref: 00416B0E
SetBkColor.GDI32(?,00000000), ref: 00416B28
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416B50

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 1d3cbda9518b2ce12e9cd07cc94b211126e19477f7e649d954dcb8d793c07e3f
Instruction ID: c000e8b01db0500dd6874d208778bcf8efa3d9016d5589f965051e8255cd057a
Opcode Fuzzy Hash: 1d3cbda9518b2ce12e9cd07cc94b211126e19477f7e649d954dcb8d793c07e3f
Instruction Fuzzy Hash: 74115EB2604604AFC710EE6ECC84E8777ECEF49710B15886BB55ADB652C638FC418B79

Uniqueness

Uniqueness Score: -1.00%

Function 004239F4 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(0042398C), ref: 00423A18
GetWindow.USER32(?,00000003), ref: 00423A2D
GetWindowLongA.USER32(?,000000EC), ref: 00423A3C
SetWindowPos.USER32(00000000,004240CC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042411B,?,?,00423CE3), ref: 00423A72

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: b2f5db6fe163c30d8c8c0473a117728a579ec2d7ead3c741ce22ac317b482cf1
Instruction ID: 335c349655b4e4ce664b27c97d7ab575fba50449cb033fde685ace27ceb71c75
Opcode Fuzzy Hash: b2f5db6fe163c30d8c8c0473a117728a579ec2d7ead3c741ce22ac317b482cf1
Instruction Fuzzy Hash: 91115A70700610ABDB10EF68DC85F5A77E8EB08725F11026AF9A4AB2E2C37CDC40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00423038 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 0042308E
EnumFontsA.GDI32(00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 004230A1
73A24620.GDI32(00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230A9
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230B4

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A24620A480A570EnumFonts
String ID:
API String ID: 2630238358-0
Opcode ID: 0130a543140e80f2b9f86b8e83a342749db33d5760528b3305e50fe7c2cc1c24
Instruction ID: 4d68480f6d607538855b0f171b38ffa839f5ce6e0578d669e72114bdc8101102
Opcode Fuzzy Hash: 0130a543140e80f2b9f86b8e83a342749db33d5760528b3305e50fe7c2cc1c24
Instruction Fuzzy Hash: 0601D2616053002AE700BF6A5C82B9B37649F00709F40027BF804AF2C7D6BE9805476E

Uniqueness

Uniqueness Score: -1.00%

Function 00453970 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(00000001,00000032), ref: 0045399C
MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 004539BE
GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 004539CD
CloseHandle.KERNEL32(00000001,004539FA,004539F3,?,00000031,00000080,00000000,?,?,00453D4B,00000080,0000003C,00000000,00453D61), ref: 004539ED

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: d73ba6bc89f5e98173ec20bdde4f08e8ee51d8155801d5fd2e19193da69aa3ab
Instruction ID: f26be41c5c034272f157e269139ed2410fa661b94adc91c278c581610335523b
Opcode Fuzzy Hash: d73ba6bc89f5e98173ec20bdde4f08e8ee51d8155801d5fd2e19193da69aa3ab
Instruction Fuzzy Hash: 3301F9F06006087EEB219B998C06F6BBB9CDB457A1F600167F904D32C2C5F89E00CA69

Uniqueness

Uniqueness Score: -1.00%

Function 00477DA0 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00477DC1
GetLastError.KERNEL32 ref: 00477DCB
GetTickCount.KERNEL32 ref: 00477DD5
Sleep.KERNEL32(00000032), ref: 00477DE5

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 94161a664cb9dfa7c0c09ffa012625f085aafc4756729c7e87c49c9bc36ab8d9
Instruction ID: 455298f4415a448e3fa874f92f6781e0756abc36bce73f1148afe723a625cd3c
Opcode Fuzzy Hash: 94161a664cb9dfa7c0c09ffa012625f085aafc4756729c7e87c49c9bc36ab8d9
Instruction Fuzzy Hash: C3E06D7230DA4446DA3635BF2C866FB4AACCFC6364B28553FE08DD6282C8984C06956A

Uniqueness

Uniqueness Score: -1.00%

Function 0045A940 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00450088: SetEndOfFile.KERNEL32(?,?,0045AA1E,00000000,0045ABA9,?,00000000,00000002,00000002), ref: 0045008F

FlushFileBuffers.KERNEL32(?), ref: 0045AB75

Strings

EndOffset range exceeded, xrefs: 0045AAA9
NumRecs range exceeded, xrefs: 0045AA72

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 284914d50a052015b7c75a6107dacc898a09a70c67966605e73dc69b2178a5f5
Instruction ID: 49fd1ead36e8c92626c0d22f3e04e342ae71ee3369d077df08b87a69a2b16800
Opcode Fuzzy Hash: 284914d50a052015b7c75a6107dacc898a09a70c67966605e73dc69b2178a5f5
Instruction Fuzzy Hash: 68617334A002588FDB24DF25C881BDAB7B5EF49305F0085EAED889B352D674AEC9CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004931D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,004931DE), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,004931DE), ref: 00403356

Part of subcall function 00409AE8: 6F541CD0.COMCTL32(004931ED), ref: 00409AE8

Part of subcall function 004108C4: GetCurrentThreadId.KERNEL32 ref: 00410912

Part of subcall function 00418FB0: GetVersion.KERNEL32(00493201), ref: 00418FB0

Part of subcall function 0044F178: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00493215), ref: 0044F1B3
Part of subcall function 0044F178: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F1B9

Part of subcall function 0044F55C: GetVersionExA.KERNEL32(00496780,0049321A), ref: 0044F56B

Part of subcall function 00451DF8: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451E91,?,?,?,?,00000000,?,00493224), ref: 00451E18
Part of subcall function 00451DF8: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451E1E
Part of subcall function 00451DF8: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451E91,?,?,?,?,00000000,?,00493224), ref: 00451E32
Part of subcall function 00451DF8: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451E38

Part of subcall function 00460EAC: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00493238), ref: 00460EBB
Part of subcall function 00460EAC: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00460EC1

Part of subcall function 00468C50: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 00468C65

Part of subcall function 00474088: GetModuleHandleA.KERNEL32(kernel32.dll,?,00493242), ref: 0047408E
Part of subcall function 00474088: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 0047409B
Part of subcall function 00474088: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 004740AB

Part of subcall function 00490338: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 00490351

SetErrorMode.KERNEL32(00000001,00000000,0049328A), ref: 0049325C

Part of subcall function 00492FE0: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00493266,00000001,00000000,0049328A), ref: 00492FEA
Part of subcall function 00492FE0: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00492FF0

Part of subcall function 00424444: SendMessageA.USER32(?,0000B020,00000000,?), ref: 00424463

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

ShowWindow.USER32(?,00000005,00000000,0049328A), ref: 004932CD

Part of subcall function 0047D0AC: SetActiveWindow.USER32(?), ref: 0047D150

Strings

Setup, xrefs: 004932B3

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF541FormatLibraryLineLoadMessageModeRegisterSendShowTextThread
String ID: Setup
API String ID: 1894428048-3839654196
Opcode ID: e253acae3d79c720c49bda8c36fe9e2b0bd9ede0ac4c29c2e6fb5136b58f06d3
Instruction ID: 779a321fc15f42447a8f0963ad68d9f2a93317841f7d3acf2e890d1de8ee30c9
Opcode Fuzzy Hash: e253acae3d79c720c49bda8c36fe9e2b0bd9ede0ac4c29c2e6fb5136b58f06d3
Instruction Fuzzy Hash: 0531A3312146409FDB11BBB7AC1351D3BA4EB8A71DBA2447FF804C2653CE3D5C548A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00453C84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 00453D18
GetLastError.KERNEL32(0000003C,00000000,00453D61,?,?,00000001,00000001), ref: 00453D29

Part of subcall function 00453970: WaitForInputIdle.USER32(00000001,00000032), ref: 0045399C
Part of subcall function 00453970: MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 004539BE
Part of subcall function 00453970: GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 004539CD
Part of subcall function 00453970: CloseHandle.KERNEL32(00000001,004539FA,004539F3,?,00000031,00000080,00000000,?,?,00453D4B,00000080,0000003C,00000000,00453D61), ref: 004539ED

Strings

<, xrefs: 00453CCC

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Wait$CloseCodeErrorExecuteExitHandleIdleInputLastMultipleObjectsProcessShell
String ID: <
API String ID: 35504260-4251816714
Opcode ID: 788435f46bc4c63fd7636eca0852d7f1769961e84bbe6081cf0c5bdf5c797a66
Instruction ID: 33ba34e09f30df1b12b73ce0116b213a2e15e307ba7a65c56a6979caf0e15077
Opcode Fuzzy Hash: 788435f46bc4c63fd7636eca0852d7f1769961e84bbe6081cf0c5bdf5c797a66
Instruction Fuzzy Hash: 3C2153B0600209ABDB11DF65D8826DE7BF8AF09396F50443AF844E7381D7789E49CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004513F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,dE,00000000,004564D0,?,?,?,00000000,0045146A,?,?,?,00000001), ref: 00451444
GetLastError.KERNEL32(00000000,00000000,?,?,dE,00000000,004564D0,?,?,?,00000000,0045146A,?,?,?,00000001), ref: 0045144C

Strings

dE, xrefs: 00451436, 00451439

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID: dE
API String ID: 2919029540-3809906464
Opcode ID: 721ffe35d6e65d1fd1cf9db2e24978e6b55250b9ec7c9eced588239fae4a6160
Instruction ID: 6a74b67a3bdf66ca54efcfc0657381ecd904da166113fafb2436bbcb0ae12e28
Opcode Fuzzy Hash: 721ffe35d6e65d1fd1cf9db2e24978e6b55250b9ec7c9eced588239fae4a6160
Instruction Fuzzy Hash: E1117972600208AF8B00DEA9DC41EDFB7ECEB4D310B114566FD18D3212D638AD15CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004776B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,00477936,00000000,0047794C,?,?,?,?,00000000), ref: 00477712

Strings

RegisteredOwner, xrefs: 004776EF
RegisteredOrganization, xrefs: 00477701

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 5da0313d24de2a72906f0e02df73607d497778b3bd604c1f31dadd7d7b78e1f2
Instruction ID: 44da9ba76ca96eafcd406259b3cb4b8fe95da4c4325a64976e48815ca65e7baf
Opcode Fuzzy Hash: 5da0313d24de2a72906f0e02df73607d497778b3bd604c1f31dadd7d7b78e1f2
Instruction Fuzzy Hash: 94F0593470C244AFDB04D6A5EC52BAB3B9AD740308FA4807BA544CB391C67CBD05D74C

Uniqueness

Uniqueness Score: -1.00%

Function 004231AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 004231B9
LoadCursorA.USER32(00000000,00000000), ref: 004231E3

Strings

EI, xrefs: 004231C6

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CursorLoad
String ID: EI
API String ID: 3238433803-1715459816
Opcode ID: cf7d116e50ce189f5790faa080c989bb411d79830bfeb1cde74da96b9f6355ff
Instruction ID: e763212e35d88e91f52bf3e5ce882ef76e84b1945e438db40d164ba05c470673
Opcode Fuzzy Hash: cf7d116e50ce189f5790faa080c989bb411d79830bfeb1cde74da96b9f6355ff
Instruction Fuzzy Hash: 1DF0A7117001145BD620593E6CC1D3A72688F87736B61033BFE2AD72D1C62E2D51426D

Uniqueness

Uniqueness Score: -1.00%

Function 00470F48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047117F), ref: 00470F6D
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047117F), ref: 00470F84

Part of subcall function 004520A4: GetLastError.KERNEL32(00000000,00452B15,00000005,00000000,00452B4A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00492A61,00000000), ref: 004520A7

Strings

CreateFile, xrefs: 00470F79

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 7d7f0adbb495ba2e141194a5ba8799ea20fff4202c1297b42232a8d62608c13e
Instruction ID: 4dce3a0fb710f8058c99a71000b1262451dde5c1e1bb000cefd451e94b844243
Opcode Fuzzy Hash: 7d7f0adbb495ba2e141194a5ba8799ea20fff4202c1297b42232a8d62608c13e
Instruction Fuzzy Hash: C4E06D74341304BFEA20E669DCC6F4977889B04728F108152FA48AF3E2C6F9EC408658

Uniqueness

Uniqueness Score: -1.00%

Function 0046ADDC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,TqI,00000004,00000001,?,0046B40F,?,?,00000000,0046B4F7,?,_is1,?), ref: 0046ADEF

Strings

NoModify, xrefs: 0046ADED
TqI, xrefs: 0046ADE5, 0046ADE8

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Value
String ID: NoModify$TqI
API String ID: 3702945584-2484388882
Opcode ID: f5a2910f86b5d4890aa6fcbcf0034d47aef96215c39c1bb137200c97013dc63d
Instruction ID: 388a847686ab158aae351853834ee3a19678c554c0d9cb8fd514d48c61279f2c
Opcode Fuzzy Hash: f5a2910f86b5d4890aa6fcbcf0034d47aef96215c39c1bb137200c97013dc63d
Instruction Fuzzy Hash: F4E04FB0640704BFEB04DB55CD4AF6B77ACDB48714F104059BA08EB281E674FE10CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC54 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

Strings

OG, xrefs: 0042DC6A, 0042DC6D
System\CurrentControlSet\Control\Windows, xrefs: 0042DC6E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Open
String ID: OG$System\CurrentControlSet\Control\Windows
API String ID: 71445658-2870956291
Opcode ID: cac79e148e5d1637301d0cd401e0a8768c8b40d51dfb76d9d00be79e5a4099f3
Instruction ID: fabb803f5ff523eeab3b7a035bb747b9213277980d9d81731b2bf545c5070290
Opcode Fuzzy Hash: cac79e148e5d1637301d0cd401e0a8768c8b40d51dfb76d9d00be79e5a4099f3
Instruction Fuzzy Hash: EDD0C772910128BBDB10DA89DC41DF7775DDB59760F54401AFD0497141C1B4EC5197F4

Uniqueness

Uniqueness Score: -1.00%

Function 00468C50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E1F0: SetErrorMode.KERNEL32(00008000), ref: 0042E1FA
Part of subcall function 0042E1F0: LoadLibraryA.KERNEL32(00000000,00000000,0042E244,?,00000000,0042E262,?,00008000), ref: 0042E229

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 00468C65

Strings

shell32.dll, xrefs: 00468C5A
SHPathPrepareForWriteA, xrefs: 00468C50

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 508af3c658affefe6038fbba91c66eaedd781a48fc4f31e111b442a49285859a
Instruction ID: f54d236eaa647a004fc156d77ac0774b12b8f86e94465ae50302f3b70839ea38
Opcode Fuzzy Hash: 508af3c658affefe6038fbba91c66eaedd781a48fc4f31e111b442a49285859a
Instruction Fuzzy Hash: FDB092A064271082CE006BB2584271B22149750744B10C57FB040AA295EE7D88044FBE

Uniqueness

Uniqueness Score: -1.00%

Function 0047C760 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,0047C898), ref: 0047C830
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 0047C841
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 0047C859

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: 103ad35a9952b07d56bdb3bad9c34a645578be9cba599f62803875c0b4fd2168
Instruction ID: 938ecdfec97688d9e91313a56ab48558b9b04f1f4dc78c4c1ee95835cae09dfe
Opcode Fuzzy Hash: 103ad35a9952b07d56bdb3bad9c34a645578be9cba599f62803875c0b4fd2168
Instruction Fuzzy Hash: BA31CF307143455AD710FB768CC2B9A3A989B51318F55947FF904AA2D3CA7C9C09C66E

Uniqueness

Uniqueness Score: -1.00%

Function 0044ADC0 Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00000000,00000000,0044AEC1,?,0047D0C7,?,?), ref: 0044AE35
SelectObject.GDI32(?,00000000), ref: 0044AE58
73A1A480.USER32(00000000,?,0044AE98,00000000,0044AE91,?,00000000,?,00000000,00000000,0044AEC1,?,0047D0C7,?,?), ref: 0044AE8B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A480A570ObjectSelect
String ID:
API String ID: 1230475511-0
Opcode ID: 91444e5bf131007ac93604d47e6fc7e18e34c23fefa9c833d2c38518ec62aedf
Instruction ID: 233d7bfbdcc25e67ff0a572e229f91d747dfb26028a93c536af8bc2826ebb7c8
Opcode Fuzzy Hash: 91444e5bf131007ac93604d47e6fc7e18e34c23fefa9c833d2c38518ec62aedf
Instruction Fuzzy Hash: D721B570E84208AFEB01DFA5C841B9F7BB9DB48304F51847AF504A6281C77C9950CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0044AAF4 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044AB80,?,0047D0C7,?,?), ref: 0044AB52
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044AB65
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044AB99

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID:
API String ID: 65125430-0
Opcode ID: 145cb60817e1461b02aba970f6a399deb92e78d362c3eca44f3c4fb02434d21d
Instruction ID: de988064b5c118741e346c03ff1e8b17db840b4da88b1af59de34c2d8924ec6d
Opcode Fuzzy Hash: 145cb60817e1461b02aba970f6a399deb92e78d362c3eca44f3c4fb02434d21d
Instruction Fuzzy Hash: D811E6B27446447FE711DAAA8C81D6FB7EDDB88724F10413AF604E7280C6389E018669

Uniqueness

Uniqueness Score: -1.00%

Function 0042436C Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424382
TranslateMessage.USER32(?), ref: 004243FF
DispatchMessageA.USER32(?), ref: 00424409

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 4c72fe453077d3d5441811771d3c73f57da1beb0f02e586e781598996b195a0c
Instruction ID: aef1b0206ccdbb2aa8587e86ea6dacd49c82d9c27d6d10fa8c02d352bba97142
Opcode Fuzzy Hash: 4c72fe453077d3d5441811771d3c73f57da1beb0f02e586e781598996b195a0c
Instruction Fuzzy Hash: 6F11543030432056DA20E665A94179B73D4DFC1B44F80886EF9DD97382D77D9D4987AA

Uniqueness

Uniqueness Score: -1.00%

Function 004165B4 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 004165DA
SetPropA.USER32(00000000,00000000), ref: 004165EF
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 00416616

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 1283a2ba918a1a05b7609b6f7b848b7b983b1697ade3d6b61c1960e914505d94
Instruction ID: 49560f5f00ee2c9135054c0b38937f4b9f373f0e35015079742173c5fde362c9
Opcode Fuzzy Hash: 1283a2ba918a1a05b7609b6f7b848b7b983b1697ade3d6b61c1960e914505d94
Instruction Fuzzy Hash: C3F0BD71701220BBEB10AB599C85FA632DCAB09715F16057ABE09EF286C778DC44C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 004014E4 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Strings

@dI, xrefs: 00401522

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: @dI
API String ID: 2087232378-2169111365
Opcode ID: ac11951010fca1e09d027c43c8ed5b4b578696c80165eb8de0d03b95ec4bb515
Instruction ID: 1d7fc67d8943aca9bd8b7424c3d760102f2274f63a1bf98f742a2cdc6a51162d
Opcode Fuzzy Hash: ac11951010fca1e09d027c43c8ed5b4b578696c80165eb8de0d03b95ec4bb515
Instruction Fuzzy Hash: 28F0A772B0073067EB605A6A4C81F5359C49FC5B94F154076FD0DFF3E9D6B58C0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDC4 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EDD4
IsWindowEnabled.USER32(?), ref: 0041EDDE
EnableWindow.USER32(?,00000000), ref: 0041EE04

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: f1041f771c00274fafaec7c92c8c7bfa6f382932e423aeab5ff933265dcc9458
Instruction ID: feef2f1e36016e7b5cf4fb144cadbc7ab6d373431457e94ba2eb74728d462d7d
Opcode Fuzzy Hash: f1041f771c00274fafaec7c92c8c7bfa6f382932e423aeab5ff933265dcc9458
Instruction Fuzzy Hash: B9E0E5B41003006BD711AF67DC85E57769CBB94314F568437AD0597793EA3ED8418AB8

Uniqueness

Uniqueness Score: -1.00%

Function 00408544 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040867A), ref: 00408563

Part of subcall function 00406D54: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406D71

Part of subcall function 004084D0: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004964C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Strings

1I, xrefs: 0040857E, 0040858C, 004085A9, 004085B7, 004085FD, 0040860B, 0040862A, 00408638, 0040866C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID: 1I
API String ID: 1658689577-762079770
Opcode ID: 6e8303e27ed7ddfbf6acd002e5c720f3c58af445dc5c20a44dc96457956c1da1
Instruction ID: 74dcf24fece9135f842d9e2340cbc50c81b3ec91f87ebb2824f4d2ce1649f107
Opcode Fuzzy Hash: 6e8303e27ed7ddfbf6acd002e5c720f3c58af445dc5c20a44dc96457956c1da1
Instruction Fuzzy Hash: E7316375E00109ABCF00EF95C8819EEB7B9FF84314F118577E815BB285E738AE058B98

Uniqueness

Uniqueness Score: -1.00%

Function 0047D0AC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0047D150

Strings

InitializeWizard, xrefs: 0047D0F3

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 038b7c38db58c59d67e8228af690c5637e12a303fd43e9fe68323246a680d7fe
Instruction ID: 27c915d5e84757d1ee1c922a0b45ecd3517ff57706a6a9b1ea1830c72a43ed0f
Opcode Fuzzy Hash: 038b7c38db58c59d67e8228af690c5637e12a303fd43e9fe68323246a680d7fe
Instruction Fuzzy Hash: 9811C2306382009FD710EB29EC82B5A7BF5EB15724F50403BE808872A2DA39AC50CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00477DF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00477E3C

Strings

Failed to remove temporary directory: , xrefs: 00477E55

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: bf8459b4568011569589267856632f7437084f82826b889116ec1ad329c74b80
Instruction ID: f6f29f8194de21b7fd04b1898db3775e9a4ec43a4ec883b7b0c80518b3716d1c
Opcode Fuzzy Hash: bf8459b4568011569589267856632f7437084f82826b889116ec1ad329c74b80
Instruction Fuzzy Hash: 5F01B530218604AADB21EB75DC43B9F37A8DB15708FE188B7F804A6292D77CAD44865C

Uniqueness

Uniqueness Score: -1.00%

Function 004775CC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,00477812,00000000,0047794C), ref: 00477611

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004775E1

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 225175c1cb3e5d3e9e70e9ef9a971fa01c6206b910d71101a0ac37fcff0035a7
Instruction ID: 814c6dcea663d1405d948e9489940348151ed5d62cb49aab8d6aacd0da240b25
Opcode Fuzzy Hash: 225175c1cb3e5d3e9e70e9ef9a971fa01c6206b910d71101a0ac37fcff0035a7
Instruction Fuzzy Hash: C7F0A7317085146BDA00A65E6D42B9FA6DDCB84778F60443BF608EB346DABDDE0243AD

Uniqueness

Uniqueness Score: -1.00%

Function 0046AD6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,00497154,?,0046B06F,?,00000000,0046B4F7,?,_is1), ref: 0046AD8F

Strings

Inno Setup: Setup Version, xrefs: 0046AD8D

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version
API String ID: 3702945584-4166306022
Opcode ID: b5001300976c311ff63bf81daa3498fb24628c1a8b44004d588d325ece062412
Instruction ID: 411328d8211db58a77dae3404ef256999053971fa6961c2aedf3cbf650fcdf7d
Opcode Fuzzy Hash: b5001300976c311ff63bf81daa3498fb24628c1a8b44004d588d325ece062412
Instruction Fuzzy Hash: 7FE06D713016043FD710AA6ADC85F5BBADCDF88365F10403AB908EB392D578DD0085A9

Uniqueness

Uniqueness Score: -1.00%

Function 00452BE4 Relevance: 3.2, APIs: 2, Instructions: 190fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00452E17,?,00000000,00452E81,?,?,-00000001,00000000,?,00477E51,00000000,00477DA0,00000000), ref: 00452DF3
FindClose.KERNEL32(000000FF,00452E1E,00452E17,?,00000000,00452E81,?,?,-00000001,00000000,?,00477E51,00000000,00477DA0,00000000,00000001), ref: 00452E11

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 653b7fe48d33ea674ac97055cb2f18e1885e4578e85f3b019f33a79870c9752c
Instruction ID: 02b97b2915f0d5af3a60b1074a0ce76f3061349a54ef9b2b3eb99e2ccc93669a
Opcode Fuzzy Hash: 653b7fe48d33ea674ac97055cb2f18e1885e4578e85f3b019f33a79870c9752c
Instruction Fuzzy Hash: 9C818C30A0424D9BCB12DF65C9457EFBBB4AF4A305F1480ABE84467392D3789A4ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042DA38 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DB70), ref: 0042DA74
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DB70), ref: 0042DAE4

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fe899f6043c7f770a4508ac600d0d0e70af19fa3b1a52c17f713553a047210da
Instruction ID: de7305fe23da407263f6a21fe748e6d6d926aae016943a7179aec9e2dd5a457b
Opcode Fuzzy Hash: fe899f6043c7f770a4508ac600d0d0e70af19fa3b1a52c17f713553a047210da
Instruction Fuzzy Hash: 4F417171E04129AFDF10DF91D891BAFBBB8EB01704F918466E810B7240D778BE04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042DCF8 Relevance: 3.1, APIs: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DDF6,?,?,00000008,00000000,00000000,0042DE23), ref: 0042DD8C
RegCloseKey.ADVAPI32(?,0042DDFD,?,00000000,00000000,00000000,00000000,00000000,0042DDF6,?,?,00000008,00000000,00000000,0042DE23), ref: 0042DDF0

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: b395eec5d444746d883dbbe68a26dc186a8be4d3543415a8a9a06ae4829f6fc1
Instruction ID: 4db75c3f0003ee77c81ad7234f2e5e1b513bc4eba3d2eee43a500da64a91fe5e
Opcode Fuzzy Hash: b395eec5d444746d883dbbe68a26dc186a8be4d3543415a8a9a06ae4829f6fc1
Instruction Fuzzy Hash: 4931B270F04649AFDB14DFA6DC52BAFBBB9EB48304F90407BE400F7281D6785A01CA29

Uniqueness

Uniqueness Score: -1.00%

Function 00471EEC Relevance: 3.1, APIs: 2, Instructions: 89timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,00471FE3,?,00000000,00471FF4,?,00000000,0047203D), ref: 00471FB4
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,00471FE3,?,00000000,00471FF4,?,00000000,0047203D), ref: 00471FC8

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FileTime$Local
String ID:
API String ID: 791338737-0
Opcode ID: 794f3dc64775d537c36396be29bb059d918ede0e47b95337b39c4db572ec4a4f
Instruction ID: 1c2ecd431e7be2e6a04f09c76b7068abadfd7dca7c6163eacf0d26531580d3b4
Opcode Fuzzy Hash: 794f3dc64775d537c36396be29bb059d918ede0e47b95337b39c4db572ec4a4f
Instruction Fuzzy Hash: A8319570A14245AFCB11DFA5C892FAFBBBCEB09704F41857AF904A7391D7799900CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF38 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040AF52
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B0AF,00000000,0040B0C7,?,?,?,00000000), ref: 0040AF63

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 495ed283f31991be558d7aaf91bbf96f1b13b17f58e3dd61e94c2b353b9623af
Instruction ID: d0e6d2b3de5701a5b01f0c314f0e154d100cb3f2f79c9d4e2e087994511e300e
Opcode Fuzzy Hash: 495ed283f31991be558d7aaf91bbf96f1b13b17f58e3dd61e94c2b353b9623af
Instruction Fuzzy Hash: 7701F7B1704300AFD700EF69DC92E1A77EDDB897187128076F500EB3D0DA799C119669

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE14 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EE63
73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042E908,?,00000001), ref: 0041EE69

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A25940CurrentThread
String ID:
API String ID: 2655091166-0
Opcode ID: b328251ae0892c8a3b7f185b32438ae157af80a37aa78e1151a8addd2e42d252
Instruction ID: 6dec67758a4febc774e22da3091525d30ea0c4d8bfc57ce8b44416be19a69247
Opcode Fuzzy Hash: b328251ae0892c8a3b7f185b32438ae157af80a37aa78e1151a8addd2e42d252
Instruction Fuzzy Hash: C3015B74A04704AFD701CFA6EC11956BBE8E789720B22887BE904D37A0EA385811DE18

Uniqueness

Uniqueness Score: -1.00%

Function 0040170C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Strings

@dI, xrefs: 0040173B, 0040177B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FreeVirtual
String ID: @dI
API String ID: 1263568516-2169111365
Opcode ID: 09cabece21cf584f7b8116981dfbad3f8653d6c5a4f55eb454a10d9661d4edbc
Instruction ID: dd39995c24d96b1f0cd65365fb3acc738aa13d81c460f04ccbda7f03c85f078f
Opcode Fuzzy Hash: 09cabece21cf584f7b8116981dfbad3f8653d6c5a4f55eb454a10d9661d4edbc
Instruction Fuzzy Hash: 6D01FC766442148FC3109F69DCC0E2677E8D794378F16453EDA85673A1D37A6C018BDC

Uniqueness

Uniqueness Score: -1.00%

Function 00451888 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 004518CA
GetLastError.KERNEL32(00000000,00000000,00000000,004518F0), ref: 004518D2

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: f3ad4f44ceacd585dee16951dfbaa1082e400ba5ca539f9748169f50d7182093
Instruction ID: 4a908479c274ede1fa612a67027dcf523005e30280c6ec4e7261d6cc76548501
Opcode Fuzzy Hash: f3ad4f44ceacd585dee16951dfbaa1082e400ba5ca539f9748169f50d7182093
Instruction Fuzzy Hash: B9014971B00304AF9B10FFB99C4259EB7ECDB8832171045BBFC08E3652EA384E048558

Uniqueness

Uniqueness Score: -1.00%

Function 00451378 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004513D7), ref: 004513B1
GetLastError.KERNEL32(00000000,00000000,00000000,004513D7), ref: 004513B9

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 197182aaa49433fd3799853223fcc209063c3f4e9f2456be790aeadb59ae410a
Instruction ID: 9b23b03b90933790c580962e112c838e42041695dbfb4577ddf6274ef4a18e8c
Opcode Fuzzy Hash: 197182aaa49433fd3799853223fcc209063c3f4e9f2456be790aeadb59ae410a
Instruction Fuzzy Hash: 2EF0C871A04708BBEB00EFB5AC516AEB7E8EB09315F5045B7FC04E3A52E6794E148698

Uniqueness

Uniqueness Score: -1.00%

Function 00451510 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,0045156D,?,-00000001,?), ref: 00451547
GetLastError.KERNEL32(00000000,00000000,0045156D,?,-00000001,?), ref: 0045154F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 57c66947cca5991d3db99b7c639db2cee09b7ba3c0ed0f7350b02f287166f6c5
Instruction ID: e24a99369ca00d653b3fc93966ede53447ba658949af1692c14fa660c0f258d5
Opcode Fuzzy Hash: 57c66947cca5991d3db99b7c639db2cee09b7ba3c0ed0f7350b02f287166f6c5
Instruction Fuzzy Hash: A6F02871E00308BBCF00EFB59C4259EB3E8DB4831175049B7FC15E3662F6384E048598

Uniqueness

Uniqueness Score: -1.00%

Function 00451A18 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,00451A75,?,-00000001,00000000), ref: 00451A4F
GetLastError.KERNEL32(00000000,00000000,00451A75,?,-00000001,00000000), ref: 00451A57

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 66dd74d3f875883c26a97436bb4ac4ce631447a2e58d6a40b8a0c13ee2664326
Instruction ID: a4972dc580858431ea76902efd1aedaa5458d24b8279bd81c51e3053393522ee
Opcode Fuzzy Hash: 66dd74d3f875883c26a97436bb4ac4ce631447a2e58d6a40b8a0c13ee2664326
Instruction Fuzzy Hash: 93F0C271A05708AB9B01EFB5AC516AEB3E8EB0831575049B7FC04E3652E7785E048598

Uniqueness

Uniqueness Score: -1.00%

Function 0042E1F0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E1FA
LoadLibraryA.KERNEL32(00000000,00000000,0042E244,?,00000000,0042E262,?,00008000), ref: 0042E229

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 47d034d6c104ad3889763985cd5d076ad7b368865af99a999868f5179706add0
Instruction ID: 2bd629673230950b16c4bb4544665cc4d3578012b9e0763c9fae70ecea85f9d4
Opcode Fuzzy Hash: 47d034d6c104ad3889763985cd5d076ad7b368865af99a999868f5179706add0
Instruction Fuzzy Hash: 31F08270714744FEDF019F779C6282BBBECE74DB1479249B6F800A2691E63C5810C939

Uniqueness

Uniqueness Score: -1.00%

Function 00450054 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,0046C065,?,00000000), ref: 0045006A
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,0046C065,?,00000000), ref: 00450072

Part of subcall function 0044FE10: GetLastError.KERNEL32(0044FC2C,0044FED2,?,00000000,?,00492588,00000001,00000000,00000002,00000000,004926E9,?,?,00000005,00000000,0049271D), ref: 0044FE13

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: c60135f50bbb281d7793e671e93e1976bdba8d3d8f9166c58eed3528ee47267f
Instruction ID: 619d70630f7d728e19568b0c26e44efacd411b086580920acadf97a9c9154113
Opcode Fuzzy Hash: c60135f50bbb281d7793e671e93e1976bdba8d3d8f9166c58eed3528ee47267f
Instruction Fuzzy Hash: F9E012B53042016BEB10EAA5A9C1F3B23DCEF44715F10447EB944CF183D674CC054B69

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF64 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EF7E
73A25940.USER32(00000000,0041EF00,00000000,00424036,?,00000000,004240CC), ref: 0041EF84

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A25940CurrentThread
String ID:
API String ID: 2655091166-0
Opcode ID: 1e51a69d22359fe57c3349ead92f96c594880110c417ab77ffcbdb1adb02fee0
Instruction ID: 4a2654b4922951af120f300f6371b31d1f7ec6cfd98fc3bc871b571f4259df04
Opcode Fuzzy Hash: 1e51a69d22359fe57c3349ead92f96c594880110c417ab77ffcbdb1adb02fee0
Instruction Fuzzy Hash: 71E02671600200AFDF10DBB5ED45F5537A9A791734F124C37AA04D62A1EA7858429A08

Uniqueness

Uniqueness Score: -1.00%

Function 00478F74 Relevance: 1.6, APIs: 1, Instructions: 128windowCOMMON

Download Yara Rule

APIs

SendNotifyMessageA.USER32(0002047E,00000496,00002711,00000000), ref: 0047912C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: MessageNotifySend
String ID:
API String ID: 3556456075-0
Opcode ID: 1bf78a2a4972fbb2a73e3495687c09ee27ad1c961f8a5cc689fdc3f33d66a45c
Instruction ID: 7d22008d7a83e2500ddd5853d1c98629ae082a9ef6797e0e4edc72868eccde80
Opcode Fuzzy Hash: 1bf78a2a4972fbb2a73e3495687c09ee27ad1c961f8a5cc689fdc3f33d66a45c
Instruction Fuzzy Hash: 884142343240009BCB10FF26D88598A7BA5EB50309B65C5BBB8049F3A7CA3DDD46DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0046A1C4 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

756FE550.OLE32(00494B14,00000000,00000001,00494B24,00497054), ref: 0046A2B9

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: E550
String ID:
API String ID: 734438002-0
Opcode ID: 1a96fdbb3e90de8797b7c34e8fd7761ef28502cc93813c311678e4427fcc9a8f
Instruction ID: 28ea0cda059d87ed8d6f055d3f11cf2141d1ab261bbca5563b99c48b31e217e3
Opcode Fuzzy Hash: 1a96fdbb3e90de8797b7c34e8fd7761ef28502cc93813c311678e4427fcc9a8f
Instruction Fuzzy Hash: 1731BC303686008FD750DB19D895B6A73E1EB95314F6082BBF8489B3A1E779EC41CB4E

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB0C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FBA9

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: 50e1310ba0544b59a0555e2be0f3aefd4cf1699031129a7841ddf0d9dd467a2f
Instruction ID: 884c2cb002146e47c45dd1875db58eae66db6a4caaf859e9ca4b80fd75174b4c
Opcode Fuzzy Hash: 50e1310ba0544b59a0555e2be0f3aefd4cf1699031129a7841ddf0d9dd467a2f
Instruction Fuzzy Hash: DD2130716087456FC340DF39D840696BBE4BB48344F148A3EA098C3341D774E99ACBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00468368 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EE14: GetCurrentThreadId.KERNEL32 ref: 0041EE63
Part of subcall function 0041EE14: 73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042E908,?,00000001), ref: 0041EE69

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,004683C6,?,00000000,?,?,004685D3,?,00000000,00468612), ref: 004683AA

Part of subcall function 0041EEC8: IsWindow.USER32(8BF0EBFF), ref: 0041EED6
Part of subcall function 0041EEC8: EnableWindow.USER32(8BF0EBFF,00000001), ref: 0041EEE5

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$A25940CurrentEnablePathPrepareThreadWrite
String ID:
API String ID: 390483697-0
Opcode ID: 467ce9893c8a2b941d671877d34955771c88eccab2483bb784be52c54abd03e3
Instruction ID: 1e6c9ee491f26ebb38a393fd70065da3d13cda2054ea28a361ce8fb2712a9f85
Opcode Fuzzy Hash: 467ce9893c8a2b941d671877d34955771c88eccab2483bb784be52c54abd03e3
Instruction Fuzzy Hash: F0F0E9B1258300BFE7159B72EC56B1677E8E314B15F51447FF804C66D0EA7A5890C62D

Uniqueness

Uniqueness Score: -1.00%

Function 004164C0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 004164F5

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cdcc0148ce654954751abbafc01dffb42bdee5d1888213000ee0bb92e9214fa3
Instruction ID: a44329a4cc8b06b024a2b0eee2fd8d89e642962040674eee811c3e7967e458ca
Opcode Fuzzy Hash: cdcc0148ce654954751abbafc01dffb42bdee5d1888213000ee0bb92e9214fa3
Instruction Fuzzy Hash: F5F025B2200510AFDB84CF9CD9C0F9373ECEB0C210B0981A6FA08CF24AD220EC108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00414924 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 0041495F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0042CBA8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CBF0,?,00000001,?,?,00000000,?,0042CC42,00000000,0045162D,00000000,0045164E,?,00000000), ref: 0042CBD3

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fb728ae1967c572744be537d183b1c2397660519459ab9e6793d4da77068addf
Instruction ID: dfed850972a7f4cfed0b3d6ce6ead54829112a593105f6481b619d55be1254e6
Opcode Fuzzy Hash: fb728ae1967c572744be537d183b1c2397660519459ab9e6793d4da77068addf
Instruction Fuzzy Hash: 1AE06571304708BFD701EB62AC93E5EBBACD745714B914876B400A7651D5B8AE00845C

Uniqueness

Uniqueness Score: -1.00%

Function 0044FF20 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0044FF60

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a92cf0aa8bb23f57ccdc9442b6704fbd4576b7ac5b6e0326e42d432a692528ee
Instruction ID: 45ed5e217c844315310d89a20c49d2eff003bfa8467b370b0955f01a950c20be
Opcode Fuzzy Hash: a92cf0aa8bb23f57ccdc9442b6704fbd4576b7ac5b6e0326e42d432a692528ee
Instruction Fuzzy Hash: 39E0EDA53541583ED240AABCBC52F9767DC9759754F008033B998D7241D4619A158BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042E670 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451E7B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E68F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 860b655ccada46b5013a8742cf2038536e52ba062f8b3e277fa769ce81e13b95
Instruction ID: 7c82c80d86496392c3130c3e7de8882f0dfcc9e316fc406f93a4df2216b263d5
Opcode Fuzzy Hash: 860b655ccada46b5013a8742cf2038536e52ba062f8b3e277fa769ce81e13b95
Instruction Fuzzy Hash: 21E026617843112AF23514567C83B7F1A4E83C0B04FE4842B7B00DE3C3DAAEAD09429E

Uniqueness

Uniqueness Score: -1.00%

Function 00406300 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,004235EC,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 00406329

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 1d12608fc0467a25e6c73015cc4d191371d7057fe5102c86e19c90aa3d4ae925
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: 4CE002B2204309BFDB00DE8ADDC1DABB7ACFB4C654F844105BB1C972428275AD608BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC1C Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC48

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4676b834bccda8ccd94f8a4f379db04665fbdc7bc7b85aab9c145464b6c6dbba
Instruction ID: 5aa87c08ff8936fcaaa84cf50ff31e6a06e3de0a8084b04fc6442f63f77fe161
Opcode Fuzzy Hash: 4676b834bccda8ccd94f8a4f379db04665fbdc7bc7b85aab9c145464b6c6dbba
Instruction Fuzzy Hash: BDE07EB2600129AF9B40DE8DDC81EEB37ADAB1D350F404016FA08D7200C2B4EC519BB4

Uniqueness

Uniqueness Score: -1.00%

Function 004536BC Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0046C888,00000000,0046D681,?,00000000,0046D6CA,?,00000000,0046D803,?,00000000,?,00000000), ref: 004536D2

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 7d5519857b665cbbf82b8b35f439f608cfeada5da546942c6fbe9b0196f0527a
Instruction ID: eca53ef0c4505d94b6e963a585f564cfd6265b0c9c03d819447d58a966c2af15
Opcode Fuzzy Hash: 7d5519857b665cbbf82b8b35f439f608cfeada5da546942c6fbe9b0196f0527a
Instruction Fuzzy Hash: 49E065705047004BCB24DF3A848121A7AD15F84321F08C56AAC58CB396E63DC4199616

Uniqueness

Uniqueness Score: -1.00%

Function 004145EC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00490192,?,004901B4,?,?,00000000,00490192,?,?), ref: 0041460B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00406E78 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406E8C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a86332fa630e211a890a26f820a456cfae7ee7da2a92b38f798d74d6102b1500
Instruction ID: 5e9ef0cb41ef517b54198f539e7e4457f1ce254f1207c5e451c0fee893fabf4d
Opcode Fuzzy Hash: a86332fa630e211a890a26f820a456cfae7ee7da2a92b38f798d74d6102b1500
Instruction Fuzzy Hash: 3DD05B763082107AD620A55BAC44DA76BDCCFC5770F11063EB558C71C1D6309C01C675

Uniqueness

Uniqueness Score: -1.00%

Function 004235BC Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423568: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042357D

ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Part of subcall function 00423598: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 004235B4

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 93aae6dcf666a3a1cf545ce3cfd38204cf591cfccf867612cdfd8c7b00efefd8
Instruction ID: 6e8deb3ed7ffb4c54c7bf11bddd21d475954711d807402a63cfbe74293682e9f
Opcode Fuzzy Hash: 93aae6dcf666a3a1cf545ce3cfd38204cf591cfccf867612cdfd8c7b00efefd8
Instruction Fuzzy Hash: 03D05E123812743102107ABB280998B42A84D862AB388043BB54CDB202E91E8A81A1AC

Uniqueness

Uniqueness Score: -1.00%

Function 00424234 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 0042424C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: c34688b727229efcedc1f2997f44e421d28f5fd8d0fc977b3f59e8ef08dab085
Instruction ID: a3b20f4c882213fa23ff33249cd178fa67041ba6f44abe22b1f00704e939aabb
Opcode Fuzzy Hash: c34688b727229efcedc1f2997f44e421d28f5fd8d0fc977b3f59e8ef08dab085
Instruction Fuzzy Hash: 4CD05EE27011702BCB01BBED54C4AC667CC8B8829AB1940BBF918EF257C638CE448398

Uniqueness

Uniqueness Score: -1.00%

Function 0042CC48 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0045185D,00000000,00451876,?,-00000001,00000000), ref: 0042CC53

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 82f5dea6b02cc0f726bbe4c909810c4d52a47932f104f8a95c7157b85414663c
Instruction ID: fb3bcb19fe042810799c60ac9426d807c03ae468120a660d59a80632ebfc0af6
Opcode Fuzzy Hash: 82f5dea6b02cc0f726bbe4c909810c4d52a47932f104f8a95c7157b85414663c
Instruction Fuzzy Hash: 04D012D030121015DA1475BF2ACD75F42884FA5735BB41B37B96DE23E2D23D8956101C

Uniqueness

Uniqueness Score: -1.00%

Function 0042CC00 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00450CD7,00000000), ref: 0042CC0B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 696c079d1e659a807bafa968d47e5a3e4cea9be412662ea6c9d5bc89f686c2e0
Instruction ID: 3d474633da5dc292dd1e9b08acfa0ea7ef8e6560f0837aa6ac70ccb6d2902417
Opcode Fuzzy Hash: 696c079d1e659a807bafa968d47e5a3e4cea9be412662ea6c9d5bc89f686c2e0
Instruction Fuzzy Hash: 42C08CE03022001A9A1465BF2CC511F42C8891827A3A41F37F53CE32D2D27E88A72428

Uniqueness

Uniqueness Score: -1.00%

Function 004633A4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00464010,00000000,00000000,00000000,0000000C,00000000), ref: 004633BC

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00406E28 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A834,0040CDE0,?,00000000,?), ref: 00406E45

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4583f237df22b439ee34a1a79ec62ce4162a2c4c0b032f6043df3341da82d5c7
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: 4583f237df22b439ee34a1a79ec62ce4162a2c4c0b032f6043df3341da82d5c7
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Uniqueness

Uniqueness Score: -1.00%

Function 0041F30C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,00000000), ref: 0041F320

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction ID: 48f25c4fc7afed193c39a16cc91a0304f94a1296cd048c63733264e3b5f0309e
Opcode Fuzzy Hash: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction Fuzzy Hash: D2D0C932100108AFDB018E94AC018677B69EB48210B148815FD0485221D633E831AA91

Uniqueness

Uniqueness Score: -1.00%

Function 00450088 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045AA1E,00000000,0045ABA9,?,00000000,00000002,00000002), ref: 0045008F

Part of subcall function 0044FE10: GetLastError.KERNEL32(0044FC2C,0044FED2,?,00000000,?,00492588,00000001,00000000,00000002,00000000,004926E9,?,?,00000005,00000000,0049271D), ref: 0044FE13

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 857a2ef5c33fcabe859aa2781a1519cd0b5291b8658590954683ea0b80d8510a
Instruction ID: 5fd336f37560a3562a1f9a64c462d12011a30875c45227d907a3aa1d5a9b5e2e
Opcode Fuzzy Hash: 857a2ef5c33fcabe859aa2781a1519cd0b5291b8658590954683ea0b80d8510a
Instruction Fuzzy Hash: 35C04C65300110479F00A6BE95C1A1763D95F083063104866BA04CF257D669D8544A18

Uniqueness

Uniqueness Score: -1.00%

Function 00406EB8 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00496628,00492DAD,00000000,00492E02,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d6272d179bacf2974813569cb343044e053bf0796cd1d1d4bd728cfe90bb8503
Instruction ID: f501027f96a9746725af0604134d36a8ca8c314a7ca2a7be08ed73c27bcd633e
Opcode Fuzzy Hash: d6272d179bacf2974813569cb343044e053bf0796cd1d1d4bd728cfe90bb8503
Instruction Fuzzy Hash: 97B012E13D220A2ACE0079FE4CC191700CC462C6163405A3A3406EB1C3D93CC4180414

Uniqueness

Uniqueness Score: -1.00%

Function 00407210 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,00492516,00000000,004926E9,?,?,00000005,00000000,0049271D,?,?,00000000), ref: 0040721B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 116f646fca034a371e6a5c157b9d4efecc0deabf7e2bcd6bcee3aaaef58023bf
Instruction ID: c18bf430a4858a09d5fd0626d157798880aaaa8ea81a5298b6cf69089c3012d4
Opcode Fuzzy Hash: 116f646fca034a371e6a5c157b9d4efecc0deabf7e2bcd6bcee3aaaef58023bf
Instruction Fuzzy Hash: B0B012E03D161B27CA0079FE4CC191A01CC46292163501B3A3006E71C3D83CC8080514

Uniqueness

Uniqueness Score: -1.00%

Function 00478120 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,0047C512), ref: 00478136

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: a0733d547ba9a615f27e584c0e25f3c3f3139aaaff4c722c948ff892e8f0bc14
Instruction ID: 51a0f791e75373d49b6d83255c8d5b34eb3325c5235352f17ae16dccff1f23d7
Opcode Fuzzy Hash: a0733d547ba9a615f27e584c0e25f3c3f3139aaaff4c722c948ff892e8f0bc14
Instruction Fuzzy Hash: D5C0EAB15292208AC740FB78AC08A523AE4B738289B048D7BA018C6272E7788541CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042E24B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E269), ref: 0042E25C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 7fad5ebe009d69c2099675b3e000f1c062c351dec5b4fb3cd432c824ae70c241
Instruction ID: b0804e078831a813d9aa2463563e291fc03c9a68ee142e2bda9a21ea894dad8b
Opcode Fuzzy Hash: 7fad5ebe009d69c2099675b3e000f1c062c351dec5b4fb3cd432c824ae70c241
Instruction Fuzzy Hash: AFB09B7670C600DDB709D6D6745552D63D8D7C47207E145B7F001D2580D93C58004928

Uniqueness

Uniqueness Score: -1.00%

Function 0041655C Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

73A25CF0.USER32(?), ref: 00416563

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15102f7382d34fed751781a5022c55e4c44b9a191595ad2a6c0bef55f1a25186
Instruction ID: 444a78761fbc6a727879d8c4239369b0bde5fc0390465f01f64749401816922a
Opcode Fuzzy Hash: 15102f7382d34fed751781a5022c55e4c44b9a191595ad2a6c0bef55f1a25186
Instruction Fuzzy Hash: CDA002756015049ADE04A7A5C849F662298BB44204FC915F971449B092C53C99008E58

Uniqueness

Uniqueness Score: -1.00%

Function 0045C348 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0045C3D8

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 76fbdefa84b6e6646576d37aa534d5687847a51f5d406797e85eb89dfb11de70
Instruction ID: 7994756c429da8fd341528b1115bd972bbd87915911d1c28c7d9b705713d9cd5
Opcode Fuzzy Hash: 76fbdefa84b6e6646576d37aa534d5687847a51f5d406797e85eb89dfb11de70
Instruction Fuzzy Hash: 641163716043089FD700AE55C8C1B4B3795AF8475AF05806AFD589B2C7DB38E848CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F334 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED14,?,004237FF,00423B7C,0041ED14), ref: 0041F352

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fcc5bb2b52a6c868320fd556f825bdddd6823e0008dba192f27ebe0d5c6033d0
Instruction ID: b4617262a153a49870252b9da37c83347ffd54b91452f412ea0f349906787434
Opcode Fuzzy Hash: fcc5bb2b52a6c868320fd556f825bdddd6823e0008dba192f27ebe0d5c6033d0
Instruction Fuzzy Hash: 361118742407099BC710DF59D881B86FBE5EB983A0B10C53BED688B385D378E945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00451BCC Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00451C35), ref: 00451C17

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1897e2adf53df2e5beb569c157847238c97ef970a39bc2d9b11d042c5864cf78
Instruction ID: 9b046278fcf2f54c8895181bb84fa4e67d3ca0abe95595291a9aaadc5344c142
Opcode Fuzzy Hash: 1897e2adf53df2e5beb569c157847238c97ef970a39bc2d9b11d042c5864cf78
Instruction Fuzzy Hash: 7B017036604248AF8B11DF69AC105EEF7E8EB4932072082B7FC64C3352D7754D05D694

Uniqueness

Uniqueness Score: -1.00%

Function 0045C2F0 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,0045C3CE), ref: 0045C307

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1db0cbd719025b65296d728f72a94704870e37dd70070be8469bdcaf82232f5c
Instruction ID: 3bb3114e2640d79ee9d1f6c6c170ec04299b672b50bb43f7844af23f30410e64
Opcode Fuzzy Hash: 1db0cbd719025b65296d728f72a94704870e37dd70070be8469bdcaf82232f5c
Instruction Fuzzy Hash: 6CD0E9B17557045FDF90EE798CC1B0237D8BB48741F5044666D04DB286E674E8048A18

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0044B08C Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B038: GetVersionExA.KERNEL32(00000094), ref: 0044B055

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F1A9,00493215), ref: 0044B0B3
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B0CB
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B0DD
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B0EF
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B101
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B113
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B125
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B137
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B149
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B15B
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B16D
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B17F
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B191
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B1A3
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B1B5
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B1C7
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B1D9
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B1EB
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B1FD
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B20F
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B221
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B233
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B245
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B257
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B269
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B27B
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B28D
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B29F
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B2B1
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B2C3
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B2D5
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B2E7
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B2F9
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B30B
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B31D
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B32F
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B341
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B353
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B365
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B377
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B389
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B39B
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B3AD
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B3BF
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B3D1
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B3E3
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B3F5
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B407

Strings

SetThemeAppProperties, xrefs: 0044B3B7
GetThemeBool, xrefs: 0044B207
GetThemePartSize, xrefs: 0044B12F
GetThemeTextExtent, xrefs: 0044B141
OpenThemeData, xrefs: 0044B0C3
GetThemeMargins, xrefs: 0044B273
HitTestThemeBackground, xrefs: 0044B177
GetWindowTheme, xrefs: 0044B36F
GetThemeSysString, xrefs: 0044B327
GetCurrentThemeName, xrefs: 0044B3C9
EnableTheming, xrefs: 0044B3FF
IsThemePartDefined, xrefs: 0044B1AD
IsAppThemed, xrefs: 0044B35D
CloseThemeData, xrefs: 0044B0D5
GetThemePosition, xrefs: 0044B23D
GetThemePropertyOrigin, xrefs: 0044B297
GetThemeSysColor, xrefs: 0044B2CD
SetWindowTheme, xrefs: 0044B2A9
GetThemeDocumentationProperty, xrefs: 0044B3DB
uxtheme.dll, xrefs: 0044B0AE
DrawThemeParentBackground, xrefs: 0044B3ED
DrawThemeText, xrefs: 0044B0F9
GetThemeTextMetrics, xrefs: 0044B153
GetThemeColor, xrefs: 0044B1D1
GetThemeSysFont, xrefs: 0044B315
GetThemeMetric, xrefs: 0044B1E3
GetThemeRect, xrefs: 0044B261
GetThemeFont, xrefs: 0044B24F
EnableThemeDialogTexture, xrefs: 0044B381
DrawThemeBackground, xrefs: 0044B0E7
GetThemeSysInt, xrefs: 0044B339
IsThemeActive, xrefs: 0044B34B
GetThemeSysColorBrush, xrefs: 0044B2DF
GetThemeSysSize, xrefs: 0044B303
GetThemeIntList, xrefs: 0044B285
GetThemeString, xrefs: 0044B1F5
IsThemeDialogTextureEnabled, xrefs: 0044B393
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B1BF
GetThemeBackgroundRegion, xrefs: 0044B165
GetThemeEnumValue, xrefs: 0044B22B
GetThemeAppProperties, xrefs: 0044B3A5
DrawThemeEdge, xrefs: 0044B189
GetThemeSysBool, xrefs: 0044B2F1
DrawThemeIcon, xrefs: 0044B19B
GetThemeInt, xrefs: 0044B219
GetThemeBackgroundContentRect, xrefs: 0044B10B, 0044B11D
GetThemeFilename, xrefs: 0044B2BB

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: bb98b0fb62eabb2ddab1d9336ccc6a073254380c373182d9daf05d71656a5071
Instruction ID: fe7ec38607b22d39bed663b2d58cef56837bfbcccade8a066643eb3a06087c6f
Opcode Fuzzy Hash: bb98b0fb62eabb2ddab1d9336ccc6a073254380c373182d9daf05d71656a5071
Instruction Fuzzy Hash: 3B91E3B0A40B50EFEF00EBF598C6A2636A8EB15B18B15457BB444EF296C778D804CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00456D8C Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00456DF3
QueryPerformanceCounter.KERNEL32(00000000,00000000,00457086,?,?,00000000,00000000,?,00457782,?,00000000,00000000), ref: 00456DFC
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 00456E06
GetCurrentProcessId.KERNEL32(?,00000000,00000000,00457086,?,?,00000000,00000000,?,00457782,?,00000000,00000000), ref: 00456E0F
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00456E85
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 00456E93
CreateFileA.KERNEL32(00000000,C0000000,00000000,00494AB0,00000003,00000000,00000000,00000000,00457042), ref: 00456EDB
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00457031,?,00000000,C0000000,00000000,00494AB0,00000003,00000000,00000000,00000000,00457042), ref: 00456F14

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00456FBD
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 00456FF3
CloseHandle.KERNEL32(000000FF,00457038,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0045702B

Part of subcall function 004520A4: GetLastError.KERNEL32(00000000,00452B15,00000005,00000000,00452B4A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00492A61,00000000), ref: 004520A7

Strings

\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00456E5B
CreateNamedPipe, xrefs: 00456EA3
64-bit helper EXE wasn't extracted, xrefs: 00456DE7
CreateFile, xrefs: 00456EE9
CreateProcess, xrefs: 00456FC6
i, xrefs: 00456F70
helper %d 0x%x, xrefs: 00456F9C
Helper process PID: %u, xrefs: 00457010
Cannot utilize 64-bit features on this version of Windows, xrefs: 00456DD4
Starting 64-bit helper process., xrefs: 00456DC1
D, xrefs: 00456F36
SetNamedPipeHandleState, xrefs: 00456F1D

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 78acb9f109d5724a7969658c962b1e810a68082c87b2ea8d487cf227c5990b69
Instruction ID: f6538b9f74412226b669bfece35f7f8b6dba794c0ca87bd4e30d5109fc12bfbf
Opcode Fuzzy Hash: 78acb9f109d5724a7969658c962b1e810a68082c87b2ea8d487cf227c5990b69
Instruction Fuzzy Hash: 49716470A04744AFDB20DB69DC41B5EBBF8AB05705F5084BAF908EB282D7785948CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0045B29C Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045B2B6
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045B2D6
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045B2E3
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045B2F0
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045B2FE

Part of subcall function 0045B1A4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045B243,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045B21D

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045B4F1,?,?,00000000), ref: 0045B3B7
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045B4F1,?,?,00000000), ref: 0045B3C0

Strings

SetNamedSecurityInfoW, xrefs: 0045B2EA
advapi32.dll, xrefs: 0045B2D1
SetEntriesInAclW, xrefs: 0045B2F8
W, xrefs: 0045B3CE
GetNamedSecurityInfoW, xrefs: 0045B2DD

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 581bc1d990142ef0cbc7df71f3a5d238f8833566cc05c87d00b3ef4aae44d50d
Instruction ID: c7fa785e835f4f31fbb174cc3c8bee0aea38d4a0e272f0ec20846287379b14aa
Opcode Fuzzy Hash: 581bc1d990142ef0cbc7df71f3a5d238f8833566cc05c87d00b3ef4aae44d50d
Instruction Fuzzy Hash: 455174B1900608EFDB10DF99C845BEEB7B8EB49315F14806AF904B7382D7789945CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004739C4 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 00473A17
GetLastError.KERNEL32(?,?), ref: 00473A20
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00473A6D
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00473A91
CloseHandle.KERNEL32(00000000,00473AC2,00000000,00000000,000000FF,000000FF,00000000,00473ABB,?,?,?), ref: 00473AB5

Strings

GetExitCodeProcess, xrefs: 00473A9A
ShellExecuteEx returned hProcess=0, xrefs: 00473A41
runas, xrefs: 004739F0
MsgWaitForMultipleObjects, xrefs: 00473A7A
<, xrefs: 004739E2
ShellExecuteEx, xrefs: 00473A31

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseCodeErrorExecuteExitHandleLastMultipleObjectsProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 171997614-221126205
Opcode ID: ceea5159fd8dee0bdb195dc0c5f446595e8a1ed53b7a7188edfe43d9d26f279e
Instruction ID: fd51c6fdc7ef3a5c4723c7cab516b72f55abc6f577cd61f87c3a1e5de1d1d72d
Opcode Fuzzy Hash: ceea5159fd8dee0bdb195dc0c5f446595e8a1ed53b7a7188edfe43d9d26f279e
Instruction Fuzzy Hash: C92167B0A00204ABDB14EFA98943ADD76E8EF05709F50843BF548F62C2DB7C9A04975D

Uniqueness

Uniqueness Score: -1.00%

Function 004182F4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418303
GetWindowPlacement.USER32(?,0000002C), ref: 00418320
GetWindowRect.USER32(?), ref: 0041833C
GetWindowLongA.USER32(?,000000F0), ref: 0041834A
GetWindowLongA.USER32(?,000000F8), ref: 0041835F
ScreenToClient.USER32(00000000), ref: 00418368
ScreenToClient.USER32(00000000,?), ref: 00418373

Strings

,, xrefs: 0041830C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 76ed797ea6865fddbc3593e7458191c6aaa261637689223d055d8f073444f388
Instruction ID: 9cf88c6662a8b54f2d940af1896da5675c8924d24fa9a5d7825e36bf04e718ba
Opcode Fuzzy Hash: 76ed797ea6865fddbc3593e7458191c6aaa261637689223d055d8f073444f388
Instruction Fuzzy Hash: 40112B71505201AFDB00DF69C885F9B77E8AF49314F18067EBD58DB286C739D900CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00453FD0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00453FDF
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00453FE5
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00453FFE
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00454025
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045402A
ExitWindowsEx.USER32(00000002,00000000), ref: 0045403B

Strings

SeShutdownPrivilege, xrefs: 00453FF7

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 6090fdc4bc4e87c108c969846b268b0c771cb1f603e6b24c9ba738576c1ec04e
Instruction ID: fefb7ae41868014354d83cb3ae28757c4cdc7dcc71e7b198ec4e0078f4c74e40
Opcode Fuzzy Hash: 6090fdc4bc4e87c108c969846b268b0c771cb1f603e6b24c9ba738576c1ec04e
Instruction Fuzzy Hash: 06F06270694702B5E620AA758C07F6B25989B80F8DF60492ABE45EF1C3D6BCC54C4A2A

Uniqueness

Uniqueness Score: -1.00%

Function 00492760 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0049289E,?,?,00000000,00496628,?,00492A28,00000000,00492A7C,?,?,00000000,00496628), ref: 004927B7
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0049283A
FindNextFileA.KERNEL32(000000FF,?,00000000,00492876,?,00000000,?,00000000,0049289E,?,?,00000000,00496628,?,00492A28,00000000), ref: 00492852
FindClose.KERNEL32(000000FF,0049287D,00492876,?,00000000,?,00000000,0049289E,?,?,00000000,00496628,?,00492A28,00000000,00492A7C), ref: 00492870

Strings

isRS-, xrefs: 004927D7
isRS-???.tmp, xrefs: 004927A1

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 70fea279a0487c66a379aa7ff36a45d08903b4abdbe9169b97591ec596f32377
Instruction ID: 6f3af90e7e4d79464d1657adb4957f5333b5dfcd3ed3f620ee887a0d658b233a
Opcode Fuzzy Hash: 70fea279a0487c66a379aa7ff36a45d08903b4abdbe9169b97591ec596f32377
Instruction Fuzzy Hash: A5319471900618BFDF10EF66CD41ACEBBBCDB49304F5085F7A808A32A1D7789E458E58

Uniqueness

Uniqueness Score: -1.00%

Function 0044C210 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044EABD), ref: 0044C21F
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C230
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C240

Strings

CreateStdAccessibleObject, xrefs: 0044C23A
oleacc.dll, xrefs: 0044C21A
LresultFromObject, xrefs: 0044C22A

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 3fed220ecff7d472f56716f5b8077b1b583819bf05c1fad9037041acfd60cba7
Instruction ID: 433fed67622e38403ad12c2b69c23a269c66bc576510ece0f105dc57e33200d4
Opcode Fuzzy Hash: 3fed220ecff7d472f56716f5b8077b1b583819bf05c1fad9037041acfd60cba7
Instruction Fuzzy Hash: 76F0FEB0A427018AEB50ABF5DDC57123294F32070CF1951BBA001561A1C7FE5588CA2D

Uniqueness

Uniqueness Score: -1.00%

Function 0047884C Relevance: 9.2, APIs: 6, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,?,00000000,00478B12,?,00000000,?,00000000,?,00478C56,00000000,00000000), ref: 004788AD
FindNextFileA.KERNEL32(000000FF,?,00000000,004789BD,?,00000000,?,?,?,?,00000000,00478B12,?,00000000,?,00000000), ref: 00478999
FindClose.KERNEL32(000000FF,004789C4,004789BD,?,00000000,?,?,?,?,00000000,00478B12,?,00000000,?,00000000), ref: 004789B7
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,?,00000000,00478B12,?,00000000,?,00000000,?,00478C56,00000000), ref: 00478A10

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Find$File$First$CloseNext
String ID:
API String ID: 2001080981-0
Opcode ID: bf4e0802f79d6ecb0b26fe8947a890451376e871c9cd550310497b4db5b6158c
Instruction ID: c53e02efa538cd00ed8c6064e36d24adcac4933ff0a83cd0056e21b928a08691
Opcode Fuzzy Hash: bf4e0802f79d6ecb0b26fe8947a890451376e871c9cd550310497b4db5b6158c
Instruction Fuzzy Hash: CD71607090020DAFCF11EFA5CC45ADFBBB9EF49304F5084AAE508A7291DB399A45CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00455800 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 0045587D
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004558A4
SetForegroundWindow.USER32(?), ref: 004558B5
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00455B8F,?,00000000,00455BCB), ref: 00455B7A

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 004559FA

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: f630950fb9490f87c2970171911c92c802a33cf7ae5f5ac9df6b4dee4f4196c1
Instruction ID: 78b58341f63533b3ae22fdc0b35f2ff7933112878ccc3eccec269f40d3d6be6d
Opcode Fuzzy Hash: f630950fb9490f87c2970171911c92c802a33cf7ae5f5ac9df6b4dee4f4196c1
Instruction Fuzzy Hash: 0291C234604604EFD715CF65D965F6ABBF9EB48714F2180BAEC0497792C739AE04CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00417C40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417C7F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417C9D
GetWindowPlacement.USER32(?,0000002C), ref: 00417CD3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417CFA

Strings

,, xrefs: 00417CC1

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 81a48e547fa398d3f0e332d3c5732c978cb07eabcf612ef17b70e18ae1a1ab95
Instruction ID: c7e48a005123f112bfb3c773aae920d88014dc0855fb7fe4f04d55f6c4297c8c
Opcode Fuzzy Hash: 81a48e547fa398d3f0e332d3c5732c978cb07eabcf612ef17b70e18ae1a1ab95
Instruction Fuzzy Hash: 92213E71604204ABCF00EF69D8C4ADA77B8AF48314F11456AFD18DF346D678E984CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00460594 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00460751), ref: 004605C5
FindFirstFileA.KERNEL32(00000000,?,00000000,00460724,?,00000001,00000000,00460751), ref: 00460654
FindNextFileA.KERNEL32(000000FF,?,00000000,00460706,?,00000000,?,00000000,00460724,?,00000001,00000000,00460751), ref: 004606E6
FindClose.KERNEL32(000000FF,0046070D,00460706,?,00000000,?,00000000,00460724,?,00000001,00000000,00460751), ref: 00460700

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 8e5f21022fae35bd05caf680941799b374ea027a06ecb90817f05a91b3dc2be9
Instruction ID: f78dcee57c625dac1728093300786459247b71741faca452f92d1a4d7efbbe15
Opcode Fuzzy Hash: 8e5f21022fae35bd05caf680941799b374ea027a06ecb90817f05a91b3dc2be9
Instruction Fuzzy Hash: D941B970A006189FDB11EF65DC85ADFB7B8EB88705F5044BAF804E7391D63C9E488E59

Uniqueness

Uniqueness Score: -1.00%

Function 00460A10 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00460BF7), ref: 00460A85
FindFirstFileA.KERNEL32(00000000,?,00000000,00460BC2,?,00000001,00000000,00460BF7), ref: 00460ACB
FindNextFileA.KERNEL32(000000FF,?,00000000,00460BA4,?,00000000,?,00000000,00460BC2,?,00000001,00000000,00460BF7), ref: 00460B80
FindClose.KERNEL32(000000FF,00460BAB,00460BA4,?,00000000,?,00000000,00460BC2,?,00000001,00000000,00460BF7), ref: 00460B9E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 49e9851897b8f681d322c96bb90846bd68f017f54ff683acd975a5c922cbe8b7
Instruction ID: c4fca8719043302f1557867009f5b54629f0d04ae6016422a46977757255b98a
Opcode Fuzzy Hash: 49e9851897b8f681d322c96bb90846bd68f017f54ff683acd975a5c922cbe8b7
Instruction Fuzzy Hash: D7417631A00618DFCB10EFA5DC859DFB7B8EB88709F5085A6F804A7341E7789E448E59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E6DC Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00451B47,00000000,00451B68), ref: 0042E6FE
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E729
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00451B47,00000000,00451B68), ref: 0042E736
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00451B47,00000000,00451B68), ref: 0042E73E
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00451B47,00000000,00451B68), ref: 0042E744

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 3b0f4d38eb6dceebd9f76a9e4dec45dc220b74548ab12df4217102bcadea50c6
Instruction ID: 405047736e0f3db58adf1e262a5124b738154ad7abc3b976f47152011cf6baa3
Opcode Fuzzy Hash: 3b0f4d38eb6dceebd9f76a9e4dec45dc220b74548ab12df4217102bcadea50c6
Instruction Fuzzy Hash: 12F0F0713917207AF620B1BA6CC6F7B018CC7C5B68F10823ABB04FF1C1D9A84C06056D

Uniqueness

Uniqueness Score: -1.00%

Function 0047E0A8 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0047E0E6
GetWindowLongA.USER32(00000000,000000F0), ref: 0047E104
ShowWindow.USER32(00000000,00000005,00000000,000000F0,00497030,0047D932,0047D966,00000000,0047D986,?,?,00000001,00497030), ref: 0047E126
ShowWindow.USER32(00000000,00000000,00000000,000000F0,00497030,0047D932,0047D966,00000000,0047D986,?,?,00000001,00497030), ref: 0047E13A

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: af3e5d018bea6ce680d04de36dbf473975af9ab811efa4d170cb9ff8881e7d8d
Instruction ID: c92ae80fdea3dbb9ecd522712915d334841aed4b7b9fd6eda1dbd96f1c302fca
Opcode Fuzzy Hash: af3e5d018bea6ce680d04de36dbf473975af9ab811efa4d170cb9ff8881e7d8d
Instruction Fuzzy Hash: 910171702252509ADB00B776CC46BDB2396AB19344F4486BBF8489B3A3CA7D9C61974C

Uniqueness

Uniqueness Score: -1.00%

Function 0045F008 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0045F0DC), ref: 0045F060
FindNextFileA.KERNEL32(000000FF,?,00000000,0045F0BC,?,00000000,?,00000000,0045F0DC), ref: 0045F09C
FindClose.KERNEL32(000000FF,0045F0C3,0045F0BC,?,00000000,?,00000000,0045F0DC), ref: 0045F0B6

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 28630f636b04da4fcdbc8bf603e3cd822730a77496e846d3c01d6dea91b4df37
Instruction ID: 68591aebe15be66c02bfe18b1190825c6ab69d9b7e21385b208dddf45066949f
Opcode Fuzzy Hash: 28630f636b04da4fcdbc8bf603e3cd822730a77496e846d3c01d6dea91b4df37
Instruction Fuzzy Hash: 6D21DB315047086EDB11EB65CC41ADEBBACDB49714F5484F7BC08D35E3E6389E4C895A

Uniqueness

Uniqueness Score: -1.00%

Function 0042414C Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00424154
SetActiveWindow.USER32(?,?,?,00468BB4), ref: 00424161

Part of subcall function 004235BC: ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Part of subcall function 00423A84: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,022425AC,0042417A,?,?,?,00468BB4), ref: 00423ABF

SetFocus.USER32(00000000,?,?,?,00468BB4), ref: 0042418E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: bf39fc93c20dd362814a915e3816c2be519e9f0d9e4d58152530bfc1c9f789b4
Instruction ID: 4136aac35a779e4733478972a6ab5bc4469f39141bd8f2cff661810d574da02b
Opcode Fuzzy Hash: bf39fc93c20dd362814a915e3816c2be519e9f0d9e4d58152530bfc1c9f789b4
Instruction Fuzzy Hash: 3EF03A717001208BDB40AFAA98C4B9633A8AF48304B55017BBD09EF34BCA7CDC5187A8

Uniqueness

Uniqueness Score: -1.00%

Function 00417C3E Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417C7F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417C9D
GetWindowPlacement.USER32(?,0000002C), ref: 00417CD3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417CFA

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: b8fbe12c44fb062a6cac749eb6b5fd61645d1f9f5889301bfb76636b936bc9d1
Instruction ID: f0313cfea0d4087130c3a657ee055cc65a4736f61d4b278e94d42609036002a6
Opcode Fuzzy Hash: b8fbe12c44fb062a6cac749eb6b5fd61645d1f9f5889301bfb76636b936bc9d1
Instruction Fuzzy Hash: 31015A31204104ABDF10EE6A98C5EEA73A8AF44324F114166FD08CF342E638EC8086A8

Uniqueness

Uniqueness Score: -1.00%

Function 00417508 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417533
GetCapture.USER32 ref: 0041753C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 3e17b5cf6dc19ebd5b8abcafb316f5af57189b7328e4788ec4edb4e2478c176d
Instruction ID: 516534a0d685a41b5289b303ed97122a4deaa6af678778b669afb1f0a2bf06d6
Opcode Fuzzy Hash: 3e17b5cf6dc19ebd5b8abcafb316f5af57189b7328e4788ec4edb4e2478c176d
Instruction Fuzzy Hash: 80F04471B04602A7DB20E72EC8C5AA762F69F44394B54443FF415C7B96EA7CDCC48758

Uniqueness

Uniqueness Score: -1.00%

Function 00424104 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042410B

Part of subcall function 004239F4: EnumWindows.USER32(0042398C), ref: 00423A18
Part of subcall function 004239F4: GetWindow.USER32(?,00000003), ref: 00423A2D
Part of subcall function 004239F4: GetWindowLongA.USER32(?,000000EC), ref: 00423A3C
Part of subcall function 004239F4: SetWindowPos.USER32(00000000,004240CC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042411B,?,?,00423CE3), ref: 00423A72

SetActiveWindow.USER32(?,?,?,00423CE3,00000000,004240CC), ref: 0042411F

Part of subcall function 004235BC: ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: 42e4936c4a6647b65b5ab24117e0ac4ae5d8008d356746b3415a205c164669c5
Instruction ID: b8e4b42960b6b3797255afb6d30997fccd36cf0c86298b6f3b138aeb4614201e
Opcode Fuzzy Hash: 42e4936c4a6647b65b5ab24117e0ac4ae5d8008d356746b3415a205c164669c5
Instruction Fuzzy Hash: 76E0E5A0300100C7EB00AFAAD8C9B9672A9BB48304F5501BABC08CF24BD6B8C8948724

Uniqueness

Uniqueness Score: -1.00%

Function 00412548 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,00412745), ref: 00412733

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: ccb3f07b2fee23e1b7d0b9fe211690240d667b5ade3c407fcf90e85793529408
Instruction ID: 7676943622bfa1b87a175b7a8473920ed7b4936c8d574fb73453cf2521b2b913
Opcode Fuzzy Hash: ccb3f07b2fee23e1b7d0b9fe211690240d667b5ade3c407fcf90e85793529408
Instruction Fuzzy Hash: 5751D3356042059FC710DF5AD681A9BF3E5FF98304B3582ABE814C73A5D6B8AD92874C

Uniqueness

Uniqueness Score: -1.00%

Function 00473F28 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00474076

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 25d2fed37fc004c0ef9d7e1e532679906a7dfcc26d9c4c4e0f977566c6f286e0
Instruction ID: 893271b3bcd24fcb62a5a78660203d6d155b33e0871f9808868e069105ad9bad
Opcode Fuzzy Hash: 25d2fed37fc004c0ef9d7e1e532679906a7dfcc26d9c4c4e0f977566c6f286e0
Instruction Fuzzy Hash: E8415779A04144DFCB10CF99C2808AAB7F9EB88311B25C592E94CDB745D339EE41EB98

Uniqueness

Uniqueness Score: -1.00%

Function 0048CEA0 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,0048D395,?,?,?,?,00000000,00000000,00000000), ref: 0048CEE0
FindWindowA.USER32(00000000,00000000), ref: 0048CF11

Strings

FINDWINDOWBYCLASSNAME, xrefs: 0048CEED
REGISTERWINDOWMESSAGE, xrefs: 0048D073
CREATEMUTEX, xrefs: 0048D2C1
FREEDLL, xrefs: 0048D28C
CHARTOOEMBUFF, xrefs: 0048D336
OEMTOCHARBUFF, xrefs: 0048D2F3
SENDNOTIFYMESSAGE, xrefs: 0048D017
SENDBROADCASTNOTIFYMESSAGE, xrefs: 0048D14F
SENDBROADCASTMESSAGE, xrefs: 0048D0AD
CALLDLLPROC, xrefs: 0048D205
POSTBROADCASTMESSAGE, xrefs: 0048D0FB
FINDWINDOWBYWINDOWNAME, xrefs: 0048CF29
LOADDLL, xrefs: 0048D1A3
POSTMESSAGE, xrefs: 0048CFBB
SENDMESSAGE, xrefs: 0048CF65
SLEEP, xrefs: 0048CECA

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 2e5a7d8b1170dd3aac9fd301d3dd2178002dc776484c68961187b797f033286d
Instruction ID: b0d844213b24b695988cfb35ecebf8c704e926cd3cc1ee44f2907765548c277e
Opcode Fuzzy Hash: 2e5a7d8b1170dd3aac9fd301d3dd2178002dc776484c68961187b797f033286d
Instruction Fuzzy Hash: 36C161A0B0461067D714BE3E9C4261E569A9F89704B11D93FB406EB7CACE7DDC06439E

Uniqueness

Uniqueness Score: -1.00%

Function 004565B8 Relevance: 45.7, APIs: 11, Strings: 15, Instructions: 237filesynchronizationprocessCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00494AA4,00000001,00000000,00000000,004568ED,?,?,?,00000001,?,00456B07,00000000,00456B1D,?,00000000,00496628), ref: 00456605
CreateFileMappingA.KERNEL32(000000FF,00494AA4,00000004,00000000,00002018,00000000), ref: 0045663D
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00002018,00000000,004568C3,?,00494AA4,00000001,00000000,00000000,004568ED,?,?,?), ref: 00456664
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00456771
ReleaseMutex.KERNEL32(00000000,00000000,00000002,00000000,00000000,00002018,00000000,004568C3,?,00494AA4,00000001,00000000,00000000,004568ED), ref: 004566C9

Part of subcall function 004520A4: GetLastError.KERNEL32(00000000,00452B15,00000005,00000000,00452B4A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00492A61,00000000), ref: 004520A7

CloseHandle.KERNEL32(00456B07,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00456788
WaitForSingleObject.KERNEL32(00000000,000000FF,00456B07,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004567C1
GetLastError.KERNEL32(00000000,000000FF,00456B07,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004567D3
UnmapViewOfFile.KERNEL32(00000000,004568CA,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004568A5
CloseHandle.KERNEL32(00000000,004568CA,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004568B4
CloseHandle.KERNEL32(00000000,004568CA,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004568BD

Strings

CreateMutex, xrefs: 00456613
GetProcAddress, xrefs: 00456831
OleInitialize, xrefs: 0045680D
_isetup\_RegDLL.tmp, xrefs: 004566EF
_RegDLL.tmp %u %u, xrefs: 00456719
REGDLL mutex wait failed (%d, %d), xrefs: 004567E7
Spawning _RegDLL.tmp, xrefs: 004565E4
REGDLL returned unknown result code %d, xrefs: 00456884
D, xrefs: 00456732
CreateProcess, xrefs: 0045677A
ReleaseMutex, xrefs: 004566D2
LoadLibrary, xrefs: 0045681F
CreateFileMapping, xrefs: 0045664B
REGDLL failed with exit code 0x%x, xrefs: 004567B1
MapViewOfFile, xrefs: 00456672

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseCreateFileHandle$ErrorLastMutexView$MappingObjectProcessReleaseSingleUnmapWait
String ID: CreateFileMapping$CreateMutex$CreateProcess$D$GetProcAddress$LoadLibrary$MapViewOfFile$OleInitialize$REGDLL failed with exit code 0x%x$REGDLL mutex wait failed (%d, %d)$REGDLL returned unknown result code %d$ReleaseMutex$Spawning _RegDLL.tmp$_RegDLL.tmp %u %u$_isetup\_RegDLL.tmp
API String ID: 4012871263-351310198
Opcode ID: 0a4c6db077385fac2b9b4f246735c915a4f66f41dc355d0fc00f59d12061f423
Instruction ID: 980461e75233d27168dbefb0458f3d7e1823a55311cdbdb2a0391f25a35d7111
Opcode Fuzzy Hash: 0a4c6db077385fac2b9b4f246735c915a4f66f41dc355d0fc00f59d12061f423
Instruction Fuzzy Hash: 32918170E002159FDB10EBA9C845B9EB7B4EF48305F91856BF914EB382DB789908CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041F088 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418F60,00000000,?,?,?,00000001), ref: 0041F096
SetErrorMode.KERNEL32(00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0B2
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0BE
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0CC
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F0FC
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F125
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F13A
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F14F
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F164
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F179
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F18E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F1A3
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F1B8
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F1CD
FreeLibrary.KERNEL32(00000001,?,00418F60,00000000,?,?,?,00000001), ref: 0041F1DF

Strings

Ctl3dUnregister, xrefs: 0041F11A
Ctl3dCtlColorEx, xrefs: 0041F16E
Ctl3dSubclassCtl, xrefs: 0041F12F
Ctl3dSubclassDlgEx, xrefs: 0041F144
Ctl3dUnAutoSubclass, xrefs: 0041F198
CTL3D32.DLL, xrefs: 0041F0B9
BtnWndProc3d, xrefs: 0041F1C2
Ctl3dAutoSubclass, xrefs: 0041F183
Ctl3dDlgFramePaint, xrefs: 0041F159
Ctl3dRegister, xrefs: 0041F0F1
Ctl3DColorChange, xrefs: 0041F1AD

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 2dd926b95465aa8cb279299c0f11ee4864398866ef086d8a09126c640cf0fcfa
Instruction ID: da08133687b7634b50b6c6a847516dd753fa1eb4508864759417a9d87976edef
Opcode Fuzzy Hash: 2dd926b95465aa8cb279299c0f11ee4864398866ef086d8a09126c640cf0fcfa
Instruction Fuzzy Hash: 3531F0B1640740EBDB00EBF5EC86E653654F768B28756093BB608DB162D77D488ACB1C

Uniqueness

Uniqueness Score: -1.00%

Function 004917C0 Relevance: 35.5, APIs: 3, Strings: 17, Instructions: 495COMMON

Download Yara Rule

Strings

Cannot find utCompiledCode record for this version of the uninstaller, xrefs: 00491A36
Not calling UninstallNeedRestart because a restart has already been deemed necessary., xrefs: 00491DAF
Will restart because UninstallNeedRestart returned True., xrefs: 00491D80
Removed all? %s, xrefs: 00491CFA
Setup version: Inno Setup version 5.3.5 (a), xrefs: 00491898
Uninstall, xrefs: 0049184B
Uninstall DAT: , xrefs: 004918C5
utCompiledCode[1] is invalid, xrefs: 00491A71
Original Uninstall EXE: , xrefs: 004918A2
Will not restart Windows automatically., xrefs: 00491EA4
InitializeUninstall, xrefs: 00491BF0
Need to restart Windows? %s, xrefs: 00491DD1
Install was done in 64-bit mode but not running 64-bit Windows now, xrefs: 00491AAB
DeinitializeUninstall, xrefs: 00491F3A
InitializeUninstall returned False; aborting., xrefs: 00491C28
UninstallNeedRestart, xrefs: 00491D30, 00491D69
Uninstall command line: , xrefs: 004918E8

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$Long$Show
String ID: Cannot find utCompiledCode record for this version of the uninstaller$DeinitializeUninstall$InitializeUninstall$InitializeUninstall returned False; aborting.$Install was done in 64-bit mode but not running 64-bit Windows now$Need to restart Windows? %s$Not calling UninstallNeedRestart because a restart has already been deemed necessary.$Original Uninstall EXE: $Removed all? %s$Setup version: Inno Setup version 5.3.5 (a)$Uninstall$Uninstall DAT: $Uninstall command line: $UninstallNeedRestart$Will not restart Windows automatically.$Will restart because UninstallNeedRestart returned True.$utCompiledCode[1] is invalid
API String ID: 3609083571-1972832509
Opcode ID: 3878d7cdee979cc7fcfd16d65cb90173a97255a8d1c2c32ea5da40bb2991a449
Instruction ID: 6596ef0c965ed04d70404abd425b2fb86aee653cd75455762a8c83b1d9d07689
Opcode Fuzzy Hash: 3878d7cdee979cc7fcfd16d65cb90173a97255a8d1c2c32ea5da40bb2991a449
Instruction Fuzzy Hash: CE12AC34A54245AFDF11EB65EC42B9E7FA5AB19308F10807BF800A73B2CB789845CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C97C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,0041A8B4,?), ref: 0041C9B0
73A24C40.GDI32(?,00000000,?,0041A8B4,?), ref: 0041C9BC
73A26180.GDI32(0041A8B4,?,00000001,00000001,00000000,00000000,0041CBD2,?,?,00000000,?,0041A8B4,?), ref: 0041C9E0
73A24C00.GDI32(?,0041A8B4,?,00000000,0041CBD2,?,?,00000000,?,0041A8B4,?), ref: 0041C9F0
SelectObject.GDI32(0041CDAC,00000000), ref: 0041CA0B
FillRect.USER32(0041CDAC,?,?), ref: 0041CA46
SetTextColor.GDI32(0041CDAC,00000000), ref: 0041CA5B
SetBkColor.GDI32(0041CDAC,00000000), ref: 0041CA72
PatBlt.GDI32(0041CDAC,00000000,00000000,0041A8B4,?,00FF0062), ref: 0041CA88
73A24C40.GDI32(?,00000000,0041CB8B,?,0041CDAC,00000000,?,0041A8B4,?,00000000,0041CBD2,?,?,00000000,?,0041A8B4), ref: 0041CA9B
SelectObject.GDI32(00000000,00000000), ref: 0041CACC
73A18830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B,?,0041CDAC,00000000,?,0041A8B4), ref: 0041CAE4
73A122A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B,?,0041CDAC,00000000,?), ref: 0041CAED
73A18830.GDI32(0041CDAC,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B), ref: 0041CAFC
73A122A0.GDI32(0041CDAC,0041CDAC,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B), ref: 0041CB05
SetTextColor.GDI32(00000000,00000000), ref: 0041CB1E
SetBkColor.GDI32(00000000,00000000), ref: 0041CB35
73A24D40.GDI32(0041CDAC,00000000,00000000,0041A8B4,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,0041CB7A,?,?,00000000), ref: 0041CB51
SelectObject.GDI32(00000000,?), ref: 0041CB5E
DeleteDC.GDI32(00000000), ref: 0041CB74

Part of subcall function 00419FC8: GetSysColor.USER32(?), ref: 00419FD2

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Color$ObjectSelect$A122A18830Text$A26180A570DeleteFillRect
String ID:
API String ID: 1381628555-0
Opcode ID: d7b92da64cecfd48f0a2b1e7f5bec81e0b40094dab39069241f93e3b0f0d639f
Instruction ID: 7128b10ae0d2f5501f58bad1f60f679124a592cf14607d549707b49f1954e982
Opcode Fuzzy Hash: d7b92da64cecfd48f0a2b1e7f5bec81e0b40094dab39069241f93e3b0f0d639f
Instruction Fuzzy Hash: 5961FC71A44609ABDF10EBE5DC86FAFB7B8EF48704F10446AF504E7281C67CA9418B69

Uniqueness

Uniqueness Score: -1.00%

Function 0042DEBC Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178memorylibraryloaderCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00494788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEF6
GetVersion.KERNEL32(00000000,0042E0A0,?,00494788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF13
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E0A0,?,00494788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF2C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DF32
FreeSid.ADVAPI32(00000000,0042E0A7,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E09A

Strings

advapi32.dll, xrefs: 0042DF27
CheckTokenMembership, xrefs: 0042DF22

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressAllocateFreeHandleInitializeModuleProcVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 1717332306-1888249752
Opcode ID: 76ce5d291f5cbb31bdfd7ca4dddea97b98bde0e8b8927e0d63e74708cf7a7565
Instruction ID: 5045d4bdae095839e21654112f0de3b8f2816e6eca6f617d5415efb28b53f152
Opcode Fuzzy Hash: 76ce5d291f5cbb31bdfd7ca4dddea97b98bde0e8b8927e0d63e74708cf7a7565
Instruction Fuzzy Hash: 6151C571B44629AEDB10EAE69C42F7F77ECEB09304F94447BB500F7282C5BC9806866D

Uniqueness

Uniqueness Score: -1.00%

Function 00492A8C Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00492E24,?,?,00000000,?,00000000,00000000,?,00493165,00000000,0049316F,?,00000000), ref: 00492B0F
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00492E24,?,?,00000000,?,00000000,00000000,?,00493165,00000000), ref: 00492B22
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00492E24,?,?,00000000,?,00000000,00000000), ref: 00492B32
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00492B53
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00492E24,?,?,00000000,?,00000000), ref: 00492B63

Part of subcall function 0042D328: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D3B6,?,?,00000000,?,?,00492520,00000000,004926E9,?,?,00000005), ref: 0042D35D

Strings

.msg, xrefs: 00492B86
o1I, xrefs: 00492AB1, 00492ABE, 00492AD5, 00492AE2, 00492B76, 00492B80, 00492B90, 00492B9A
/REG, xrefs: 00492AC1
.lst, xrefs: 00492BA0
/REGU, xrefs: 00492AE5
Setup, xrefs: 00492AFB
e1I, xrefs: 00492E16
Inno-Setup-RegSvr-Mutex, xrefs: 00492B19

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup$e1I$o1I
API String ID: 2000705611-221793176
Opcode ID: 564c8b13e7eddf64b783a8c8f274ab65814001774e33307f884660b89f46a155
Instruction ID: 4be49199d801b1cb5a3f4bb92d7f292d3e3738ea6ecad4381c70a4705d363757
Opcode Fuzzy Hash: 564c8b13e7eddf64b783a8c8f274ab65814001774e33307f884660b89f46a155
Instruction Fuzzy Hash: 3891D434A04205AFDF11EBA5D956BAF7FB4EB09304F918477F400AB692C6BD9C05CB19

Uniqueness

Uniqueness Score: -1.00%

Function 00458DE4 Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 199COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045907E,?,?,?,?,?,00000006,?,00000000,00491FBA,?,00000000,0049205D), ref: 00458F30

Strings

.chm, xrefs: 00458E80
Stripped read-only attribute., xrefs: 00458F09
.fts, xrefs: 00458E58
.gid, xrefs: 00458E34
Failed to delete the file; it may be in use (%d)., xrefs: 0045901F
.chw, xrefs: 00458E99
Failed to strip read-only attribute., xrefs: 00458F15
The file appears to be in use (%d). Will delete on restart., xrefs: 00458F79
Deleting file: %s, xrefs: 00458ECF
.hlp, xrefs: 00458E1B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-1593206319
Opcode ID: 33b658db2c5661edf65c4c2769d17ba3fc5b96e935de89830e81aad438822a76
Instruction ID: e4eb3b4405a0979e1a2c77286c885a36d1837fd04eb9654633cb4fd66a7308d3
Opcode Fuzzy Hash: 33b658db2c5661edf65c4c2769d17ba3fc5b96e935de89830e81aad438822a76
Instruction Fuzzy Hash: 7B618E30B042549BDB10EB69C8827AE77A9AB48715F50486FF801EB383CB789D49C799

Uniqueness

Uniqueness Score: -1.00%

Function 0041B31C Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

73A24C40.GDI32(00000000,?,00000000,?), ref: 0041B333
73A24C40.GDI32(00000000,00000000,?,00000000,?), ref: 0041B33D
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B34F
73A26180.GDI32(0000000B,?,00000001,00000001,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B366
73A1A570.USER32(00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B372
73A24C00.GDI32(00000000,0000000B,?,00000000,0041B3CB,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B39F
73A1A480.USER32(00000000,00000000,0041B3D2,00000000,0041B3CB,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3C5
SelectObject.GDI32(00000000,?), ref: 0041B3E0
SelectObject.GDI32(?,00000000), ref: 0041B3EF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B41B
SelectObject.GDI32(00000000,00000000), ref: 0041B429
SelectObject.GDI32(?,00000000), ref: 0041B437
DeleteDC.GDI32(00000000), ref: 0041B440
DeleteDC.GDI32(?), ref: 0041B449

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Object$Select$Delete$A26180A480A570Stretch
String ID:
API String ID: 359944910-0
Opcode ID: e420a80018f5a27581da0c94fb8e2332c520fd2d58b05de39de388c6394c4d5d
Instruction ID: ef99a8f9a6f00624a9096b2aeeb37702e3b70ceb3a8cbf3cb68c8f3869cb2bd7
Opcode Fuzzy Hash: e420a80018f5a27581da0c94fb8e2332c520fd2d58b05de39de388c6394c4d5d
Instruction Fuzzy Hash: 1541D071E40619AFDF10DAE9D846FEFB7BCEF08704F104466B614FB281C67869408BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00453338 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegQueryValueExA.ADVAPI32(00459246,00000000,00000000,?,00000000,?,00000000,004535D1,?,00459246,00000003,00000000,00000000,00453608), ref: 00453451

Part of subcall function 0042E670: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451E7B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E68F

RegQueryValueExA.ADVAPI32(00459246,00000000,00000000,00000000,?,00000004,00000000,0045351B,?,00459246,00000000,00000000,?,00000000,?,00000000), ref: 004534D5
RegQueryValueExA.ADVAPI32(00459246,00000000,00000000,00000000,?,00000004,00000000,0045351B,?,00459246,00000000,00000000,?,00000000,?,00000000), ref: 00453504

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004533A8
RegOpenKeyEx, xrefs: 004533D4
, xrefs: 004533C2
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045336F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: d547f96382ddb47af51d9cc29b1b85abbfcd8a0dd46a61b3a596026ad2d6d4ad
Instruction ID: 553864e69fa8df29f0895cd1651d22ce7dcdc08a544756bbeb7b66468d6216b8
Opcode Fuzzy Hash: d547f96382ddb47af51d9cc29b1b85abbfcd8a0dd46a61b3a596026ad2d6d4ad
Instruction Fuzzy Hash: DF912371A04208BBDB11DF95C942BDEB7F9EB08346F10446BF900F7282D6789F098B69

Uniqueness

Uniqueness Score: -1.00%

Function 00457208 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0045723F
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 0045725B
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00457269
GetExitCodeProcess.KERNEL32(?), ref: 0045727A
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 004572C1
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 004572DD

Strings

Helper process exited, but failed to get exit code., xrefs: 004572B3
Helper process exited., xrefs: 00457289
Helper process exited with failure code: 0x%x, xrefs: 004572A7
Stopping 64-bit helper process. (PID: %u), xrefs: 00457231
Helper isn't responding; killing it., xrefs: 0045724B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 876bd47f3016d2db9cf78fa326c892381f2b041dc37dfd2cca94a350008baebc
Instruction ID: cbbbea6dedd0d273467075bf502e8a2b7be663cd85a1a49bef8c8f37b48c8077
Opcode Fuzzy Hash: 876bd47f3016d2db9cf78fa326c892381f2b041dc37dfd2cca94a350008baebc
Instruction Fuzzy Hash: 89215C70608B009AC720E779D441B5BB7D4AF08305F04897FBC9ACB283D678E8489B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00452FEC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC48

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004531C3,?,00000000,00453287), ref: 00453113
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004531C3,?,00000000,00453287), ref: 0045324F

Part of subcall function 0042E670: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451E7B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E68F

Strings

, xrefs: 00453075
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045302B
RegCreateKeyEx, xrefs: 00453087
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045305B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 758553f8d2e594071fe37aa958d85f9a645975654b76cf36553100ddb6c8e864
Instruction ID: 2c0c5fe921886f73e21521b3bff8a538c4309916fb6f6cfb0a6381ca684f6e5a
Opcode Fuzzy Hash: 758553f8d2e594071fe37aa958d85f9a645975654b76cf36553100ddb6c8e864
Instruction Fuzzy Hash: C5812171A00609AFDB00DFE5C941BDEB7B9EB08345F54446AF901F7282D778AA09CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004913E4 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004524C4: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004915B5,_iu,?,00000000,004525FE), ref: 004525B3
Part of subcall function 004524C4: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004915B5,_iu,?,00000000,004525FE), ref: 004525C3

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00491461
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,004915B5), ref: 00491482
CreateWindowExA.USER32(00000000,STATIC,004915C4,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 004914A9
SetWindowLongA.USER32(?,000000FC,00490C3C), ref: 004914BC
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00491588,?,?,000000FC,00490C3C,00000000,STATIC,004915C4), ref: 004914EC
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00491560
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00491588,?,?,000000FC,00490C3C,00000000), ref: 0049156C

Part of subcall function 00452814: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004528FB

73A25CF0.USER32(?,0049158F,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00491588,?,?,000000FC,00490C3C,00000000,STATIC), ref: 00491582

Strings

STATIC, xrefs: 004914A2
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 0049151B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FileWindow$CloseCreateHandle$AttributesCopyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 170458502-2312673372
Opcode ID: f6f0833c634dff45ce27eae22e22124fde983d8f8d6200dc1cfe18e43cdafe9e
Instruction ID: 8fdd4e63cd422c3942ebc1833423ec4bc75e2ea9b26886e4930e7115e52d1235
Opcode Fuzzy Hash: f6f0833c634dff45ce27eae22e22124fde983d8f8d6200dc1cfe18e43cdafe9e
Instruction Fuzzy Hash: 10415270A04209AEDF00EBA5CD42F9E7BF8EB49714F51457AF500F72D2D6799E008BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042EBE0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042EBEC
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042EC00
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042EC0D
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042EC1A
GetWindowRect.USER32(?,00000000), ref: 0042EC66
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042ECA4

Strings

user32.dll, xrefs: 0042EBFB
MonitorFromWindow, xrefs: 0042EC07
GetMonitorInfoA, xrefs: 0042EC14
(, xrefs: 0042EC45

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: ab635a9dbd45ec810e9935963670e5bdc3844d9f2a3901bc6b7a360ecf31759e
Instruction ID: 4a37ecb70f16d0e534201d00fe1897e1a246a2af0c0267f068437e20043e9251
Opcode Fuzzy Hash: ab635a9dbd45ec810e9935963670e5bdc3844d9f2a3901bc6b7a360ecf31759e
Instruction Fuzzy Hash: 1221CF72301624AFD300DAAADC81F3B3698EB84B10F09452EF944EB382DA78DC048A59

Uniqueness

Uniqueness Score: -1.00%

Function 0045F2A8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0045F2B4
GetModuleHandleA.KERNEL32(user32.dll), ref: 0045F2C8
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0045F2D5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0045F2E2
GetWindowRect.USER32(?,00000000), ref: 0045F32E
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 0045F36C

Strings

MonitorFromWindow, xrefs: 0045F2CF
(, xrefs: 0045F30D
GetMonitorInfoA, xrefs: 0045F2DC
user32.dll, xrefs: 0045F2C3

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 0759357e475281c3d178149a1403ff3b79648049ae6c1278b3f2bdc8cf34fbc7
Instruction ID: 95483c6525a53468b4ec8186bc606c8502f0d91924da71a6d47f5662d43c45fd
Opcode Fuzzy Hash: 0759357e475281c3d178149a1403ff3b79648049ae6c1278b3f2bdc8cf34fbc7
Instruction Fuzzy Hash: 112192757456046BE3109A68CC81F3F3799DB88715F09453EFD84DB382DA78ED0C8A9A

Uniqueness

Uniqueness Score: -1.00%

Function 004573E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,004575BF,?,00000000,00457622,?,?,00000000,00000000), ref: 0045743D
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00457554,?,00000000,00000001,00000000,00000000,00000000,004575BF), ref: 0045749A
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00457554,?,00000000,00000001,00000000,00000000,00000000,004575BF), ref: 004574A7
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004574F3
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,0045752D,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00457554,?,00000000), ref: 00457519
GetLastError.KERNEL32(?,?,00000000,00000001,0045752D,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00457554,?,00000000), ref: 00457520

Part of subcall function 004520A4: GetLastError.KERNEL32(00000000,00452B15,00000005,00000000,00452B4A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00492A61,00000000), ref: 004520A7

Strings

TransactNamedPipe, xrefs: 004574B3
CreateEvent, xrefs: 0045744B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 4a1be90eadc7030d6042a310619e9464d84d911e0a831bbccd3557c30aaba0a6
Instruction ID: 79c6e3806f75cd6c2156c397a36c552c7ebc7e0cdca09418cd540dcb18b715b5
Opcode Fuzzy Hash: 4a1be90eadc7030d6042a310619e9464d84d911e0a831bbccd3557c30aaba0a6
Instruction Fuzzy Hash: 98418E70A04608BFDB15DF99D981F9EBBF8EB09710F5040B6F904E7792D6789E44CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00455138 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,0045529D,?,?,00000031,?), ref: 00455160
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00455166
LoadTypeLib.OLEAUT32(00000000,?), ref: 004551B3

Part of subcall function 004520A4: GetLastError.KERNEL32(00000000,00452B15,00000005,00000000,00452B4A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00492A61,00000000), ref: 004520A7

Strings

OLEAUT32.DLL, xrefs: 0045515B
ITypeLib::GetLibAttr, xrefs: 004551E9
GetProcAddress, xrefs: 00455173
LoadTypeLib, xrefs: 004551BE
UnRegisterTypeLib, xrefs: 0045521F
UnRegisterTypeLib, xrefs: 00455156

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 1ed3e8c5a2aa991d601313e4c083ed3eccbaf9bc08da749f5376dbd3bf59aa27
Instruction ID: fb038adfd684185714a4e58cf340431a6a295a782a22b6c655451b98c415bd11
Opcode Fuzzy Hash: 1ed3e8c5a2aa991d601313e4c083ed3eccbaf9bc08da749f5376dbd3bf59aa27
Instruction Fuzzy Hash: DD31A571A00A04AFC711EFAACC61D6F77B9EB89B41B5044A6FD04D7352DA38D904CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0042E274 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E379,?,?,00000001,00000000,?,?,00000001,00000000,00000002,00000000,0047BE41), ref: 0042E29D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E2A3
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E379,?,?,00000001,00000000,?,?,00000001), ref: 0042E2F1

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0042E300
Locale, xrefs: 0042E2E0
.DEFAULT\Control Panel\International, xrefs: 0042E2C8
GetUserDefaultUILanguage, xrefs: 0042E293
kernel32.dll, xrefs: 0042E298

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 45ed28070ffb47697e526778f64ff79688c24bec5b2b36becef891b4b1b2b151
Instruction ID: d6249f7fc2f92a5c557ffc1224eecf0a88ec9f0d2c320431a8896816ae334499
Opcode Fuzzy Hash: 45ed28070ffb47697e526778f64ff79688c24bec5b2b36becef891b4b1b2b151
Instruction Fuzzy Hash: 80212670B00215EBDB00EAA7DC55B9F77A9EB44315FD04477A900E7281DB7C9E05DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00416CF0 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416D83
SaveDC.GDI32(?), ref: 00416D97
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416DBA
RestoreDC.GDI32(?,?), ref: 00416DD5
CreateSolidBrush.GDI32(00000000), ref: 00416E55
FrameRect.USER32(?,?,?), ref: 00416E88
DeleteObject.GDI32(?), ref: 00416E92
CreateSolidBrush.GDI32(00000000), ref: 00416EA2
FrameRect.USER32(?,?,?), ref: 00416ED5
DeleteObject.GDI32(?), ref: 00416EDF

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 11cab2540a393598a96cd90c2e3c258298f48b02ea15760158b99ad2ea31a5fa
Instruction ID: 01d81588b69ff1f480347e903aed9c185fc6c29f227380d1fa6610f1b9ad60dd
Opcode Fuzzy Hash: 11cab2540a393598a96cd90c2e3c258298f48b02ea15760158b99ad2ea31a5fa
Instruction Fuzzy Hash: A8513C712086449BDB50EF69C8C0B9B77E8EF48314F15566AFD48CB286C738EC81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00422158 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 004221A3
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 004221C1
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221CE
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221DB
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221E8
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 004221F5
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422202
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042220F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 0042222D
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 00422249

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 05b40914ec909e1c9740d8afeb2cf42751dc2338b7eead5136cc8733da9e1836
Instruction ID: e98f5eede000e984507cfb68b46ad6efe0a5c83d9602cc3651cf502f29ecaa29
Opcode Fuzzy Hash: 05b40914ec909e1c9740d8afeb2cf42751dc2338b7eead5136cc8733da9e1836
Instruction Fuzzy Hash: 23213370380744BAE720D725DD8BF9B7BD89B04708F0444A5BA487F2D7C6F9AE40869C

Uniqueness

Uniqueness Score: -1.00%

Function 00457C10 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 130registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00457B28: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00457C5A,00000000,00457DA7,?,00000000,00000000,00000000), ref: 00457B75

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00457DA7,?,00000000,00000000,00000000), ref: 00457CB6
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00457DA7,?,00000000,00000000,00000000), ref: 00457D1C

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

Strings

v1.1.4322, xrefs: 00457D0E
.NET Framework not found, xrefs: 00457D6A
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 00457C6A
v2.0.50727, xrefs: 00457CA8
.NET Framework version %s not found, xrefs: 00457D56
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00457CD0

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$v1.1.4322$v2.0.50727
API String ID: 2976201327-1070292914
Opcode ID: 38dafa01eb145cd46e344ec0d302f40d6a4ca12a07449fb32f1c0fadfb05638c
Instruction ID: 1181c51870a89a76828bf4cdafa164266e6ab86bcafa1da5c5d87414d128b815
Opcode Fuzzy Hash: 38dafa01eb145cd46e344ec0d302f40d6a4ca12a07449fb32f1c0fadfb05638c
Instruction Fuzzy Hash: 5F41C730A081495FCB00DF65E851BEE77B6EF49309F5544BBE840DB292D739AA0ECB58

Uniqueness

Uniqueness Score: -1.00%

Function 004733A0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004732C8: GetWindowThreadProcessId.USER32(00000000), ref: 004732D0
Part of subcall function 004732C8: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004733C7,0pI,00000000), ref: 004732E3
Part of subcall function 004732C8: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004732E9

SendMessageA.USER32(00000000,0000004A,00000000,Z7G), ref: 004733D5
GetTickCount.KERNEL32 ref: 0047341A
GetTickCount.KERNEL32 ref: 00473424
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00473479

Strings

Z7G, xrefs: 004733C7, 004733CA
CallSpawnServer: Unexpected status: %d, xrefs: 00473462
0pI, xrefs: 004733A7
CallSpawnServer: Unexpected response: $%x, xrefs: 0047340A

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: 0pI$CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d$Z7G
API String ID: 613034392-2401662188
Opcode ID: 8feb52f6250f747c5a664b1527b2b5cd8d32300bfcf5c1eaa96ed0b76df53d0f
Instruction ID: 8dd7748eb102d70c53ef4d50441e40eca7a6ef9e476b6454bb3470e68b985026
Opcode Fuzzy Hash: 8feb52f6250f747c5a664b1527b2b5cd8d32300bfcf5c1eaa96ed0b76df53d0f
Instruction Fuzzy Hash: 6F31C434F002259ADB10EFB999467EEB2E09F04305F50813BB548EB382DA7C8E01979D

Uniqueness

Uniqueness Score: -1.00%

Function 0045DFD8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0045E013
GetActiveWindow.USER32 ref: 0045E077
CoInitialize.OLE32(00000000), ref: 0045E08B
SHBrowseForFolder.SHELL32(?), ref: 0045E0A2
756CD120.OLE32(0045E0E3,00000000,?,?,?,?,?,00000000,0045E167), ref: 0045E0B7
SetActiveWindow.USER32(?,0045E0E3,00000000,?,?,?,?,?,00000000,0045E167), ref: 0045E0CD
SetActiveWindow.USER32(?,?,0045E0E3,00000000,?,?,?,?,?,00000000,0045E167), ref: 0045E0D6

Strings

A, xrefs: 0045E04B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ActiveWindow$BrowseD120FolderInitializeMalloc
String ID: A
API String ID: 2698730301-3554254475
Opcode ID: 4c93aed7974da8df2999b89a302ce796433789b5a6ec67c560a89b0d32607bd6
Instruction ID: 6bfd7eabbe9e682b3dde037a987c9ea474e9b057d6f32f0a8e83a6328ca7ae7b
Opcode Fuzzy Hash: 4c93aed7974da8df2999b89a302ce796433789b5a6ec67c560a89b0d32607bd6
Instruction Fuzzy Hash: D0314471D00218AFDB04EFA6E886A9EBBF8EF09704F51447AF804E7252D7785A04CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00418BC4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418BE0
GetSystemMetrics.USER32(0000000D), ref: 00418BE8
6F522980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418BEE

Part of subcall function 00409920: 6F51C400.COMCTL32((fI,000000FF,00000000,00418C1C,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00409924

6F58CB00.COMCTL32((fI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C3E
6F58C740.COMCTL32(00000000,?,(fI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418C49
6F58CB00.COMCTL32((fI,00000001,?,?,00000000,?,(fI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000), ref: 00418C5C
6F520860.COMCTL32((fI,00418C7F,?,00000000,?,(fI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E), ref: 00418C72

Strings

(fI, xrefs: 00418C14, 00418C2C, 00418C3A, 00418C58, 00418C6E, 00418C3D, 00418C5B, 00418C71

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: MetricsSystem$C400C740F520860F522980
String ID: (fI
API String ID: 2856677924-4122540895
Opcode ID: 65e0913070e1a46d1e4049ee6121461fcfbb365fe4eb4b9520eb625876ba3720
Instruction ID: ebdf7d90a3a22d50ab8fd643d9f8c48181b88e499e337cf830e96f2c39c8652b
Opcode Fuzzy Hash: 65e0913070e1a46d1e4049ee6121461fcfbb365fe4eb4b9520eb625876ba3720
Instruction Fuzzy Hash: 19113675744204BADB50EBF5DC82F5E77B8DB48704F50406AB604E72D2E6799D408768

Uniqueness

Uniqueness Score: -1.00%

Function 0045B990 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045B999
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045B9A9
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045B9B9
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045B9C9

Strings

inflate, xrefs: 0045B9A3
inflateEnd, xrefs: 0045B9B3
inflateInit_, xrefs: 0045B993
inflateReset, xrefs: 0045B9C3

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: cdec3d2289940290433f74bcfb90cd33ccdd8b1be43608ea6e51ef040730019a
Instruction ID: 02f39ce5c28d2ed3ade6aba6a28faafd9b0cc1bc692c698d2602f952355582ec
Opcode Fuzzy Hash: cdec3d2289940290433f74bcfb90cd33ccdd8b1be43608ea6e51ef040730019a
Instruction Fuzzy Hash: 020121B0518300DADB24DF379C81B263695E764356F14893BA944552A2D77C0549EBDC

Uniqueness

Uniqueness Score: -1.00%

Function 0041A84C Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A929
73A24D40.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041A963
SetBkColor.GDI32(?,?), ref: 0041A978
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041A9C2
SetTextColor.GDI32(00000000,00000000), ref: 0041A9CD
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041A9DD
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AA1C
SetTextColor.GDI32(00000000,00000000), ref: 0041AA26
SetBkColor.GDI32(00000000,?), ref: 0041AA33

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: 70494902a934abd88d8421d1aeec792968b072de73e514355a54ff46ed356d3f
Instruction ID: 69ae49bf6c4e82acacdff2fe07525d2a8d99776db7c40e28fbb8516f53671917
Opcode Fuzzy Hash: 70494902a934abd88d8421d1aeec792968b072de73e514355a54ff46ed356d3f
Instruction Fuzzy Hash: B461D6B5A00505EFCB40EFA9D985E9AB7F8EF48314B14816AF518DB252C734ED41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00456334 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,004564E8,?, /s ",?,regsvr32.exe",?,004564E8), ref: 0045645A

Strings

/s ", xrefs: 004563A3
CreateProcess, xrefs: 0045644C
D, xrefs: 00456410
regsvr32.exe", xrefs: 0045637B
Spawning 64-bit RegSvr32: , xrefs: 004563BF
/u, xrefs: 00456396
0x%x, xrefs: 0045647D
Spawning 32-bit RegSvr32: , xrefs: 004563E1

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 083aede8d2b1757a61cb80fb4a48dd74e29d26466076b64364049000a0dce363
Instruction ID: 0727363c7f1249558044398805bdccd0d7d16a74982410126c53be3864fdc62d
Opcode Fuzzy Hash: 083aede8d2b1757a61cb80fb4a48dd74e29d26466076b64364049000a0dce363
Instruction Fuzzy Hash: 1B41E570E403086BDB10EFD5D881B9DB7F9AF49305F91407BA904BB296D7789A09CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0044CBAC Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044CBDD
GetSysColor.USER32(00000014), ref: 0044CBE4
SetTextColor.GDI32(00000000,00000000), ref: 0044CBFC
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044CC25
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044CC2F
GetSysColor.USER32(00000010), ref: 0044CC36
SetTextColor.GDI32(00000000,00000000), ref: 0044CC4E
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044CC77
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044CCA2

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 123d1c78d96388b48013e2d686bd4fbc3c46f036129ba804cfc4942d94a5bc27
Instruction ID: 1caa52e0a57a24b19c6a51c3cca57839e66ec70a0d40fc0ec19372c69ab55c34
Opcode Fuzzy Hash: 123d1c78d96388b48013e2d686bd4fbc3c46f036129ba804cfc4942d94a5bc27
Instruction Fuzzy Hash: 1D21CFB42015007FC710FB2ACD8AE9BBBECDF19319B05457A7958EB3A3C678DD408669

Uniqueness

Uniqueness Score: -1.00%

Function 00452814 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004528FB

Strings

MoveFileEx, xrefs: 00452B0B
o1I, xrefs: 00452938, 00452948, 0045297B, 00452A13, 00452A1E, 00452A06
NUL, xrefs: 004529BD
.tmp, xrefs: 004528B7
WININIT.INI, xrefs: 004528A9
[rename], xrefs: 0045295E, 0045299A

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]$o1I
API String ID: 390214022-2878587892
Opcode ID: 180da5cb8003d792c816aeea415edf5bd33e2b8e779ba911190ea486055d5340
Instruction ID: cc9533ecac0167aba3f68936dda73933724a2a20dcf6fda83704f45a3cd3408f
Opcode Fuzzy Hash: 180da5cb8003d792c816aeea415edf5bd33e2b8e779ba911190ea486055d5340
Instruction Fuzzy Hash: C1912274A002099BDB11EFA5D982BDEB7B5EF49305F508067E800B7392D7B86E09CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00490C88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00450088: SetEndOfFile.KERNEL32(?,?,0045AA1E,00000000,0045ABA9,?,00000000,00000002,00000002), ref: 0045008F

Part of subcall function 00406EB8: DeleteFileA.KERNEL32(00000000,00496628,00492DAD,00000000,00492E02,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

GetWindowThreadProcessId.USER32(00000000,?), ref: 00490D19
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00490D2D
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00490D47
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00490D53
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00490D59
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00490D6C

Strings

Deleting Uninstall data files., xrefs: 00490C8F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 0c9909550bc1c2d6830a1784165c7de32f0d2a18ee4084f0f45fe3452929a5d0
Instruction ID: fe893ce7c7fc4f02ce2c16f04c74f522583f7d0dd1eba0bd56840a119b19c503
Opcode Fuzzy Hash: 0c9909550bc1c2d6830a1784165c7de32f0d2a18ee4084f0f45fe3452929a5d0
Instruction Fuzzy Hash: 2A217371358240AEEB10A7A6EC42B273B9CDB54318F50063BF5049B2E3DA7CAC44D76D

Uniqueness

Uniqueness Score: -1.00%

Function 0046C118 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0046C215,?,?,?,?,00000000), ref: 0046C17F
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0046C215), ref: 0046C196
AddFontResourceA.GDI32(00000000), ref: 0046C1B3
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0046C1C7

Strings

AddFontResource, xrefs: 0046C1D1
Failed to set value in Fonts registry key., xrefs: 0046C188
Failed to open Fonts registry key., xrefs: 0046C19D

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: d0cfe69457fce7bbbc28504f119b2d4c3be8b6de6538d31fc16afe2da0dcfddb
Instruction ID: 8ea992291a1dd30632b8682880332e8f2f5ba9678f4ac26e890d70cee17ca1cd
Opcode Fuzzy Hash: d0cfe69457fce7bbbc28504f119b2d4c3be8b6de6538d31fc16afe2da0dcfddb
Instruction Fuzzy Hash: 8221E570B402047AE710EAA68C92F7A639CDB45748F504477BD40EB2C2E67C9D05966E

Uniqueness

Uniqueness Score: -1.00%

Function 0045F6E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416380: GetClassInfoA.USER32(00400000,?,?), ref: 004163EF
Part of subcall function 00416380: UnregisterClassA.USER32(?,00400000), ref: 0041641B
Part of subcall function 00416380: RegisterClassA.USER32(?), ref: 0041643E

GetVersion.KERNEL32 ref: 0045F718
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 0045F756
SHGetFileInfo.SHELL32(0045F7F4,00000000,?,00000160,00004011), ref: 0045F773
LoadCursorA.USER32(00000000,00007F02), ref: 0045F791
SetCursor.USER32(00000000,00000000,00007F02,0045F7F4,00000000,?,00000160,00004011), ref: 0045F797
SetCursor.USER32(?,0045F7D7,00007F02,0045F7F4,00000000,?,00000160,00004011), ref: 0045F7CA

Strings

Explorer, xrefs: 0045F732

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: e3239e46c257503266597b56140d29e20775804faaf584886ec342b17592225d
Instruction ID: 7ff7faf5247c26d25335c70635a1860a407a0e5f323aeaa6378cd2fc5b7ea516
Opcode Fuzzy Hash: e3239e46c257503266597b56140d29e20775804faaf584886ec342b17592225d
Instruction Fuzzy Hash: B121E7317403046BE710BBB98C47F9A76989B09709F4144BFBB05EA6C3DA7C9C09866D

Uniqueness

Uniqueness Score: -1.00%

Function 004019CC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(00496420,00000000,00401A82,?,?,0040222E,02240650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(00496420,00496420,00000000,00401A82,?,?,0040222E,02240650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,00496420,00000000,00401A82,?,?,0040222E,02240650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(00496420,00401A89,00000000,00401A82,?,?,0040222E,02240650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

@dI, xrefs: 004019FA
PdI, xrefs: 00401A04
|dI, xrefs: 00401A0E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: @dI$PdI$|dI
API String ID: 730355536-4088903152
Opcode ID: f176e8b5bc4d8de55a84342bec8c86950c68c795945543f3ab918003abf5a290
Instruction ID: 5e78e1d922e44001d172df758a9733a16a6df98b74bc9f0da5c534ca1700ba01
Opcode Fuzzy Hash: f176e8b5bc4d8de55a84342bec8c86950c68c795945543f3ab918003abf5a290
Instruction Fuzzy Hash: EC01C0706442405EFB19ABE99802B253ED4D795B88F13803FF440A6AF1C67C4840CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00458518 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045869A,?,00000000,00000000,00000000,?,00000006,?,00000000,00491FBA,?,00000000,0049205D), ref: 004585DE

Part of subcall function 00452EB8: FindClose.KERNEL32(000000FF,00452FAE), ref: 00452F9D

Strings

Failed to delete directory (%d)., xrefs: 00458674
Stripped read-only attribute., xrefs: 004585A0
Failed to strip read-only attribute., xrefs: 004585AC
Failed to delete directory (%d). Will retry later., xrefs: 004585F7
Deleting directory: %s, xrefs: 00458567
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 004585B8
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00458653

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 7eee57634941201ad799ca4b03e9bcf14bece65eee70f3c352577929f619c991
Instruction ID: dd70d7a7e9406b9190765920557ab5b8ad56b684bc2d1b190e3df41212a100e3
Opcode Fuzzy Hash: 7eee57634941201ad799ca4b03e9bcf14bece65eee70f3c352577929f619c991
Instruction Fuzzy Hash: 3B418630B042489BCB10DB6988427AE76E59B8930AF55857FAC05B7393DF7C890D8B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00422DC0 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422E14
GetCapture.USER32 ref: 00422E23
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422E29
ReleaseCapture.USER32 ref: 00422E2E
GetActiveWindow.USER32 ref: 00422E3D
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422EBC
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422F20
GetActiveWindow.USER32 ref: 00422F2F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 8d225d8a55f9a88f292a2c30a551b716c13a14df50b62869e123561c13ee422b
Instruction ID: 3dc7d5c5dffcbd9cfc95175fcc265abaf37585ce791e678acf2218af3f88607c
Opcode Fuzzy Hash: 8d225d8a55f9a88f292a2c30a551b716c13a14df50b62869e123561c13ee422b
Instruction Fuzzy Hash: 19416270B00244AFDB50EBA9DA42B9E77F1EF04304F5540BAF404AB3A2D7B99E40DB18

Uniqueness

Uniqueness Score: -1.00%

Function 004293F0 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000), ref: 004293FA
GetTextMetricsA.GDI32(00000000), ref: 00429403

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(00000000,00000000), ref: 00429412
GetTextMetricsA.GDI32(00000000,?), ref: 0042941F
SelectObject.GDI32(00000000,00000000), ref: 00429426
73A1A480.USER32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0042942E
GetSystemMetrics.USER32(00000006), ref: 00429453
GetSystemMetrics.USER32(00000006), ref: 0042946D

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$A480A570CreateFontIndirect
String ID:
API String ID: 361401722-0
Opcode ID: aa0e22ae2bb85fef1fe3d4d4a9dea72362df36d5d975f8d53732e0b8776d61f5
Instruction ID: 6143225b0a8ca3b977d6363335e7cd80f7f8ea5cda66b8f0fa851fdc2eb08b32
Opcode Fuzzy Hash: aa0e22ae2bb85fef1fe3d4d4a9dea72362df36d5d975f8d53732e0b8776d61f5
Instruction Fuzzy Hash: 360104917087103BF710B2769CC2F6B6188DB9435CF44003FFA469A3D3D56C8C45866A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD94 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00418FC9,00493201), ref: 0041DD97
73A24620.GDI32(00000000,0000005A,00000000,?,00418FC9,00493201), ref: 0041DDA1
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,?,00418FC9,00493201), ref: 0041DDAE
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DDBD
GetStockObject.GDI32(00000007), ref: 0041DDCB
GetStockObject.GDI32(00000005), ref: 0041DDD7
GetStockObject.GDI32(0000000D), ref: 0041DDE3
LoadIconA.USER32(00000000,00007F00), ref: 0041DDF4

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ObjectStock$A24620A480A570IconLoad
String ID:
API String ID: 3573811560-0
Opcode ID: 79ba34301ffdcd870fce82e69020cd4fb5d8953881da513776c9bfc891f1925d
Instruction ID: bf46a9fe5e63f1af167cdf0a983a4ac464f15f0dd566559e746e50b59b955e29
Opcode Fuzzy Hash: 79ba34301ffdcd870fce82e69020cd4fb5d8953881da513776c9bfc891f1925d
Instruction Fuzzy Hash: A11130706453419AE740BF655992BA63690DB64748F01813FF609AF2D2DB7A0C448B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0045FAF8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 0045FBFC
SetCursor.USER32(00000000,00000000,00007F02,00000000,0045FC91), ref: 0045FC02
SetCursor.USER32(?,0045FC79,00007F02,00000000,0045FC91), ref: 0045FC6C

Strings

Internal error: Item already expanding, xrefs: 0045FB99
, xrefs: 0045FE92
, xrefs: 0045FE77

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 2a5e59fbc60391709db9e707cfb1b81175e986b7537cdf1dfc64ada719463c73
Instruction ID: 7a834110d2e8282c1345bf2880c47fa17af2e43f078088a6ac64f542608522eb
Opcode Fuzzy Hash: 2a5e59fbc60391709db9e707cfb1b81175e986b7537cdf1dfc64ada719463c73
Instruction Fuzzy Hash: 81B14B30600604DFD711EF69C586B9ABBF1AF05305F1485BAE845AB7A3C778AD4CCB1A

Uniqueness

Uniqueness Score: -1.00%

Function 00408688 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004088D0,?,?,?,?,00000000,00000000,00000000,?,004098D7,00000000,004098EA), ref: 004086A2

Part of subcall function 004084D0: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004964C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Part of subcall function 0040851C: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040871E,?,?,?,00000000,004088D0), ref: 0040852F

Strings

AMPM, xrefs: 0040886D
:mm, xrefs: 00408884
:mm:ss, xrefs: 0040889E
m/d/yy, xrefs: 00408771
mmmm d, yyyy, xrefs: 00408793

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: d28892a32a3756e591db26ccf56d4423c4b5dcf68a3e55eb2d1216e614db25d0
Instruction ID: f7723302c3cbbcbb01f246a146743d61dec29c667e41bc47a3323a0acc4546db
Opcode Fuzzy Hash: d28892a32a3756e591db26ccf56d4423c4b5dcf68a3e55eb2d1216e614db25d0
Instruction Fuzzy Hash: CB514A35B00248ABDB01FBAA8941A9F7769DB98308F50D47FA141BB3C6DE3DDA05871D

Uniqueness

Uniqueness Score: -1.00%

Function 00411664 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00411869), ref: 004116FC
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 004117BA

Part of subcall function 00411A1C: CreatePopupMenu.USER32 ref: 00411A36

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 00411846

Part of subcall function 00411A1C: CreateMenu.USER32 ref: 00411A40

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 0041182D

Strings

?, xrefs: 00411716
,, xrefs: 0041170F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 81cf1368c6a983362ffd0b97e47859e0159252f4e06a36b3365d64b72bbd56ad
Instruction ID: 3f3527f43cca8a4f6c45e7f3696c032b38f9f6d147acb0657ff8a7652be0e8fd
Opcode Fuzzy Hash: 81cf1368c6a983362ffd0b97e47859e0159252f4e06a36b3365d64b72bbd56ad
Instruction Fuzzy Hash: CC511774A001409BDB10EF6ADC81ADA7BF9BF49304B1585BBF904E73A6D738C942CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041BDD3 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BE98
GetObjectA.GDI32(?,00000018,?), ref: 0041BEA7
GetBitmapBits.GDI32(?,?,?), ref: 0041BEF8
GetBitmapBits.GDI32(?,?,?), ref: 0041BF06
DeleteObject.GDI32(?), ref: 0041BF0F
DeleteObject.GDI32(?), ref: 0041BF18
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BF35

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: c7b0e75b457b54f40c973da1b74c3022c367d96584a0130cfc4ac672875a8614
Instruction ID: 2920a3410ecffe373541ee6f53742fd475180ef7da711f6faed1b6e94a947089
Opcode Fuzzy Hash: c7b0e75b457b54f40c973da1b74c3022c367d96584a0130cfc4ac672875a8614
Instruction Fuzzy Hash: 0C510571E00219AFCB14DFA9D8819EEB7F9EF48314B11446AF914E7391D738AD81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE48 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CE6E
73A24620.GDI32(00000000,00000026), ref: 0041CE8D
73A18830.GDI32(?,?,00000001,00000000,00000026), ref: 0041CEF3
73A122A0.GDI32(?,?,?,00000001,00000000,00000026), ref: 0041CF02
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CF6C
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041CFAA
73A18830.GDI32(?,?,00000001,0041CFDC,00000000,00000026), ref: 0041CFCF

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Stretch$A18830$A122A24620BitsMode
String ID:
API String ID: 430401518-0
Opcode ID: 132354002ca2fdf89728bebe702e6aaf01ac2d906efdfd832a76dcf97bd27496
Instruction ID: 0295d75a013be80ecc2d975aeb153abe1d20fbb24d7cab5e263b7fb8805ed029
Opcode Fuzzy Hash: 132354002ca2fdf89728bebe702e6aaf01ac2d906efdfd832a76dcf97bd27496
Instruction Fuzzy Hash: 6A512970644600AFDB14DFA8C985FABBBF9AF08304F10459AF544DB292C778ED80CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00455548 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 0045559A

Part of subcall function 004241EC: GetWindowTextA.USER32(?,?,00000100), ref: 0042420C

Part of subcall function 0041EE14: GetCurrentThreadId.KERNEL32 ref: 0041EE63
Part of subcall function 0041EE14: 73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042E908,?,00000001), ref: 0041EE69

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00455601
TranslateMessage.USER32(?), ref: 0045561F
DispatchMessageA.USER32(?), ref: 00455628

Strings

[Paused] , xrefs: 004555D0

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Message$TextWindow$A25940CurrentDispatchSendThreadTranslate
String ID: [Paused]
API String ID: 3047529653-4230553315
Opcode ID: 3a95339d3b00b4d4c014ba20a0af633e860cba05bef6b97c8997cd6cdd85c36c
Instruction ID: 1ea6cdf9f8c4d0006da5c53b80d4ab4df920001bdb03266b2b95788fb80fd04e
Opcode Fuzzy Hash: 3a95339d3b00b4d4c014ba20a0af633e860cba05bef6b97c8997cd6cdd85c36c
Instruction Fuzzy Hash: AA31E6309046886ECB11DBB5DC51BEEBBB8EB49314F91447BE804E7292D73C9909CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00467594 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,004676D3), ref: 00467650
LoadCursorA.USER32(00000000,00007F02), ref: 0046765E
SetCursor.USER32(00000000,00000000,00007F02,00000000,004676D3), ref: 00467664
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,004676D3), ref: 0046766E
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,004676D3), ref: 00467674

Strings

CheckPassword, xrefs: 004675F8

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: f618de79bd0409718f22e630077bc69e7fe5e9a916c863db875ed2d6752e7a54
Instruction ID: 0acf26c21a080d5da0313e65daee1c9aa77075bbb7fadc865c3b9f3c1b589fde
Opcode Fuzzy Hash: f618de79bd0409718f22e630077bc69e7fe5e9a916c863db875ed2d6752e7a54
Instruction Fuzzy Hash: 2131B334648744AFD711EB79C88AF9A7BE4AF05318F1580B6B8049F3A2D7789E40CB4D

Uniqueness

Uniqueness Score: -1.00%

Function 00457E90 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 00457F4B

Strings

Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 00457F56
Failed to load .NET Framework DLL "%s", xrefs: 00457F30
Fusion.dll, xrefs: 00457EEB
.NET Framework CreateAssemblyCache function failed, xrefs: 00457F6E
CreateAssemblyCache, xrefs: 00457F42

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: 7e43606b3b282d8323e48636cdf2ad907ccbab7c179dc01eb58a6d5d99b86266
Instruction ID: a43b4c24682a544c2646696e4a275acb35fc84741e5fc719d5cb135cb267c29f
Opcode Fuzzy Hash: 7e43606b3b282d8323e48636cdf2ad907ccbab7c179dc01eb58a6d5d99b86266
Instruction Fuzzy Hash: 5331A771E046096FCB11EFA5D881A9FB7B4AF04715F50857AF814A7382DB3899088799

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0B8 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BFB8: GetObjectA.GDI32(?,00000018), ref: 0041BFC5

GetFocus.USER32 ref: 0041C0D8
73A1A570.USER32(?), ref: 0041C0E4
73A18830.GDI32(?,?,00000000,00000000,0041C163,?,?), ref: 0041C105
73A122A0.GDI32(?,?,?,00000000,00000000,0041C163,?,?), ref: 0041C111
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C128
73A18830.GDI32(?,00000000,00000000,0041C16A,?,?), ref: 0041C150
73A1A480.USER32(?,?,0041C16A,?,?), ref: 0041C15D

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A18830$A122A480A570BitsFocusObject
String ID:
API String ID: 2231653193-0
Opcode ID: b5ec816d879f7673cf2204928d24ade75243476a1e646848f60b5da6794254d2
Instruction ID: be6d8328aec04e85a436dd0cf8ae2147a44d9b66c6d411dca3268b31211d8f12
Opcode Fuzzy Hash: b5ec816d879f7673cf2204928d24ade75243476a1e646848f60b5da6794254d2
Instruction Fuzzy Hash: B2116A71A40618BFDB10DBA9CC86FAFB7FCEF48700F54446AB514E7281D6789D008B68

Uniqueness

Uniqueness Score: -1.00%

Function 0047E3D8 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0047E490), ref: 0047E475

Strings

LanmanNT, xrefs: 0047E43F
WinNT, xrefs: 0047E425
ProductType, xrefs: 0047E414
System\CurrentControlSet\Control\ProductOptions, xrefs: 0047E3FC
ServerNT, xrefs: 0047E459

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 3fe8207b4309967a2eec740b8de24a374655ee6a60c09589a25f0ee3bbab2cf7
Instruction ID: 46a45326e1d9b5ff3e072bf084057b1a8ce9b2520be3d98a23739a38d90d80f2
Opcode Fuzzy Hash: 3fe8207b4309967a2eec740b8de24a374655ee6a60c09589a25f0ee3bbab2cf7
Instruction Fuzzy Hash: 8F11BB30714204AADB10DA778806BDA3AA8EB09358F51C5B7A908E7392EB7C9901C75C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3D2 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B3E0
SelectObject.GDI32(?,00000000), ref: 0041B3EF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B41B
SelectObject.GDI32(00000000,00000000), ref: 0041B429
SelectObject.GDI32(?,00000000), ref: 0041B437
DeleteDC.GDI32(00000000), ref: 0041B440
DeleteDC.GDI32(?), ref: 0041B449

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 5d8119482a24acdf9dbc4f71c87d898742faec31f652e860e6f74a5bb4e0366a
Instruction ID: 073f11bba2386bee955988a390c3df6f0cbda7ed7a331810ab0cae2060ca734e
Opcode Fuzzy Hash: 5d8119482a24acdf9dbc4f71c87d898742faec31f652e860e6f74a5bb4e0366a
Instruction Fuzzy Hash: F9114C72E40659ABDF10D6D9D985FAFB3BCEF08704F048456B614FB242C678A8418B54

Uniqueness

Uniqueness Score: -1.00%

Function 0048FCB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000), ref: 0048FCC5

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(00000000,00000000), ref: 0048FCE7
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,0049023D), ref: 0048FCFB
GetTextMetricsA.GDI32(00000000,?), ref: 0048FD1D
73A1A480.USER32(00000000,00000000,0048FD47,0048FD40,?,00000000,?,?,00000000), ref: 0048FD3A

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 0048FCF2

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Text$A480A570CreateExtentFontIndirectMetricsObjectPointSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1435929781-222967699
Opcode ID: 3db6766931fef7b11a742d2f2d9c48b6603b492ecea0d86a82d8ef65d75c1a51
Instruction ID: be2ae6e373cd916ce709c39e3fbc403556832e2453e100614d5f9d9249756fbf
Opcode Fuzzy Hash: 3db6766931fef7b11a742d2f2d9c48b6603b492ecea0d86a82d8ef65d75c1a51
Instruction Fuzzy Hash: BE018876604604BFEB01EBA5CC45F5FB3ECDB49704F510476B604E7281D678AD008B68

Uniqueness

Uniqueness Score: -1.00%

Function 00423304 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 0042331F
WindowFromPoint.USER32(?,?), ref: 0042332C
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0042333A
GetCurrentThreadId.KERNEL32 ref: 00423341
SendMessageA.USER32(00000000,00000084,?,?), ref: 0042335A
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423371
SetCursor.USER32(00000000), ref: 00423383

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 60706cbef7e7fd969e6117079794ea181f59045882c2055e97c618c29bc945ad
Instruction ID: 4e500bdd1cb7c406dcecfc45487f359b17b305850d12e3c552a5b3a09f906ed3
Opcode Fuzzy Hash: 60706cbef7e7fd969e6117079794ea181f59045882c2055e97c618c29bc945ad
Instruction Fuzzy Hash: EC01D4223043103AD620BB795C86E3F26A8CFC5B55F50417FB909BE283DA3D8D0163AD

Uniqueness

Uniqueness Score: -1.00%

Function 0048FAD8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 0048FAE8
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0048FAF5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0048FB02

Strings

user32.dll, xrefs: 0048FAE3
MonitorFromRect, xrefs: 0048FAEF
GetMonitorInfoA, xrefs: 0048FAFC

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 06817d94493c4b11f4ceaf649244f67311709392a4fb54af9b6a7fbece0388f4
Instruction ID: 57668858e8c0b0289ac4f884962ff5c073460ec000cf1e14312be6c8289e998d
Opcode Fuzzy Hash: 06817d94493c4b11f4ceaf649244f67311709392a4fb54af9b6a7fbece0388f4
Instruction Fuzzy Hash: 1BF0F652B41B1466D620357A8CA2E7FA1CDCB95770F140937BE04A7382E95DAC0E43BD

Uniqueness

Uniqueness Score: -1.00%

Function 0045B864 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045B86D
GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045B87D
GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045B88D

Strings

ArcFourInit, xrefs: 0045B877
ArcFourCrypt, xrefs: 0045B887
ISCryptGetVersion, xrefs: 0045B867

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: c3c7ec0b1ce4a4f9ebe2d8e394cd6736047279cae241cd1696ff5e4f0e7e87a0
Instruction ID: 302474af057a75e6aa59db1b8817eaeab706bde5883f342fd947c8368cb819cc
Opcode Fuzzy Hash: c3c7ec0b1ce4a4f9ebe2d8e394cd6736047279cae241cd1696ff5e4f0e7e87a0
Instruction Fuzzy Hash: BFF0F9B0529700DEEB06EF76AC866623699E79032AF14D43BE408961A2D77C0448CF1C

Uniqueness

Uniqueness Score: -1.00%

Function 0045BD64 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045BD6D
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045BD7D
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045BD8D

Strings

BZ2_bzDecompressInit, xrefs: 0045BD67
BZ2_bzDecompressEnd, xrefs: 0045BD87
BZ2_bzDecompress, xrefs: 0045BD77

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: e6e2d7970eb20b2f2d3a2813d8870e9f0062fcf45f3e9ec5bea086149b4b188d
Instruction ID: 56c68a15e36e3577f8296096390340765d2f33f8892a2948cb77f36bf455d425
Opcode Fuzzy Hash: e6e2d7970eb20b2f2d3a2813d8870e9f0062fcf45f3e9ec5bea086149b4b188d
Instruction Fuzzy Hash: 55F01DB2D18700DADB04DF32AC8176236A5E768316F14803BAA45562A2D77C084CCB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0042E754 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 20libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0049036E,QueryCancelAutoPlay,0049324C), ref: 0042E76A
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E770
InterlockedExchange.KERNEL32(00496660,00000001), ref: 0042E781
ChangeWindowMessageFilter.USER32(0000C1B9,00000001), ref: 0042E792

Strings

ChangeWindowMessageFilter, xrefs: 0042E760
user32.dll, xrefs: 0042E765

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressChangeExchangeFilterHandleInterlockedMessageModuleProcWindow
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 1365377179-2498399450
Opcode ID: fa00e12cc4cdf4861ecf6d36c6a3bf7660c016f9e535c548e0154396b519efb6
Instruction ID: 0b0503ffc39751afc322a6ee3a4e58809baba8ea613a81ff3af562a8b1a90306
Opcode Fuzzy Hash: fa00e12cc4cdf4861ecf6d36c6a3bf7660c016f9e535c548e0154396b519efb6
Instruction Fuzzy Hash: 7FE0ECA1741310EAEA207BA27D8AF5A39949764715F51403BF104651E2C6BD0C40C91C

Uniqueness

Uniqueness Score: -1.00%

Function 00474088 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00493242), ref: 0047408E
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 0047409B
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 004740AB

Strings

kernel32.dll, xrefs: 00474089
VerifyVersionInfoW, xrefs: 004740A5
VerSetConditionMask, xrefs: 00474095

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 5eed5f223692949adde618fed31680a65b1dac78b626770854a6ad78c0fe1b78
Instruction ID: 0d19a0d9c31f114b981f83037a23f21ddb5836e87f543a540fedd059151603c0
Opcode Fuzzy Hash: 5eed5f223692949adde618fed31680a65b1dac78b626770854a6ad78c0fe1b78
Instruction Fuzzy Hash: B0C0C9E1285780EDAA00A7B11CC29B72548C590B29720813B7148792D2D67C0808CF2C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5DC Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B6B5
73A1A570.USER32(?), ref: 0041B6C1
73A18830.GDI32(00000000,?,00000000,00000000,0041B78C,?,?), ref: 0041B6F6
73A122A0.GDI32(00000000,00000000,?,00000000,00000000,0041B78C,?,?), ref: 0041B702
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041B76A,?,00000000,0041B78C,?,?), ref: 0041B730
73A18830.GDI32(00000000,00000000,00000000,0041B771,?,?,00000000,00000000,0041B76A,?,00000000,0041B78C,?,?), ref: 0041B764

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A18830$A122A26310A570Focus
String ID:
API String ID: 3906783838-0
Opcode ID: 07ef95a0fb610648cfd8636f7bb4d0994a53704ba577931f4d82accc70482d19
Instruction ID: 06dd750ffd38faa4806619bbf82afcbb6c92213719a6bc319da55d16d67b79f4
Opcode Fuzzy Hash: 07ef95a0fb610648cfd8636f7bb4d0994a53704ba577931f4d82accc70482d19
Instruction Fuzzy Hash: 8E512C70A00609AFDF11DFA9C895AEEBBB8FF49704F104466F510A7390D7789981CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8AC Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B987
73A1A570.USER32(?), ref: 0041B993
73A18830.GDI32(00000000,?,00000000,00000000,0041BA59,?,?), ref: 0041B9CD
73A122A0.GDI32(00000000,00000000,?,00000000,00000000,0041BA59,?,?), ref: 0041B9D9
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BA37,?,00000000,0041BA59,?,?), ref: 0041B9FD
73A18830.GDI32(00000000,00000000,00000000,0041BA3E,?,?,00000000,00000000,0041BA37,?,00000000,0041BA59,?,?), ref: 0041BA31

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A18830$A122A26310A570Focus
String ID:
API String ID: 3906783838-0
Opcode ID: 6e3cb66e1f03a8473b81b7a24d1d9b736a83310d04235b0cfb06a94d2ee0ce24
Instruction ID: 49b1e422d63778e1935042bf56866254f806bc58ba08b8974fd4ee1451f7b7cb
Opcode Fuzzy Hash: 6e3cb66e1f03a8473b81b7a24d1d9b736a83310d04235b0cfb06a94d2ee0ce24
Instruction Fuzzy Hash: 4F512B74A006089FCB11DFA9C895AAEBBF9FF48700F118066F904EB750D7389D40CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041B478 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B4EE
73A1A570.USER32(?,00000000,0041B5C8,?,?,?,?), ref: 0041B4FA
73A24620.GDI32(?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8,?,?,?,?), ref: 0041B516
73A4E680.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8,?,?,?,?), ref: 0041B533
73A4E680.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8), ref: 0041B54A
73A1A480.USER32(?,?,0041B5A3,?,?), ref: 0041B596

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: E680$A24620A480A570Focus
String ID:
API String ID: 3709697839-0
Opcode ID: dffe9a4686f16107f5e26edd6f51779d739af283e940a3615cd9a04b614b528f
Instruction ID: a6e4b16520c9e4bc630ca31e265eea6a5194191570467489af8bdb357d288b52
Opcode Fuzzy Hash: dffe9a4686f16107f5e26edd6f51779d739af283e940a3615cd9a04b614b528f
Instruction Fuzzy Hash: 2D41C571A04254AFDF10DFA9C885AAFBBB5EF49704F1484AAE900E7351D2389D10CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045B728 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045B7F4,?,?,?,?,00000000), ref: 0045B793
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045B860,?,00000000,0045B7F4,?,?,?,?,00000000), ref: 0045B7D2

Strings

MACHINE, xrefs: 0045B776
CURRENT_USER, xrefs: 0045B767
USERS, xrefs: 0045B785
CLASSES_ROOT, xrefs: 0045B758

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: c7af221143c3757ba6277ed71e4eb1831b258c6f2836e0d3f8732b0bdbf4d2ee
Instruction ID: e717c2d1a7dc230ecc2a2e6fa1343dbc2c1f959998bf22c76ea0b4b3804cf210
Opcode Fuzzy Hash: c7af221143c3757ba6277ed71e4eb1831b258c6f2836e0d3f8732b0bdbf4d2ee
Instruction Fuzzy Hash: 59117835204608AFDB11EAA2C941B6A76ADD788306F608077AD0456783D77C5F0A959D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCFC Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BD45
GetSystemMetrics.USER32(0000000C), ref: 0041BD4F
73A1A570.USER32(00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD59
73A24620.GDI32(00000000,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD80
73A24620.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD8D
73A1A480.USER32(00000000,00000000,0041BDD3,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDC6

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A24620MetricsSystem$A480A570
String ID:
API String ID: 4042297458-0
Opcode ID: 1c903c0536bb10720712021bcda66a401c12054db1b22576e6386974878fa910
Instruction ID: 8181195c8b7ace5e518c23098daf85fccaa127339f370ed271397b7e8efdaee2
Opcode Fuzzy Hash: 1c903c0536bb10720712021bcda66a401c12054db1b22576e6386974878fa910
Instruction Fuzzy Hash: 1F212C74E046499FEB04EFA9C941BEEB7B4EB48714F10402AF514B7680D7785940CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00479270 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047927E
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,00468BAA), ref: 004792A4
GetWindowLongA.USER32(?,000000EC), ref: 004792B4
SetWindowLongA.USER32(?,000000EC,00000000), ref: 004792D5
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 004792E9
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 00479305

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: c535615766b639c986f9107e3cea8d79409d64796cebe3927d30aebfe7d6897b
Instruction ID: 4d45455b4d1dd4b2c508ae6452d3c78deeda3d3e7450a597efbdbc1d096824fd
Opcode Fuzzy Hash: c535615766b639c986f9107e3cea8d79409d64796cebe3927d30aebfe7d6897b
Instruction Fuzzy Hash: B9015EB5641310ABD700E768DD81F263B98AB1E330F0606AAB959DF3E7C639DC048B18

Uniqueness

Uniqueness Score: -1.00%

Function 0041B1E0 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A650: CreateBrushIndirect.GDI32 ref: 0041A6BB

UnrealizeObject.GDI32(00000000), ref: 0041B1EC
SelectObject.GDI32(?,00000000), ref: 0041B1FE
SetBkColor.GDI32(?,00000000), ref: 0041B221
SetBkMode.GDI32(?,00000002), ref: 0041B22C
SetBkColor.GDI32(?,00000000), ref: 0041B247
SetBkMode.GDI32(?,00000001), ref: 0041B252

Part of subcall function 00419FC8: GetSysColor.USER32(?), ref: 00419FD2

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: af92fd76f0ea33d52ebd072e8e43ea1c00ff5cbe0803c9f3aa53dd55169beb2c
Instruction ID: 2be34f36c4bf399c8fa5e8a938e63ded300dcfd20fe04f8c9e05bbd916d2a40e
Opcode Fuzzy Hash: af92fd76f0ea33d52ebd072e8e43ea1c00ff5cbe0803c9f3aa53dd55169beb2c
Instruction Fuzzy Hash: 84F0BFB1511101ABCE00FFBAD9CAE4B27A89F443097048057B944DF19BC63CDC504B3E

Uniqueness

Uniqueness Score: -1.00%

Function 00472460 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 004724B6
73A259E0.USER32(00000000,000000FC,00472414,00000000,00472646,?,00000000,0047266B), ref: 004724DD
GetACP.KERNEL32(00000000,00472646,?,00000000,0047266B), ref: 0047251A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00472560

Strings

COMBOBOX, xrefs: 004724AF

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A259ClassInfoMessageSend
String ID: COMBOBOX
API String ID: 3217714596-1136563877
Opcode ID: 2494eb77be1e0edaf4ac2089fb308deb96536dac66c833c5e7946f84bffa6ab9
Instruction ID: cb5c9aae2de1f6f31ba47a78a2c89e9f0e2bb96aecd870e4ce07d9e094be5fb6
Opcode Fuzzy Hash: 2494eb77be1e0edaf4ac2089fb308deb96536dac66c833c5e7946f84bffa6ab9
Instruction Fuzzy Hash: F4514F74A04205AFC710DF65DA85EDAB7F5EB49304F1581BBF808AB3A2C778AD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004924B8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

ShowWindow.USER32(?,00000005,00000000,0049271D,?,?,00000000), ref: 004924EE

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

Part of subcall function 00407210: SetCurrentDirectoryA.KERNEL32(00000000,?,00492516,00000000,004926E9,?,?,00000005,00000000,0049271D,?,?,00000000), ref: 0040721B

Part of subcall function 0042D328: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D3B6,?,?,00000000,?,?,00492520,00000000,004926E9,?,?,00000005), ref: 0042D35D

Strings

.dat, xrefs: 00492535
.msg, xrefs: 00492554
Uninstall, xrefs: 004924D4
IMsg, xrefs: 004925C2

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: cef1635131fbe019cec2f8b6ef242356676b9b3747d5691bc46057491393c729
Instruction ID: 355638249edcb87860175999b9826d121cd81d9e81ad854bfd2fce74e3c3dc59
Opcode Fuzzy Hash: cef1635131fbe019cec2f8b6ef242356676b9b3747d5691bc46057491393c729
Instruction Fuzzy Hash: 08317534A10204AFCB01FFA5DD5299E7FB5EB49304F91847AF400A7752CB78AD01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0048D6E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,0048D7DE,?,?,00000001,00000000,00000000,0048D7F9), ref: 0048D7C7

Strings

PI, xrefs: 0048D729
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0048D73A
%s\%s_is1, xrefs: 0048D758
Inno Setup CodeFile: , xrefs: 0048D78A

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseOpen
String ID: PI$%s\%s_is1$Inno Setup CodeFile: $Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-2023862778
Opcode ID: 631d1d32ed976d7a2296184d5c0d2f3cf8c369661ad41bfb37e5f76fcf4f9ba7
Instruction ID: 2fcff84c3ae67162e3ffacf77063da78f15bdb16a6a8b48b49f63a94f6242022
Opcode Fuzzy Hash: 631d1d32ed976d7a2296184d5c0d2f3cf8c369661ad41bfb37e5f76fcf4f9ba7
Instruction Fuzzy Hash: 96314174E042089FDB11EFAADC51A9EBBF8EB48704F90487BE414E7391D7789A058B58

Uniqueness

Uniqueness Score: -1.00%

Function 0042E7D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042E802
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E808
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042E831

Strings

ShutdownBlockReasonCreate, xrefs: 0042E7F8
user32.dll, xrefs: 0042E7FD

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: a8508c04b9d2f5bfbb96bb821981feec28a03bb8c83af4d38bd3e4f3c08e389f
Instruction ID: ad48e71c188330483611c0ccbf5126987ea3f08380f38d7ba2466a98a55f956a
Opcode Fuzzy Hash: a8508c04b9d2f5bfbb96bb821981feec28a03bb8c83af4d38bd3e4f3c08e389f
Instruction Fuzzy Hash: 35F0C2D138066176E620B2BBAC82F6B158C8F94765F540036F148EB2C2EA6CC905426E

Uniqueness

Uniqueness Score: -1.00%

Function 00456268 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00456298
GetExitCodeProcess.KERNEL32(?,00492E02), ref: 004562B9
CloseHandle.KERNEL32(?,004562EC,?,?,00456B07,00000000,00000000), ref: 004562DF

Strings

MsgWaitForMultipleObjects, xrefs: 004562A5
GetExitCodeProcess, xrefs: 004562C2

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: cb15e5097a61946509ec96b5b4b98b4a4160912f96d91287cd21a5b603376055
Instruction ID: 30010b37e156efe240ce284c3751ee9f3f87d85e2b6a261707359958cd490efa
Opcode Fuzzy Hash: cb15e5097a61946509ec96b5b4b98b4a4160912f96d91287cd21a5b603376055
Instruction Fuzzy Hash: 9801A234604204AFDB10FBA98D12A2A77E8EB49710F9104B7F910E73D3DA7D9D08861C

Uniqueness

Uniqueness Score: -1.00%

Function 004732C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 004732D0
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004733C7,0pI,00000000), ref: 004732E3
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004732E9

Strings

AllowSetForegroundWindow, xrefs: 004732D9
user32.dll, xrefs: 004732DE

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: d3186cc3dc794e7465d39709d056f6715875b1f20938bb44e2ef386321cd694c
Instruction ID: 249699eff17dbda02fe1af5a7c4854b1352fabbd495b9b7335dc6b3b1f0a0c65
Opcode Fuzzy Hash: d3186cc3dc794e7465d39709d056f6715875b1f20938bb44e2ef386321cd694c
Instruction Fuzzy Hash: DBD05E9020070275D9107AF54D47D5B224C8984712710857B3414F6183CD3CDA006A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00416B9C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416BC2
SaveDC.GDI32(?), ref: 00416BF3
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416CB5), ref: 00416C54
RestoreDC.GDI32(?,?), ref: 00416C7B
EndPaint.USER32(00000000,?,00416CBC,00000000,00416CB5), ref: 00416CAF

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: c06abe95da4831753d63b9634986ca39a884699dacb8f14d7531f4240f3d7fe3
Instruction ID: 41fb8ea60d97978a9acdf236596d3a8a0d8a1996066437b2b943a95edf1585a8
Opcode Fuzzy Hash: c06abe95da4831753d63b9634986ca39a884699dacb8f14d7531f4240f3d7fe3
Instruction Fuzzy Hash: BF414E70A042049FDB14DB99C989FAA77F9EB48304F1580AEE4459B362D778DD40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414770 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 004147A6
MulDiv.KERNEL32(?,?,?), ref: 004147C0
MulDiv.KERNEL32(?,?,?), ref: 004147E9
MulDiv.KERNEL32(?,?,?), ref: 00414814
MulDiv.KERNEL32(00000000,?,00000000), ref: 0041485C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d6a748b1b1338860e82f27f8761871ff193d734180217a0f8d82b491afa6e7
Instruction ID: 41a7722d09b35ce9ade17cd18fdec9692d257bae8bd1aa266952c484067d5cda
Opcode Fuzzy Hash: 50d6a748b1b1338860e82f27f8761871ff193d734180217a0f8d82b491afa6e7
Instruction Fuzzy Hash: D3311F746047409FC320EB69C584BABB7E8AF89714F04991EF9E5C7791D738EC818B19

Uniqueness

Uniqueness Score: -1.00%

Function 0042973C Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429778
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 004297A7
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 004297C3
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 004297EE
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042980C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fe9210cf49636514123fe8028928f87ce2f158866a525e02be5b173165c2f537
Instruction ID: 5c059f72bad19c8464015bcf3ba3f3fa2ba546ca9f5ab3c2e37583cf1b766786
Opcode Fuzzy Hash: fe9210cf49636514123fe8028928f87ce2f158866a525e02be5b173165c2f537
Instruction Fuzzy Hash: 2E217F70710714BAE710ABA6DC82F5B77ACEB46708F90443EB501BB3D2DB78AD41865C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB28 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BB3A
GetSystemMetrics.USER32(0000000C), ref: 0041BB44
73A1A570.USER32(00000000,00000001,0000000C,0000000B,?,?), ref: 0041BB82
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BCED,?,00000000,00000001,0000000C,0000000B,?,?), ref: 0041BBC9
DeleteObject.GDI32(00000000), ref: 0041BC0A

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: MetricsSystem$A26310A570DeleteObject
String ID:
API String ID: 4277397052-0
Opcode ID: cb0e2adf6529593e89f90c831e9305c3e05f521d232314fc64d16b3fc11dbc77
Instruction ID: e64c8cfb77975bfe1c5019289902123c5e37d94f13133d85ba8c481b6df62587
Opcode Fuzzy Hash: cb0e2adf6529593e89f90c831e9305c3e05f521d232314fc64d16b3fc11dbc77
Instruction Fuzzy Hash: 91316F74E00609EFDB00DFA5C941AAEB7F4EB48700F10846AF510AB781D7389E80DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0046F304 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045B728: SetLastError.KERNEL32(00000057,00000000,0045B7F4,?,?,?,?,00000000), ref: 0045B793

GetLastError.KERNEL32(00000000,00000000,00000000,0046F3D8,?,?,00000001,00497154), ref: 0046F391
GetLastError.KERNEL32(00000000,00000000,00000000,0046F3D8,?,?,00000001,00497154), ref: 0046F3A7

Strings

Failed to set permissions on registry key (%d)., xrefs: 0046F3B8
Could not set permissions on the registry key because it currently does not exist., xrefs: 0046F39B
Setting permissions on registry key: %s\%s, xrefs: 0046F356

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: 87852a33b546a8e6be721aba86ca3a695e09cec86a451c63f51eb9dc0dbeb33b
Instruction ID: ef7c6c74ecef8c5dcb146dfdc27ea61306564732d519a6a89d10c305d013d1cf
Opcode Fuzzy Hash: 87852a33b546a8e6be721aba86ca3a695e09cec86a451c63f51eb9dc0dbeb33b
Instruction Fuzzy Hash: B421AA70A046445FCB00DBA9D8816AEBBE8EF49314F50417FE844E7392E7785D49876A

Uniqueness

Uniqueness Score: -1.00%

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: bbd83879051bbb61c82a419d540aea94b1d83442c47b8cdfd9cb13069dd9a881
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: bbd83879051bbb61c82a419d540aea94b1d83442c47b8cdfd9cb13069dd9a881
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Uniqueness

Uniqueness Score: -1.00%

Function 00414350 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

73A18830.GDI32(00000000,00000000,00000000), ref: 00414389
73A122A0.GDI32(00000000,00000000,00000000,00000000), ref: 00414391
73A18830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143A5
73A122A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143AB
73A1A480.USER32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143B6

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A122A18830$A480
String ID:
API String ID: 3325508737-0
Opcode ID: 194e3fff164acdd9274630c615ac113e6c237e1a8584744cad8ee02aea33715e
Instruction ID: 94861c3129a932f854b236b0087f7367a4de39103189020794ca85cb03cdcc47
Opcode Fuzzy Hash: 194e3fff164acdd9274630c615ac113e6c237e1a8584744cad8ee02aea33715e
Instruction Fuzzy Hash: 6F01DF7121C3806AD200B63E8C85A9F6BED8FCA314F15556EF498DB382CA7ACC018765

Uniqueness

Uniqueness Score: -1.00%

Function 00401548 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,PdI,?,?,?,004018B4), ref: 00401566
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,PdI,?,?,?,004018B4), ref: 0040158B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,PdI,?,?,?,004018B4), ref: 004015B1

Strings

@dI, xrefs: 00401599
PdI, xrefs: 0040154B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID: @dI$PdI
API String ID: 3668210933-1385995325
Opcode ID: d2517b2848a3e48debd733cbcc194f1d7450fe1c69e1d9f9fa61647bd21528fe
Instruction ID: 5797ca947971a1fa5f0c07c4efe461a423a426aef50e25704ee96cdc5a06cd6d
Opcode Fuzzy Hash: d2517b2848a3e48debd733cbcc194f1d7450fe1c69e1d9f9fa61647bd21528fe
Instruction Fuzzy Hash: C5F0C8716403206AEB315A694C85F133AD4DBC5794F104075BE09FF3D9D6B8980082AC

Uniqueness

Uniqueness Score: -1.00%

Function 004755B4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,00476DAD,?,00000000,00000000,00000001,00000000,00475851,?,00000000), ref: 00475815

Strings

pUG, xrefs: 004756AE
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00475689
Failed to parse "reg" constant, xrefs: 0047581C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant$pUG
API String ID: 3535843008-1176165611
Opcode ID: 3642018d57e9592f06bab58574b61b62b6ca112a26629dc16a5ab29dcfff1776
Instruction ID: a53c2b258f7a770121dbc7a1e713ee2373e0806090ae57177e88baa161e34d04
Opcode Fuzzy Hash: 3642018d57e9592f06bab58574b61b62b6ca112a26629dc16a5ab29dcfff1776
Instruction Fuzzy Hash: 93816274E00548AFCB10EF95D481ADEBBF9AF48314F50C16AE418BB391D778AE05CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00424C50 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041EFE4: GetActiveWindow.USER32 ref: 0041EFE7
Part of subcall function 0041EFE4: GetCurrentThreadId.KERNEL32 ref: 0041EFFC
Part of subcall function 0041EFE4: 73A25940.USER32(00000000,Function_0001EFC0), ref: 0041F002

Part of subcall function 00423118: GetSystemMetrics.USER32(00000000), ref: 0042311A

OffsetRect.USER32(?,?,?), ref: 00424D39
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424DFC
OffsetRect.USER32(?,?,?), ref: 00424E0D

Part of subcall function 004234D4: GetCurrentThreadId.KERNEL32 ref: 004234E9
Part of subcall function 004234D4: SetWindowsHookExA.USER32(00000003,00423490,00000000,00000000), ref: 004234F9
Part of subcall function 004234D4: CreateThread.KERNEL32(00000000,000003E8,00423440,00000000,00000000), ref: 0042351D

Part of subcall function 00424A9C: SetTimer.USER32(00000000,00000001,?,00423424), ref: 00424AB7

Strings

KB, xrefs: 00424C63, 00424D41

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Thread$CurrentOffsetRect$A25940ActiveCreateDrawHookMetricsSystemTextTimerWindowWindows
String ID: KB
API String ID: 1906964682-1869488878
Opcode ID: ac59093d0a27b56582ffd997aef8b1d0a4f4e0e0dacd98770d8e5faaed5e2370
Instruction ID: 8a1ca8d85bab54549b4d9d093631307a73357c8a1ef7de59c5480922928757da
Opcode Fuzzy Hash: ac59093d0a27b56582ffd997aef8b1d0a4f4e0e0dacd98770d8e5faaed5e2370
Instruction Fuzzy Hash: D6811771A002189FDB14DFA8D884ADEBBB5FF48314F5045AAE904AB296DB38AD45CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406F0C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00406F6B
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 00406FE5
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 0040703D

Strings

Z, xrefs: 00406FA4

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 92ba5960390d49c3d5abeb35786e3f2b2430fe15f73cbae2fbe59e8f9896e220
Instruction ID: f15ffb13b1197877662b480f320dceb00dd84bb003a9336f5ebe52512d9587e7
Opcode Fuzzy Hash: 92ba5960390d49c3d5abeb35786e3f2b2430fe15f73cbae2fbe59e8f9896e220
Instruction Fuzzy Hash: B2515170E042099FDB11EF55C941A9EBBB9FB09304F5041BAE540BB3D1C778AE418F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0044C9F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044CA82
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044CAAD
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044CB35

Strings

, xrefs: 0044CA67

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: dec825a9aee2c6b09e518825b83954473c9bd52475d7aaf62d715cc4f9536ee8
Instruction ID: f2b81961a5c9452665bafda12c1e8f4b26a8e6b06f7f6a997a3587ccb4a7b75e
Opcode Fuzzy Hash: dec825a9aee2c6b09e518825b83954473c9bd52475d7aaf62d715cc4f9536ee8
Instruction Fuzzy Hash: 6B516171900248AFDB50DFA5C8C5BDEBBF9EF49308F08447AE845EB251D778A944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042E9CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,00000000,0042EB20,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042E9F6

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(?,00000000), ref: 0042EA19
73A1A480.USER32(00000000,?,0042EB05,00000000,0042EAFE,?,00000000,00000000,0042EB20,?,?,?,?,00000000,00000000,00000000), ref: 0042EAF8

Strings

...\, xrefs: 0042EAAA

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: A480A570CreateFontIndirectObjectSelect
String ID: ...\
API String ID: 2998766281-983595016
Opcode ID: b314a03392ad466b231ea2b72e8a3a9b21c4fc795225b8958865863d61eb2cce
Instruction ID: f87e9a1f05be7c7dd371759d08ccf2a788e9820b1ab6f676742360811e2f955b
Opcode Fuzzy Hash: b314a03392ad466b231ea2b72e8a3a9b21c4fc795225b8958865863d61eb2cce
Instruction Fuzzy Hash: 66315270B00128ABDF11EB9AD841BAEBBB8FF48304F91447BF410A7291D7789E45CA59

Uniqueness

Uniqueness Score: -1.00%

Function 004524C4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004915B5,_iu,?,00000000,004525FE), ref: 004525B3
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004915B5,_iu,?,00000000,004525FE), ref: 004525C3

Strings

_iu, xrefs: 00452555
.tmp, xrefs: 00452567

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: c22b8ce8574c61dc3ef091bac60bed15bb6ab68bbab1d5513bbcbbc103e4e3ac
Instruction ID: e65077276ccf3fce125a3b1cef4711b6e1a57cb68d75bf9d1e013844d831b580
Opcode Fuzzy Hash: c22b8ce8574c61dc3ef091bac60bed15bb6ab68bbab1d5513bbcbbc103e4e3ac
Instruction Fuzzy Hash: CF31B870A40209ABCB11EBA5C942B9EBBB5AF45309F60447BF804B73C2E7785F05876D

Uniqueness

Uniqueness Score: -1.00%

Function 00416380 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 004163EF
UnregisterClassA.USER32(?,00400000), ref: 0041641B
RegisterClassA.USER32(?), ref: 0041643E

Strings

@, xrefs: 00416399

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: b3c037979d55da6bd2fe69246b4aced05b12eabfb080271b8c9806cbc91c032b
Instruction ID: e8561198b81c08f142b3a544c89b4739d35f798691a26b07e42a1fbbf62ba06a
Opcode Fuzzy Hash: b3c037979d55da6bd2fe69246b4aced05b12eabfb080271b8c9806cbc91c032b
Instruction Fuzzy Hash: 94316E706042058BD760EF68C981B9B77E5AB88308F04447FF985DB392DB39D9448B6E

Uniqueness

Uniqueness Score: -1.00%

Function 004928CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00493199,00000000,004929C2,?,?,00000000,00496628), ref: 0049293C
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00493199,00000000,004929C2,?,?,00000000,00496628), ref: 00492965
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0049297E

Strings

isRS-%.3u.tmp, xrefs: 0049291B

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: ca7de64efd1a81cfe0b197b1df468b3a71946ac3222c8e5426d60e2b27b10d4a
Instruction ID: f317836663e3456f6962b38be5478bf9a68de7f196930fcf54a7ed662431e31d
Opcode Fuzzy Hash: ca7de64efd1a81cfe0b197b1df468b3a71946ac3222c8e5426d60e2b27b10d4a
Instruction Fuzzy Hash: 682175B1E00219BFCF01EFA9C981AAFBBB8EF44314F10453BB814B72D1D6785E018A59

Uniqueness

Uniqueness Score: -1.00%

Function 00455014 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00455068
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00455095

Strings

LoadTypeLib, xrefs: 00455073
RegisterTypeLib, xrefs: 004550A0

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: 10250a5388d3ee4e550ba31a3fe5ac1922547201747451197e41336d70963160
Instruction ID: a0afcb3eee2e7d482a942a29ca59f5276f9681079562e2f4f26ed5ddc6a25d5d
Opcode Fuzzy Hash: 10250a5388d3ee4e550ba31a3fe5ac1922547201747451197e41336d70963160
Instruction Fuzzy Hash: B3119A30B00A04BFDB11DFA6DD61A5EBBBDDB49B05B108476FD00D3692DA399D04C654

Uniqueness

Uniqueness Score: -1.00%

Function 004912C2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 004912FB

Strings

(PI, xrefs: 00491348
/INITPROCWND=$%x , xrefs: 00491326
@, xrefs: 004912C8

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window
String ID: (PI$/INITPROCWND=$%x $@
API String ID: 2353593579-723503215
Opcode ID: 86e6223bfffcafd1a2f65b692b323bd489f5f98954c4b0d8703fa7141f283f5b
Instruction ID: 1f11efd2ee19ddf28ed764c7ee5ed9f3dfbff071989b61bae05a2d8f1a94ab96
Opcode Fuzzy Hash: 86e6223bfffcafd1a2f65b692b323bd489f5f98954c4b0d8703fa7141f283f5b
Instruction Fuzzy Hash: 4611C071A082099FDB01EBA5D841BAEBFB8EB48304F50447BE804E7692D6789904CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00473B54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

GetFocus.USER32 ref: 00473BBF
GetKeyState.USER32(0000007A), ref: 00473BD1
WaitMessage.USER32(?,00000000,00473BF8,?,00000000,00473C1F,?,?,00000001,00000000,?,?,?,?,0047AFF7,00000000), ref: 00473BDB

Strings

Wnd=$%x, xrefs: 00473BA3

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: 148b3ddb7fb618247b6546acefc5128578639e1ec72ed586d201cbdf9417bc3e
Instruction ID: 9b2db89c6fe012053fe9ee9db841d35393315fe18e075f30de14d411f09ec015
Opcode Fuzzy Hash: 148b3ddb7fb618247b6546acefc5128578639e1ec72ed586d201cbdf9417bc3e
Instruction Fuzzy Hash: A111A371604205AFC701FF65CC42ADEBBB8EB49704B51C4BAF408E7681D738AF00AA69

Uniqueness

Uniqueness Score: -1.00%

Function 004553F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 0045540D
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 0045549F

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00455439
4II, xrefs: 00455454

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: MessageSend
String ID: 4II$Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)
API String ID: 3850602802-2462613993
Opcode ID: 21981b69b3b60292a9e34021e10eefbd607064df05416549cbbf09db8aab2aab
Instruction ID: b78d32421564deef5ec6d5e0726a4814eb3dcf40a391e8832c227d70dedd3d0b
Opcode Fuzzy Hash: 21981b69b3b60292a9e34021e10eefbd607064df05416549cbbf09db8aab2aab
Instruction Fuzzy Hash: 7411E5B1204240AFD700AB29AC81B6F7A9C9791309F05403FF9859F393D3794804C76A

Uniqueness

Uniqueness Score: -1.00%

Function 0046A538 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046A540
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046A54F

Strings

(invalid), xrefs: 0046A5D2
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046A5C4

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: 77c66de3cf485688cd8a454c74e7d13fa64a864e7151765c05c799678a767d6c
Instruction ID: 3d329a02b99cf0ad1c2443f5a734abd9e2d9e95f88f8d85801cc299a54af140a
Opcode Fuzzy Hash: 77c66de3cf485688cd8a454c74e7d13fa64a864e7151765c05c799678a767d6c
Instruction Fuzzy Hash: 6111F8A040C3919ED340DF2AC44432BBAE4AB89704F04892FF9D8D6381E779C948DBB7

Uniqueness

Uniqueness Score: -1.00%

Function 00452A5A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00452A67

Part of subcall function 00406EB8: DeleteFileA.KERNEL32(00000000,00496628,00492DAD,00000000,00492E02,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

MoveFileA.KERNEL32(00000000,00000000), ref: 00452A8C

Part of subcall function 004520A4: GetLastError.KERNEL32(00000000,00452B15,00000005,00000000,00452B4A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00492A61,00000000), ref: 004520A7

Strings

DeleteFile, xrefs: 00452A78
MoveFile, xrefs: 00452A95

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: cba485c4373cb9b3476474b8e686bddda4e38f58d72cb5e4c066a25f76e66c5c
Instruction ID: f8b9d45963fbba9a2c353dd22a61e6c6557ef6b5226e77028bb226458c331aba
Opcode Fuzzy Hash: cba485c4373cb9b3476474b8e686bddda4e38f58d72cb5e4c066a25f76e66c5c
Instruction Fuzzy Hash: 32F036757141055BE704FFA6DA5266F63ECEF4530AFA0443BB800B76C3EA7C9E094929

Uniqueness

Uniqueness Score: -1.00%

Function 0047E330 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0047E371
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0047E394

Strings

CSDVersion, xrefs: 0047E368
System\CurrentControlSet\Control\Windows, xrefs: 0047E33E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 0901654d9ab6cc44d6c913291a9ded88af89d372fc2709b86358ce193460f02c
Instruction ID: 8efd12000c89c59f245f9e1a1bb94511b09fbcc5fab7c17f0dd19fd863842872
Opcode Fuzzy Hash: 0901654d9ab6cc44d6c913291a9ded88af89d372fc2709b86358ce193460f02c
Instruction Fuzzy Hash: EFF03675A40209E6DF10D6E28C45BDF77BCAB08708F1086A7EE14E7280E7789A44CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00457B28 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00457C5A,00000000,00457DA7,?,00000000,00000000,00000000), ref: 00457B75

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 00457B48
.NET Framework not found, xrefs: 00457B84
InstallRoot, xrefs: 00457B64

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: 23cb1f2033dc3865c53e7f2342fb28a5b001a15c0a0e235066296095a06ac94b
Instruction ID: d0e0819fb55c8f1190b2a98828cf62c2b63c39478ea79f7c0b5f5cfc857af762
Opcode Fuzzy Hash: 23cb1f2033dc3865c53e7f2342fb28a5b001a15c0a0e235066296095a06ac94b
Instruction Fuzzy Hash: 0DF0AF317041205BC710EB1AF851B4A6689DB9131AF54403BF980D7256D77DEC0A875A

Uniqueness

Uniqueness Score: -1.00%

Function 0042D7CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00452762,00000000,00452805,?,?,00000000,00000000,00000000,00000000,00000000,?,00452AD1,00000000), ref: 0042D7E6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D7EC

Strings

kernel32.dll, xrefs: 0042D7E1
GetSystemWow64DirectoryA, xrefs: 0042D7DC

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 159a61d3abceb67132d836cbc908e23cdc840a77e135d0af2cc19f2b4bcaaff8
Instruction ID: 4db8f333c9a0d948aa4d288d669557f69a64c6eaa67e0ad6c3f7b03414b73d9c
Opcode Fuzzy Hash: 159a61d3abceb67132d836cbc908e23cdc840a77e135d0af2cc19f2b4bcaaff8
Instruction Fuzzy Hash: 23E04F61B44B1112D7107ABA9C83A5B10898B88724FA0843B79A5E72C7EDBCD94A1A7D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E87C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042E7F8), ref: 0042E88A
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E890

Strings

ShutdownBlockReasonDestroy, xrefs: 0042E880
user32.dll, xrefs: 0042E885

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 45ddc528c20c35e0718a7e9c00f94a1c84d7b78ddc924b0a461653c56359e4f8
Instruction ID: 93babc8de609d28a759936f35cc35ab5444e0eee9e0897fa3c7a0f5d424eaefa
Opcode Fuzzy Hash: 45ddc528c20c35e0718a7e9c00f94a1c84d7b78ddc924b0a461653c56359e4f8
Instruction Fuzzy Hash: 5FD0C992352B726A6A1075FB3CD19EB02CCCE517B53A40077F684E7342EAADCC0535AD

Uniqueness

Uniqueness Score: -1.00%

Function 0044F178 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00493215), ref: 0044F1B3
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F1B9

Strings

NotifyWinEvent, xrefs: 0044F1A9
user32.dll, xrefs: 0044F1AE

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: 1b77f3625f350db58ab3348097a305bf1d639b9e1269e079a5da3a737ffde695
Instruction ID: 84f0676aae26238d79669219dc5dd421ce8b9c86ef8cbad31698c6a02a110ee9
Opcode Fuzzy Hash: 1b77f3625f350db58ab3348097a305bf1d639b9e1269e079a5da3a737ffde695
Instruction Fuzzy Hash: 25E012E0A01740DDEB10FBB5D942B0B3EA0EB5475DB01017BB4006619AC77C4C088B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00492FE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00493266,00000001,00000000,0049328A), ref: 00492FEA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00492FF0

Strings

DisableProcessWindowsGhosting, xrefs: 00492FE0
user32.dll, xrefs: 00492FE5

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 7dd0ed140dce1b1c3cfbac4273f952859e09270a56939a23c95a62daeb5fa57b
Instruction ID: 931628e3c560cbc195009d45a592bfebd759f3ec05311ed7f501d7576358ba43
Opcode Fuzzy Hash: 7dd0ed140dce1b1c3cfbac4273f952859e09270a56939a23c95a62daeb5fa57b
Instruction Fuzzy Hash: A1B09281281701A08C1076F20E42E5B0C18584072571400373400B10CBCEACCA00382D

Uniqueness

Uniqueness Score: -1.00%

Function 00460EAC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B08C: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F1A9,00493215), ref: 0044B0B3
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B0CB
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B0DD
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B0EF
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B101
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B113
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B125
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B137
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B149
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B15B
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B16D
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B17F
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B191
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B1A3
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B1B5
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B1C7
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B1D9
Part of subcall function 0044B08C: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B1EB

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00493238), ref: 00460EBB
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00460EC1

Strings

shell32.dll, xrefs: 00460EB6
SHPathPrepareForWriteA, xrefs: 00460EB1

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: 5a4f7db66d802c99414a1ac829227c9d7fb949c2f41460f01609198adda9a48e
Instruction ID: c6d074b57e85807914eec84ee8616fe1a8135e5451870e443c9658575dc96a53
Opcode Fuzzy Hash: 5a4f7db66d802c99414a1ac829227c9d7fb949c2f41460f01609198adda9a48e
Instruction Fuzzy Hash: 4EB092D0A51B11E48E10B7B39C4390B1814C544B0E710493BB0607A083EB7E40044E6E

Uniqueness

Uniqueness Score: -1.00%

Function 00413C68 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413CB6
GetDesktopWindow.USER32 ref: 00413D6E

Part of subcall function 00418E30: 6F58C6F0.COMCTL32(?,00000000,00413F33,00000000,00414043,?,?,00496628), ref: 00418E4C
Part of subcall function 00418E30: ShowCursor.USER32(00000001,?,00000000,00413F33,00000000,00414043,?,?,00496628), ref: 00418E69

SetCursor.USER32(00000000,?,?,?,?,00413A63,00000000,00413A76), ref: 00413DAC

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 86f28fd5b8e67e4ed68fb8d3243ff4e40f6b005c19925ef4854e6769390e0e23
Instruction ID: 370eb430aafb64f03e0c00a45e78fc31171da0b863367db60babd08861f95fe9
Opcode Fuzzy Hash: 86f28fd5b8e67e4ed68fb8d3243ff4e40f6b005c19925ef4854e6769390e0e23
Instruction Fuzzy Hash: 5C412A75600150AFCB10EF29F988B9677E1AB65325B17847FE404DB369DA38EC81CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004089BC Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 004089DD
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408A4C
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408AE7
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408B26

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: 3ad30de8adde06992adcb1243033629fda3c93d42ee346dc6366a67b7f75c718
Instruction ID: d4d784650a0269eb12294142f4e6c1e51b8c8d651a7e98bb559ca79e8df8d1d5
Opcode Fuzzy Hash: 3ad30de8adde06992adcb1243033629fda3c93d42ee346dc6366a67b7f75c718
Instruction Fuzzy Hash: 8F3141706083809FD730EB65C945B9B77E89B86304F40483FB6C8EB2D1DB7999098B67

Uniqueness

Uniqueness Score: -1.00%

Function 0044E2F8 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E341

Part of subcall function 0044C984: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044C9B6

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E3C5

Part of subcall function 0042BB24: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BB38

IsRectEmpty.USER32(?), ref: 0044E387
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E3AA

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 3f1c9d4db00e826481b178ab64ea00970205f687122e4d4c1c485c0144d2d05a
Instruction ID: f1327bf96be57b41a4daac13efecf4e5f8c8315b345326dd3a19bc45d13401f9
Opcode Fuzzy Hash: 3f1c9d4db00e826481b178ab64ea00970205f687122e4d4c1c485c0144d2d05a
Instruction Fuzzy Hash: 55115E72B0030027E210BA7E8C86B6B76C99B89748F04083FB646EB383DE7DDC054399

Uniqueness

Uniqueness Score: -1.00%

Function 004900D0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00490134
OffsetRect.USER32(?,00000000,?), ref: 0049014F
OffsetRect.USER32(?,?,00000000), ref: 00490169
OffsetRect.USER32(?,00000000,?), ref: 00490184

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: d3f66989ff800960b4c0a82a6ffd76303d58a919d7c08028faeb7088e89b5ea7
Instruction ID: 0e3da5e30cc057e3d74a4c16cf1607cb24db427b0c3e95cd5a18fc3dad4c20bc
Opcode Fuzzy Hash: d3f66989ff800960b4c0a82a6ffd76303d58a919d7c08028faeb7088e89b5ea7
Instruction Fuzzy Hash: 52217CB6700201AFD700DE69CC85E6BB7EEEBC4300F14CA2AF694C7249D635ED448796

Uniqueness

Uniqueness Score: -1.00%

Function 0048FD88 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000008,?), ref: 0048FD9D
MulDiv.KERNEL32(50142444,00000008,?), ref: 0048FDB1
MulDiv.KERNEL32(F757C3E8,00000008,?), ref: 0048FDC5
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 0048FDE3

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6335ae3c13ddf35d91c6dca3ece5bfa36ba83b479f3d3f49975b0228b2d303f4
Instruction ID: 0205f8053e5b888f5c8b1498a92a9aed559835e4432beced00229de2e9d93edf
Opcode Fuzzy Hash: 6335ae3c13ddf35d91c6dca3ece5bfa36ba83b479f3d3f49975b0228b2d303f4
Instruction Fuzzy Hash: 49112172604204ABCB40EEA9C8C4D9B77ECEF4D320B14416AF918DB246D634ED40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3F0 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F3E0,?), ref: 0041F411
UnregisterClassA.USER32(0041F3E0,00400000), ref: 0041F43A
RegisterClassA.USER32(00494598), ref: 0041F444
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F47F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: d848210eac8fa203de2a57be4a09b5e70b2efef1fc89853c1c9f6bba622f69a5
Instruction ID: 124ae18f6ccee6cd3f50944003dafe19b4a4e3b77e192b7b2acb4d1f887b2837
Opcode Fuzzy Hash: d848210eac8fa203de2a57be4a09b5e70b2efef1fc89853c1c9f6bba622f69a5
Instruction Fuzzy Hash: 390152712401047BCB10EBE8ED81E9B379CA769314B12413BBA05E72E1D6359C164BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040D170 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D187
LoadResource.KERNEL32(00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?,?,00477B64,0000000A,REGDLL_EXE), ref: 0040D1A1
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?,?,00477B64), ref: 0040D1BB
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?), ref: 0040D1C5

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: b3c15c4636e7b2139434bed422b55b0694fd43cf85b07dfc26612a38abd02691
Instruction ID: a2e4909c1946fcd89949086e6ecb513f2c22862e5b7fa6f76d970aa484769738
Opcode Fuzzy Hash: b3c15c4636e7b2139434bed422b55b0694fd43cf85b07dfc26612a38abd02691
Instruction Fuzzy Hash: BEF0FF726056046F9754EE9DA881D5B76ECDE48264320416AF908EB246DE38DD118B78

Uniqueness

Uniqueness Score: -1.00%

Function 0046C4BC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 0046C50D

Strings

Unsetting NTFS compression on file: %s, xrefs: 0046C4F3
Setting NTFS compression on file: %s, xrefs: 0046C4DB
Failed to set NTFS compression state (%d)., xrefs: 0046C51E

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: fb7718b071c0914bf1192868056acc387081eb1d94fca06d3814556e42a6789b
Instruction ID: 8a11723362a507f0333bc9965096a3e3adfce4be1f63418e8be67e25eb968b75
Opcode Fuzzy Hash: fb7718b071c0914bf1192868056acc387081eb1d94fca06d3814556e42a6789b
Instruction Fuzzy Hash: E1016770E0825866CB04D7ED54812FDBBE49F4D314F84C1EFA499E7243EB791508879B

Uniqueness

Uniqueness Score: -1.00%

Function 00454788 Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,00459E8A,?,?,?,?,?,00000000,00459EB1), ref: 004547C4
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,00459E8A,?,?,?,?,?,00000000), ref: 004547CD
RemoveFontResourceA.GDI32(00000000), ref: 004547DA
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 004547EE

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 46c8cad0b261e60d48b1d3e67bfe7d27a1d7efb6af96d1f02519370c88f59435
Instruction ID: 4674671b110c5257b68e85d971ffdb8cda5f86f627ed5b1345ff1e290f3286d1
Opcode Fuzzy Hash: 46c8cad0b261e60d48b1d3e67bfe7d27a1d7efb6af96d1f02519370c88f59435
Instruction Fuzzy Hash: A8F05EB575430136EA10B6B69C87F1B228C9F98749F10483BBA00EF2C3DA7CD805962D

Uniqueness

Uniqueness Score: -1.00%

Function 0046BBCC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046BC1D

Strings

Failed to set NTFS compression state (%d)., xrefs: 0046BC2E
Setting NTFS compression on directory: %s, xrefs: 0046BBEB
Unsetting NTFS compression on directory: %s, xrefs: 0046BC03

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: 193f04cdd3814c648f2f02ce4df2b6aea48c5bd246c2d2babab580325bb350f9
Instruction ID: 69529bc4e5d6d07a91d00c664886aea47b6ace433f8fc03d3f3948ef3290ac7a
Opcode Fuzzy Hash: 193f04cdd3814c648f2f02ce4df2b6aea48c5bd246c2d2babab580325bb350f9
Instruction Fuzzy Hash: 7B016730D0424866CB04D7AD54416DDBBE4DF4D304F44C1EFA858E7247EB79064887DB

Uniqueness

Uniqueness Score: -1.00%

Function 00473938 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,0047B594,?,?,00000001,00000000,00000002,00000000,0047BE41,?,?,?,?,?,00493309), ref: 00473941
OpenProcessToken.ADVAPI32(00000000,00000008,?,0047B594,?,?,00000001,00000000,00000002,00000000,0047BE41), ref: 00473947
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,0047B594,?,?,00000001,00000000,00000002,00000000,0047BE41), ref: 00473969
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,0047B594,?,?,00000001,00000000,00000002,00000000), ref: 0047397A

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 965a841a766a9c6b5049f1f4a3e36c493a97bbe3403353d1f3db49a3fb4cf4d9
Instruction ID: bb68efe843bb787bbe1951a3fb92d0835bf9270be0aaf8c05fbae998de9023db
Opcode Fuzzy Hash: 965a841a766a9c6b5049f1f4a3e36c493a97bbe3403353d1f3db49a3fb4cf4d9
Instruction Fuzzy Hash: 94F030A16443016BD600EAB5CD82E9B77DCEB44354F04883A7E98D72D1E678DD18AB26

Uniqueness

Uniqueness Score: -1.00%

Function 004241B0 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 004241BC
IsWindowVisible.USER32(?), ref: 004241CD
IsWindowEnabled.USER32(?), ref: 004241D7
SetForegroundWindow.USER32(?), ref: 004241E1

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: fcfbdc667dfc271acfde3df3b5f004a8a61651cac52fe1164ff6abd3c1fed0d2
Instruction ID: 7a261241521d5f36110480f60a41559dbc21bd8b6604a945fb8666e4bf107b55
Opcode Fuzzy Hash: fcfbdc667dfc271acfde3df3b5f004a8a61651cac52fe1164ff6abd3c1fed0d2
Instruction Fuzzy Hash: 0DE08699B06531139E31FA251885ABB25ACCD54B883C60127BC04F7243DF1CCFA0C1AC

Uniqueness

Uniqueness Score: -1.00%

Function 00406284 Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 00406287
GlobalUnWire.KERNEL32(00000000), ref: 0040628E
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 00406293
GlobalFix.KERNEL32(00000000), ref: 00406299

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: ccca6f24380267978f803e90f3f817f3fcf2956047d1379c6398f3f6a54b6072
Instruction ID: ad050c8fb554795a0ca7e59246f03ac17dd57b6c6051e6027a9978793207e39e
Opcode Fuzzy Hash: ccca6f24380267978f803e90f3f817f3fcf2956047d1379c6398f3f6a54b6072
Instruction Fuzzy Hash: A0B009C5814A05B9EC0833B24C0BD3F141CD88072C3808A6FB458BA1839C7C9C402A3D

Uniqueness

Uniqueness Score: -1.00%

Function 00466FA4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,0000F060,00000001), ref: 00467191
EnableMenuItem.USER32(00000000,00000000,00000000), ref: 00467197

Strings

CurPageChanged, xrefs: 0046731F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Menu$EnableItemSystem
String ID: CurPageChanged
API String ID: 3692539535-2490978513
Opcode ID: b1f316c5989fff7e00d37c5493a715d64e5e6d0b5679f88fc60dbd8090725f93
Instruction ID: 85229a9a86c8d76f9b88dc92849b92cb22f01a3e3c9a9662cd7f180e88e3a99e
Opcode Fuzzy Hash: b1f316c5989fff7e00d37c5493a715d64e5e6d0b5679f88fc60dbd8090725f93
Instruction Fuzzy Hash: AFA1F734614204DFC711DB69D985EE973F5EB49308F2640F6F804AB322EB38AE41EB59

Uniqueness

Uniqueness Score: -1.00%

Function 0044FA84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 0044FB19
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0044FB4A

Strings

open, xrefs: 0044FB3D

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: 8a0605ed0c381f0a74a086ec1471ed6555b23fb8dcfb2e81ee34f57c50cf0fe2
Instruction ID: 724f47e86b4f4745380ee9597168f1c8a72dce230288f2328438c3862ccb2892
Opcode Fuzzy Hash: 8a0605ed0c381f0a74a086ec1471ed6555b23fb8dcfb2e81ee34f57c50cf0fe2
Instruction Fuzzy Hash: F8214470E00244AFEB00DF69C992F9EB7F9EF45704F1085BAB500E7391D678BA45CA58

Uniqueness

Uniqueness Score: -1.00%

Function 00468AB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 00468B99
Failed to proceed to next wizard page; aborting., xrefs: 00468B85

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: 922b0376bd45f1a340fb446d45ca7413af626e1e06f02045d5dc725511932721
Instruction ID: be58dce371fc8eb70e9473287a00680558b91856d3b2c3d5b7f8b6b1509d7c4a
Opcode Fuzzy Hash: 922b0376bd45f1a340fb446d45ca7413af626e1e06f02045d5dc725511932721
Instruction Fuzzy Hash: 5C218E706042049FDB00EBA9E985E99B7F8EB05714F2541BFF404AB352DB38AE40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(00496420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(00496420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(00496420,00000000,00401A82,?,?,0040222E,02240650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(00496420,00496420,00000000,00401A82,?,?,0040222E,02240650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,00496420,00000000,00401A82,?,?,0040222E,02240650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(00496420,00401A89,00000000,00401A82,?,?,0040222E,02240650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: 3eb0375ff62f3d3bcca9cc60adac25dafbf9b9e3c2e27b1e4b69ca31af3a3358
Instruction ID: 5893b1754cd22d93ac955961316eccc987691ebf6da7ca014f8aac44d7effe1a
Opcode Fuzzy Hash: 3eb0375ff62f3d3bcca9cc60adac25dafbf9b9e3c2e27b1e4b69ca31af3a3358
Instruction Fuzzy Hash: 851101317042046FEB25ABB99F5A62A6AD4D795758B25087FF404F32D2D9BD8C02826C

Uniqueness

Uniqueness Score: -1.00%

Function 00446E48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 00446EFA

Strings

NIL Interface Exception, xrefs: 00446E9C
Unknown Method, xrefs: 00446ED3

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: 87cbfea59f1259fc6e468aac4867c83fbc8f3f1cc130e6dbee1779124e49575a
Instruction ID: 5f9b3b73cb94db711a986a3f2247f7757ae34ed1a40e252d8aaeb61a96a19159
Opcode Fuzzy Hash: 87cbfea59f1259fc6e468aac4867c83fbc8f3f1cc130e6dbee1779124e49575a
Instruction Fuzzy Hash: 3E1196706042489FEB10DFA5DC52AAEBBBCEB49704F52407AF900E7681D7799D04CA6A

Uniqueness

Uniqueness Score: -1.00%

Function 00490B34 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00490BFC,?,00490BF0,00000000,00490BD7), ref: 00490BA2
CloseHandle.KERNEL32(00490C3C,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00490BFC,?,00490BF0,00000000), ref: 00490BB9

Part of subcall function 00490A8C: GetLastError.KERNEL32(00000000,00490B24,?,?,?,?), ref: 00490AB0

Strings

D, xrefs: 00490B7C

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: 4e0b8aed0e4d5bca662413e8a785220bf27a46a661f749308f3dde2c37165771
Instruction ID: 99184734163d0c92a4db66637d6494c9b23a30ba7254384d63fd9a46e8a5d762
Opcode Fuzzy Hash: 4e0b8aed0e4d5bca662413e8a785220bf27a46a661f749308f3dde2c37165771
Instruction Fuzzy Hash: 790165B1644248AFDF00EBD1CC42F9FBBACDF48718F51007AB504E7291DA78AE048A58

Uniqueness

Uniqueness Score: -1.00%

Function 0042DB9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DBB0
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DBF0

Strings

Inno Setup: No Icons, xrefs: 0042DBAE

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 0890946b5df0c49e4954d7290b96ce305c787ba9704d15fe4295c439bd8e9102
Instruction ID: 08e9f6bdc79701da45a7e076aae250b208fcb3010747ef376bcb555be2d5621c
Opcode Fuzzy Hash: 0890946b5df0c49e4954d7290b96ce305c787ba9704d15fe4295c439bd8e9102
Instruction Fuzzy Hash: F5018431B8933069F73045266D41F6B558C9B85B64F65003BFA41AA3C0D6DCDC45E26A

Uniqueness

Uniqueness Score: -1.00%

Function 00491FC1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00453FD0: GetCurrentProcess.KERNEL32(00000028), ref: 00453FDF
Part of subcall function 00453FD0: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00453FE5

SetForegroundWindow.USER32(?), ref: 00491FF3

Strings

Not restarting Windows because Uninstall is being run from the debugger., xrefs: 0049201E
Restarting Windows., xrefs: 00491FD0

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 92e7afcc8831688dae5fd262e04e4039765fdd7336fda1d0c24d127371dd9238
Instruction ID: 09758fc62953ac5564f253f86018d0961132e27bbb4a61923f7fbbecd85c55b8
Opcode Fuzzy Hash: 92e7afcc8831688dae5fd262e04e4039765fdd7336fda1d0c24d127371dd9238
Instruction Fuzzy Hash: 7701BC747042807AEB01EB65EA02B9C2FA89B4430DF80407BF500AB293C6BD9A49C72D

Uniqueness

Uniqueness Score: -1.00%

Function 004713F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EB8: DeleteFileA.KERNEL32(00000000,00496628,00492DAD,00000000,00492E02,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

MoveFileA.KERNEL32(00000000,00000000), ref: 00471456

Part of subcall function 004712A8: GetLastError.KERNEL32(00000000,00471394,?,?,?,00497138,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0047141B,00000001), ref: 004712C9

Strings

MoveFile, xrefs: 00471431
DeleteFile, xrefs: 0047140F

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: File$DeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3195829115-139070271
Opcode ID: 51569406b8907aa8f27be33c1290f694066cffae2399f79e6ee197169eb5c4fe
Instruction ID: 498d1f86d5cab30c0c02f2f8960253c4d30b0e1e307aae4f7005b10ea634dfd9
Opcode Fuzzy Hash: 51569406b8907aa8f27be33c1290f694066cffae2399f79e6ee197169eb5c4fe
Instruction Fuzzy Hash: 3AF062A010411067DF107B6E85836DA239C8F0235EB54C17BBD88BF3A3CA3D9C0287AE

Uniqueness

Uniqueness Score: -1.00%

Function 00455C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00455C42
FileTimeToLocalFileTime.KERNEL32(?,.2I,?), ref: 00455C4F

Strings

.2I, xrefs: 00455C47, 00455C5B, 00455C63, 00455C4A

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: .2I
API String ID: 1748579591-803348413
Opcode ID: aba8b51db9d65da12f539ddc2c0835b2624d8a3471dbf7fd6520d9ecd032998b
Instruction ID: 4f8a786cf5642c40ef90ebfca535d25145d1c27a2836ec24ad6e1980779010cb
Opcode Fuzzy Hash: aba8b51db9d65da12f539ddc2c0835b2624d8a3471dbf7fd6520d9ecd032998b
Instruction Fuzzy Hash: B7E0ED71D0060DABCF00EBE5DC418EEB7BCFA08314F40067BA814E3295E734A6098B94

Uniqueness

Uniqueness Score: -1.00%

Function 00454060 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 0045407F
Sleep.KERNEL32(?), ref: 0045408F
GetLastError.KERNEL32 ref: 004540A2
GetLastError.KERNEL32 ref: 004540AC

Memory Dump Source

Source File: 00000001.00000002.2125075308.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2125048880.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125156902.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125198155.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2125229157.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_EzvizStudioSetups.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 90638990078551a93e354ff3f13e8fbad671cfff88aec0058828b361cc5d74ec
Instruction ID: 017d81aa95838fcb6bb112513f86caaf4ff52444f8b7b5a451e770b39712fdff
Opcode Fuzzy Hash: 90638990078551a93e354ff3f13e8fbad671cfff88aec0058828b361cc5d74ec
Instruction Fuzzy Hash: B8F0F632A00524578E20A9AE998192F62CDDAC0B6D730052BEF04DF283D439CC854AAE

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NpfDetectApp.exePID: 7844, Parent PID: 7428COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	56

Executed Functions

Function 6F8523F0 Relevance: 37.0, APIs: 12, Strings: 9, Instructions: 259
nativelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F8590E4: _malloc.LIBCMT ref: 6F8590FC

GetModuleHandleA.KERNEL32(ntdll.dll,00000000), ref: 6F852492
GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 6F85249E
NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,00000000), ref: 6F8524B9
_malloc.LIBCMT ref: 6F8524CA
NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,00000000), ref: 6F852505
_wprintf.LIBCMT ref: 6F8525A7

Strings

iVMS-4200.exe, xrefs: 6F85253F
NtQuerySystemInformation, xrefs: 6F852498
ServiceManager.exe, xrefs: 6F852523
wpcap.dll, xrefs: 6F8526A4
SADPTool.exe, xrefs: 6F852531
NpfApp, xrefs: 6F852466
ntdll.dll, xrefs: 6F85248D
please close process %s , xrefs: 6F8525A2, 6F8525F1, 6F852646, 6F852695
wireshark.exe, xrefs: 6F852519

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: InformationQuerySystem_malloc$AddressHandleModuleProc_wprintf
String ID: NpfApp$NtQuerySystemInformation$SADPTool.exe$ServiceManager.exe$iVMS-4200.exe$ntdll.dll$please close process %s $wireshark.exe$wpcap.dll
API String ID: 1443024271-1032959715
Opcode ID: e8e85f9bb68dd8b30d1d00208135a5ea7d58761f03fa165c0cce20587efe285f
Instruction ID: b9c092e6e15a56104583cbaf6a07545ed817e28b3ee947c014dccec1a7553fe9
Opcode Fuzzy Hash: e8e85f9bb68dd8b30d1d00208135a5ea7d58761f03fa165c0cce20587efe285f
Instruction Fuzzy Hash: B891BF70508301ABEBA0DF78CC41B6A77E8AF55358F500DADE5A48E2C0EB75E524C793

Uniqueness

Uniqueness Score: -1.00%

Function 009B1000 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 146
servicelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 009B101E
GetModuleFileNameA.KERNEL32(00000000,?,00000100,?,?,?,00000000,000000FF), ref: 009B1072
_strrchr.LIBCMT ref: 009B1082
_strncpy.LIBCMT ref: 009B10A0
GetModuleHandleA.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,00000000,000000FF), ref: 009B10E1
GetProcAddress.KERNEL32(00000000), ref: 009B10E8
GetNativeSystemInfo.KERNELBASE(009BBB60,?,?,?,?,?,?,?,?,00000000,000000FF), ref: 009B10FC
CreateServiceA.ADVAPI32(00000000,NPF,Sadp Driver (NPF),000F01FF,00000001,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000), ref: 009B119E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000FF), ref: 009B11A8
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000000,000000FF), ref: 009B11AF
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00000000,000000FF), ref: 009B11D5
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00000000,000000FF), ref: 009B11D8

Strings

npf.sys, xrefs: 009B111C, 009B1168
Sadp Driver (NPF), xrefs: 009B1193
GetNativeSystemInfo, xrefs: 009B10AA
npf64.sys, xrefs: 009B113C
kernel32.dll, xrefs: 009B10AF
NPF, xrefs: 009B1198

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: HandleService$Close$Module$AddressCreateErrorFileInfoLastManagerNameNativeOpenProcSystem_strncpy_strrchr
String ID: GetNativeSystemInfo$NPF$Sadp Driver (NPF)$kernel32.dll$npf.sys$npf64.sys
API String ID: 2717685956-1380749418
Opcode ID: ca859922a0af6525e4602843126e0c0bc034208ea784d8f246989c1a78ce52fd
Instruction ID: 5fc843144d4e0a5f42a6b97dd46f6fb58f9be61ff3361ef81bf67ece01159726
Opcode Fuzzy Hash: ca859922a0af6525e4602843126e0c0bc034208ea784d8f246989c1a78ce52fd
Instruction Fuzzy Hash: 2951C57062C305AFD714EF68DEA9BE777E9EB88720F404619E649C72A1EBB0C404DB51

Uniqueness

Uniqueness Score: -1.00%

Function 009B1200 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 126
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 009B120D
OpenServiceA.ADVAPI32(00000000,NPF,000F01FF), ref: 009B122E
CloseServiceHandle.ADVAPI32(00000000), ref: 009B123B

Strings

NPF, xrefs: 009B1228

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: OpenService$CloseHandleManager
String ID: NPF
API String ID: 4136619037-2688663593
Opcode ID: b46e303383b1f5cd76418aff22a608d157698c1c91bbc082f0aa69c267a4abfa
Instruction ID: 8c5c463457bcfad06c9f19ac97f3c017506bef0ba56c2f9490c0ff0beea8efaf
Opcode Fuzzy Hash: b46e303383b1f5cd76418aff22a608d157698c1c91bbc082f0aa69c267a4abfa
Instruction Fuzzy Hash: C93129316043019BD720BBA59E846BF77ECEBC87B1F44092AF914D2100DA38D849E7A2

Uniqueness

Uniqueness Score: -1.00%

Function 009B15A0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 102
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009B1500: RegCreateKeyExA.KERNELBASE ref: 009B152C
Part of subcall function 009B1500: MessageBoxA.USER32(00000000,Could not create the registry key,00000000,00000000), ref: 009B1541

Part of subcall function 009B1350: GetTickCount.KERNEL32 ref: 009B1354
Part of subcall function 009B1350: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 009B1367
Part of subcall function 009B1350: OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 009B1383
Part of subcall function 009B1350: CloseServiceHandle.ADVAPI32(00000000), ref: 009B1390

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 009B15C0
OpenServiceA.ADVAPI32(00000000,SADP_NPF,00010000), ref: 009B15DD
DeleteService.ADVAPI32(00000000), ref: 009B15EA
CloseServiceHandle.ADVAPI32(00000000), ref: 009B15F1
CloseServiceHandle.ADVAPI32(00000000), ref: 009B15F4
NpfSetSuccess.NPFDETECT ref: 009B1609
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 009B162E
OpenServiceA.ADVAPI32(00000000,NPF,00010000), ref: 009B1645
DeleteService.ADVAPI32(00000000), ref: 009B1652
CloseServiceHandle.ADVAPI32(00000000), ref: 009B1659
CloseServiceHandle.ADVAPI32(00000000), ref: 009B165C
NpfSetSuccess.NPFDETECT ref: 009B168E
NpfDetectEntry.NPFDETECT(0000000A,00000000), ref: 009B16A1

Part of subcall function 009B1500: RegSetValueExA.KERNELBASE(00000000,NpfInstallResult,00000000,00000004,0002001F,00000004), ref: 009B1561
Part of subcall function 009B1500: MessageBoxA.USER32(00000000,RegSetValueEx FAILED,00000000,00000000), ref: 009B1576
Part of subcall function 009B1500: RegCloseKey.ADVAPI32 ref: 009B1580

Strings

NPF, xrefs: 009B1618, 009B163F
SADP_NPF, xrefs: 009B15AA, 009B15D7

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: Service$CloseOpen$Handle$Manager$DeleteMessageSuccess$CountCreateDetectEntryTickValue
String ID: NPF$SADP_NPF
API String ID: 4165630549-3487682683
Opcode ID: 9d61b1aa752bed8a70c7a668129fe4da41f11c98f1abd20624f5455ac17f9147
Instruction ID: 3096d68f8ef1765723a5ef692547c204f613d31365ebd6760918916321f539e8
Opcode Fuzzy Hash: 9d61b1aa752bed8a70c7a668129fe4da41f11c98f1abd20624f5455ac17f9147
Instruction Fuzzy Hash: 4621E53665520567D32137B02F2ABFF265C9BCABF6F480121FA0690182EE91C4059076

Uniqueness

Uniqueness Score: -1.00%

Function 6F852558 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F851ED0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,00000000), ref: 6F851F1C
Part of subcall function 6F851ED0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,00000000), ref: 6F851F31

_wprintf.LIBCMT ref: 6F8525A7
_wprintf.LIBCMT ref: 6F8525F6
_wprintf.LIBCMT ref: 6F85264B
_wprintf.LIBCMT ref: 6F85269A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6F852728
_malloc.LIBCMT ref: 6F85274C

Part of subcall function 6F858A54: __FF_MSGBANNER.LIBCMT ref: 6F858A6B
Part of subcall function 6F858A54: __NMSG_WRITE.LIBCMT ref: 6F858A72
Part of subcall function 6F858A54: RtlAllocateHeap.NTDLL(011A0000,00000000,00000001,?,?,?,?,6F859101,?), ref: 6F858A97

NtQuerySystemInformation.NTDLL(00000010,00000000,?,?), ref: 6F852776

Part of subcall function 6F851AD0: GetModuleHandleA.KERNEL32(ntdll.dll,?,00000000,00000000,?,?,?,?,?,?,?,?,6F852783), ref: 6F851AED
Part of subcall function 6F851AD0: GetProcAddress.KERNEL32(00000000,NtQueryObject), ref: 6F851AFC
Part of subcall function 6F851AD0: GetCurrentProcess.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,6F852783), ref: 6F851B0A
Part of subcall function 6F851AD0: DuplicateHandle.KERNELBASE(00000000,?,?,?,00000002,00000000,00000002,?,00000000,00000000), ref: 6F851B75
Part of subcall function 6F851AD0: __beginthreadex.LIBCMT ref: 6F851BA9
Part of subcall function 6F851AD0: WaitForSingleObject.KERNEL32(000003E8,?,?,?,?,00000000,00000000), ref: 6F851BBC
Part of subcall function 6F851AD0: GetProcAddress.KERNEL32(?,NtQueryObject), ref: 6F851BCE

Strings

wpcap.dll, xrefs: 6F8526A4
please close process %s , xrefs: 6F8525A2, 6F8525F1, 6F852646, 6F852695

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _wprintf$AddressByteCharHandleMultiProcWide$AllocateCreateCurrentDuplicateEventHeapInformationModuleObjectProcessQuerySingleSystemWait__beginthreadex_malloc
String ID: please close process %s $wpcap.dll
API String ID: 1218870135-942768427
Opcode ID: 62b8e41a7fce5463d8ee5be972e694ca2e89d5be65096bd0dca1552b73d6c9d5
Instruction ID: b4dfd8f24cb056607a4ea9b9c127f33ac87d8509c65de5a4178db0bff7602654
Opcode Fuzzy Hash: 62b8e41a7fce5463d8ee5be972e694ca2e89d5be65096bd0dca1552b73d6c9d5
Instruction Fuzzy Hash: 16518E70108341AFD7A4EF68C841B6B77E9AF85348F600D9DE5A48E2C1EB75E524CB93

Uniqueness

Uniqueness Score: -1.00%

Function 009B1350 Relevance: 24.1, APIs: 16, Instructions: 105
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 009B1354
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 009B1367
OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 009B1383
CloseServiceHandle.ADVAPI32(00000000), ref: 009B1390
QueryServiceStatus.ADVAPI32(00000000,?), ref: 009B13A9
CloseServiceHandle.ADVAPI32(00000000), ref: 009B13BF
CloseServiceHandle.ADVAPI32(00000000), ref: 009B13C2

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: Service$CloseHandle$Open$CountManagerQueryStatusTick
String ID:
API String ID: 2352368958-0
Opcode ID: 4a31a031b826d9a9bde8c47becd543f71236ed85039e0fd5950ff1ee5eb94db1
Instruction ID: 5a723761543470f60441160c07bdbc9c1eb4e647688c0836291761849820f0ff
Opcode Fuzzy Hash: 4a31a031b826d9a9bde8c47becd543f71236ed85039e0fd5950ff1ee5eb94db1
Instruction Fuzzy Hash: 6231D3311043129BC724EF68DE989FFB7ADEF897B1F840919F10092160EB20D94DDBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6F851FD0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 6F852046
K32EnumProcessModules.KERNEL32(00000000,?,00000FA0,?), ref: 6F852070
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,000003E8), ref: 6F852097
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,000003E8), ref: 6F8520C4
FindCloseChangeNotification.KERNELBASE(00000000), ref: 6F852228
_wprintf.LIBCMT ref: 6F85226F
_wprintf.LIBCMT ref: 6F85230E
CloseHandle.KERNEL32(00000000), ref: 6F852317

Strings

packet.dll, xrefs: 6F85219F
the process %s maybe influence the installation., xrefs: 6F85226A, 6F852309
PACKET.dll, xrefs: 6F852143
wpcap.dll, xrefs: 6F8520C8

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: BaseCloseModuleNameProcess_wprintf$ChangeEnumFindHandleModulesNotificationOpen
String ID: PACKET.dll$packet.dll$the process %s maybe influence the installation.$wpcap.dll
API String ID: 3813893090-3337625397
Opcode ID: 17a8afe3fdf95b2f1d7df1df4e198a417a019c3a8317d7e54178179b6c84d8aa
Instruction ID: 0bc6e9b37e913842f96ec0f1cf38ebc988bccf5852486a4e45c9251900449bf1
Opcode Fuzzy Hash: 17a8afe3fdf95b2f1d7df1df4e198a417a019c3a8317d7e54178179b6c84d8aa
Instruction Fuzzy Hash: C7913335D482599BDF558F24CC80BEABB79EF02304F4409D9D40DAF180DF3AAA98CB51

Uniqueness

Uniqueness Score: -1.00%

Function 009B1500 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 52
registrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE ref: 009B152C
MessageBoxA.USER32(00000000,Could not create the registry key,00000000,00000000), ref: 009B1541
RegSetValueExA.KERNELBASE(00000000,NpfInstallResult,00000000,00000004,0002001F,00000004), ref: 009B1561
MessageBoxA.USER32(00000000,RegSetValueEx FAILED,00000000,00000000), ref: 009B1576
RegCloseKey.ADVAPI32 ref: 009B1580

Strings

Could not create the registry key, xrefs: 009B153A
NpfInstallResult, xrefs: 009B155B
RegSetValueEx FAILED, xrefs: 009B156F
Software\sadp, xrefs: 009B151A

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: Message$CloseCreateValue
String ID: Could not create the registry key$NpfInstallResult$RegSetValueEx FAILED$Software\sadp
API String ID: 388455370-1470756963
Opcode ID: 3b932641ed886a392330c3094bb517fcf990b02f6d18f9c258bfd893cad3c504
Instruction ID: e6c0c42ebd997e3d0203be7e7a1cc74e54db90b316b02c2c909b1b303fb87bc3
Opcode Fuzzy Hash: 3b932641ed886a392330c3094bb517fcf990b02f6d18f9c258bfd893cad3c504
Instruction Fuzzy Hash: 630184743A830077E720ABA09E4BF9B36E8AB8CF35F940518F345E91C0DAF4E408DA55

Uniqueness

Uniqueness Score: -1.00%

Function 6F851AD0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 103
libraryloadersynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,?,00000000,00000000,?,?,?,?,?,?,?,?,6F852783), ref: 6F851AED
GetProcAddress.KERNEL32(00000000,NtQueryObject), ref: 6F851AFC
GetCurrentProcess.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,6F852783), ref: 6F851B0A
DuplicateHandle.KERNELBASE(00000000,?,?,?,00000002,00000000,00000002,?,00000000,00000000), ref: 6F851B75
__beginthreadex.LIBCMT ref: 6F851BA9
WaitForSingleObject.KERNEL32(000003E8,?,?,?,?,00000000,00000000), ref: 6F851BBC
GetProcAddress.KERNEL32(?,NtQueryObject), ref: 6F851BCE

Strings

ntdll.dll, xrefs: 6F851AE5
NtQueryObject, xrefs: 6F851AF3, 6F851BC6

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: AddressHandleProc$CurrentDuplicateModuleObjectProcessSingleWait__beginthreadex
String ID: NtQueryObject$ntdll.dll
API String ID: 4215168012-1206107818
Opcode ID: 527fc04baf81b7a93623efe3c03d4b6c52ab08545ddbc3ebfd021a814543784c
Instruction ID: 0caedd07cfd1bf7fbf006405d6625afb8aeab2c38f4c054e8193486ee0415198
Opcode Fuzzy Hash: 527fc04baf81b7a93623efe3c03d4b6c52ab08545ddbc3ebfd021a814543784c
Instruction Fuzzy Hash: 5331B270A00609EBDF54DFA5CC85BBEB7B9FF04310F1058E9E545AB280E774A860CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F8520A9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleBaseNameA.KERNEL32(00000000,?,?,000003E8), ref: 6F8520C4
FindCloseChangeNotification.KERNELBASE(00000000), ref: 6F852228
_wprintf.LIBCMT ref: 6F85226F
_wprintf.LIBCMT ref: 6F85230E
CloseHandle.KERNEL32(00000000), ref: 6F852317

Strings

packet.dll, xrefs: 6F85219F
PACKET.dll, xrefs: 6F852143
wpcap.dll, xrefs: 6F8520C8

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: Close_wprintf$BaseChangeFindHandleModuleNameNotification
String ID: PACKET.dll$packet.dll$wpcap.dll
API String ID: 1488707689-601586977
Opcode ID: f0ac6bb565e8b70eb6200a29299860d2c3e938926667551d87697b7f8e57df71
Instruction ID: ee2297695e628d4c3e51e29953bd6eefb1a5b62fe72007f7f9117e015f195448
Opcode Fuzzy Hash: f0ac6bb565e8b70eb6200a29299860d2c3e938926667551d87697b7f8e57df71
Instruction Fuzzy Hash: 9E41C1359482998BDF558F20C8917EAB772EF26304F8409C5C94D9F181DF3ABA98CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6F858DB7 Relevance: 4.5, APIs: 3, Instructions: 15
threadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd_noexit.LIBCMT ref: 6F858DBB

Part of subcall function 6F85D95E: GetLastError.KERNEL32(?,6F859101,6F85C55F,6F858ADB,?,?,6F859101,?), ref: 6F85D960
Part of subcall function 6F85D95E: __calloc_crt.LIBCMT ref: 6F85D981
Part of subcall function 6F85D95E: __initptd.LIBCMT ref: 6F85D9A3
Part of subcall function 6F85D95E: GetCurrentThreadId.KERNEL32 ref: 6F85D9AA
Part of subcall function 6F85D95E: SetLastError.KERNEL32(00000000,6F859101,6F85C55F,6F858ADB,?,?,6F859101,?), ref: 6F85D9C2

__freeptd.LIBCMT ref: 6F858DD5

Part of subcall function 6F858EBA: LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,6F858DD4), ref: 6F858ED4
Part of subcall function 6F858EBA: GetProcAddress.KERNEL32(00000000), ref: 6F858EDB
Part of subcall function 6F858EBA: EncodePointer.KERNEL32(00000000), ref: 6F858EE6
Part of subcall function 6F858EBA: DecodePointer.KERNEL32(6F858DD4), ref: 6F858F01

ExitThread.KERNEL32 ref: 6F858DDE

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: ErrorLastPointerThread$AddressCurrentDecodeEncodeExitLibraryLoadProc__calloc_crt__freeptd__getptd_noexit__initptd
String ID:
API String ID: 21986956-0
Opcode ID: 0a27e795d32d02b1fd23d080493ba2e9f4a1d201ac934c89eab547573c37da72
Instruction ID: d5c0120edcdf784a044c2628aa06b1a9af11278e34636b4b14ea406c3b6e082b
Opcode Fuzzy Hash: 0a27e795d32d02b1fd23d080493ba2e9f4a1d201ac934c89eab547573c37da72
Instruction Fuzzy Hash: 21D0A73241BB21BBCFA31724C40879F36D95F01359F0008D6DC141E1909B32A9B4C6D6

Uniqueness

Uniqueness Score: -1.00%

Function 6F859880 Relevance: 3.0, APIs: 2, Instructions: 33
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F85C55A: __getptd_noexit.LIBCMT ref: 6F85C55A

__lock_file.LIBCMT ref: 6F8598C5

Part of subcall function 6F85DBB3: __lock.LIBCMT ref: 6F85DBD6

__fclose_nolock.LIBCMT ref: 6F8598D0

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 3fa907a960706d821938391089c69c6732d358172a5ba9097713d05777488599
Instruction ID: 5ac3a587da1ce37e48423ebe5a6b924c4dd953d900d7b6f70d2b790cd2986e96
Opcode Fuzzy Hash: 3fa907a960706d821938391089c69c6732d358172a5ba9097713d05777488599
Instruction Fuzzy Hash: D0F0B4B2A05708ABE7909FBD880079D77E26F41339F158AC9CC249F2C4CB7C95629F55

Uniqueness

Uniqueness Score: -1.00%

Function 6F85C760 Relevance: 3.0, APIs: 2, Instructions: 30
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,?,?,?,?,00000000,00000000,00000000,00000000,?,6F85BD6B,?,?,00000000,?,00000000), ref: 6F85C787
LCMapStringW.KERNEL32(00000000,?,?,?,?,00000000,?,6F85BD6B,?,?,00000000,?,00000000,00000000), ref: 6F85C7A4

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: bf147bbb884b5c5e02a813a428516da6d8722f18a9dd7364500b792c938c1dd1
Instruction ID: 67e1ad29aa6a233845134ad436fa7f13b8aaeaf01a629feddd1f226374ed3255
Opcode Fuzzy Hash: bf147bbb884b5c5e02a813a428516da6d8722f18a9dd7364500b792c938c1dd1
Instruction Fuzzy Hash: 3DF01F7201010AFFDF069FA4DC0ACAA3B6AFB09254B008559FA1849521D776A971ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 009B1BAF Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 009B1BB7

Part of subcall function 009B1B84: GetModuleHandleW.KERNEL32(mscoree.dll,?,009B1BBC,?,?,009B6334,000000FF,0000001E,?,009B46F2,?,00000001,?,?,009B32BA,00000018), ref: 009B1B8E
Part of subcall function 009B1B84: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009B1B9E

ExitProcess.KERNEL32 ref: 009B1BC0

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: c3cf5eea157f669325c60de7f675201bb1f9ef3628bb3ec0a68402fbabb49280
Instruction ID: ec8c0a7cc57ceb4e4960474ab3e27694413b04006d91b70d6ee784452b1a342e
Opcode Fuzzy Hash: c3cf5eea157f669325c60de7f675201bb1f9ef3628bb3ec0a68402fbabb49280
Instruction Fuzzy Hash: 1EB09231004108BBCB053F12DD0ADCA3F2AEB807B1B588121F8084A071EF72AD92EA90

Uniqueness

Uniqueness Score: -1.00%

Function 6F854560 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 6F85458C

Part of subcall function 6F859135: __flsbuf.LIBCMT ref: 6F859208

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: __flsbuf__wfopen_s
String ID:
API String ID: 151305219-0
Opcode ID: 299191789d36a28cdc9f13e8b2c0b97a11e1397f809d50c7ea98753013c74e76
Instruction ID: 344698febd55062875fe33c6209b03964616e95f6fe9bee8c6411e594f21b99d
Opcode Fuzzy Hash: 299191789d36a28cdc9f13e8b2c0b97a11e1397f809d50c7ea98753013c74e76
Instruction Fuzzy Hash: E4110AB2A4132477CB40DEA99C09FDFBBA8DF55614F0405D6E8085F280DB359A34C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 009B2EAE Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 009B2EC3

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 81b4c463206b0c8736386804bdedc65527525bc08969bab6742fb29c9a93681a
Instruction ID: 9cadd2ebe4f4fcf102ce2b4cdaa07a324b3599422413542b9e2b1bc7f8c9dbe6
Opcode Fuzzy Hash: 81b4c463206b0c8736386804bdedc65527525bc08969bab6742fb29c9a93681a
Instruction Fuzzy Hash: FBD05E729683485EDB005F726E087633BDCD3843E5F048435B90CC6590EAB0C940EB00

Uniqueness

Uniqueness Score: -1.00%

Function 6F858D76 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6F85D946: __getptd_noexit.LIBCMT ref: 6F85D947
Part of subcall function 6F85D946: __amsg_exit.LIBCMT ref: 6F85D954

Part of subcall function 6F858DB7: __getptd_noexit.LIBCMT ref: 6F858DBB
Part of subcall function 6F858DB7: __freeptd.LIBCMT ref: 6F858DD5
Part of subcall function 6F858DB7: ExitThread.KERNEL32 ref: 6F858DDE

__XcptFilter.LIBCMT ref: 6F858DA3

Part of subcall function 6F85D65C: __getptd_noexit.LIBCMT ref: 6F85D660

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd
String ID:
API String ID: 1400385479-0
Opcode ID: cc769f4d3fa9ebd9bbb0f70b905577821c375798c21cbba3944da09c862bf4dd
Instruction ID: 8850b7785af368daa2b2a0025f63bc72217d5ea404bb7caee213ced94baf4a94
Opcode Fuzzy Hash: cc769f4d3fa9ebd9bbb0f70b905577821c375798c21cbba3944da09c862bf4dd
Instruction Fuzzy Hash: 05E08CB2904700BFEB44ABA4C848E6E37A5AF04309F2008C9E401AF2B1CB34A850DB21

Uniqueness

Uniqueness Score: -1.00%

Function 009B1DCB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 009B1DD7

Part of subcall function 009B1C9F: __lock.LIBCMT ref: 009B1CAD
Part of subcall function 009B1C9F: __decode_pointer.LIBCMT ref: 009B1CE4
Part of subcall function 009B1C9F: __decode_pointer.LIBCMT ref: 009B1CF9
Part of subcall function 009B1C9F: __decode_pointer.LIBCMT ref: 009B1D23
Part of subcall function 009B1C9F: __decode_pointer.LIBCMT ref: 009B1D39
Part of subcall function 009B1C9F: __decode_pointer.LIBCMT ref: 009B1D46
Part of subcall function 009B1C9F: __initterm.LIBCMT ref: 009B1D75
Part of subcall function 009B1C9F: __initterm.LIBCMT ref: 009B1D85

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 4d71aff0867389932a0e9693dc54d63384f880c61e32b4f1878b3348982ac901
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: 45B0923258020C33DA212682AC17F563F0A87C1BA0E680020BA0C1D1A1A9A2A9618089

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6F851C10 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 201libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 6F851CCD
GetProcAddress.KERNEL32(00000000,NtQueryObject), ref: 6F851CD9
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6F851D23
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 6F851D3D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?), ref: 6F851DDA
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000,?,?), ref: 6F851DEF
_wprintf.LIBCMT ref: 6F851DFB

Strings

NPF_, xrefs: 6F851C59
ntdll.dll, xrefs: 6F851CC8
please close process %s , xrefs: 6F851DF6
NtQueryObject, xrefs: 6F851CD3

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: ByteCharMultiWide$AddressHandleModuleProc_wprintf
String ID: NPF_$NtQueryObject$ntdll.dll$please close process %s
API String ID: 582902756-1510169709
Opcode ID: f7255f6de0278580a0a9fcb8b6695d0a7e8a9addc5c8e16e255312d1901fa65a
Instruction ID: c6a4ff9c036eb7850bbf9aab40fe72fb91956b48cda1d2c1772dd595ecebf7e6
Opcode Fuzzy Hash: f7255f6de0278580a0a9fcb8b6695d0a7e8a9addc5c8e16e255312d1901fa65a
Instruction Fuzzy Hash: AA71BE71108740AFEB60CF64CC45B6BBBE8AB85718F100E9DF2949A2C1D7B1E518CB66

Uniqueness

Uniqueness Score: -1.00%

Function 009B16BA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 009B1A90
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009B1AA5
UnhandledExceptionFilter.KERNEL32(009B817C), ref: 009B1AB0
GetCurrentProcess.KERNEL32(C0000409), ref: 009B1ACC
TerminateProcess.KERNEL32(00000000), ref: 009B1AD3

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6c31e68c193e6130683397fd5778ff7f1c8124ee44d088e2e5adfc5a8a1ccfb6
Instruction ID: 7bea1bca729e641aada6224aa24d2c99a453631c0a7a3ca998f1f4cbe9a53fe3
Opcode Fuzzy Hash: 6c31e68c193e6130683397fd5778ff7f1c8124ee44d088e2e5adfc5a8a1ccfb6
Instruction Fuzzy Hash: CC21A3B442D308DFD710EF69FBA96963BA8BB09330F50421AE509972B0EBF45585EF05

Uniqueness

Uniqueness Score: -1.00%

Function 6F85C510 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,6F85D5C2,?,?,?,00000001), ref: 6F85C515
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 6F85C51E

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6e97136c0df7a32982093195958884a0e53094c732ef7bf89c7e893e5f516a33
Instruction ID: c63a6c2f5416b275b79661c5a5ff744f66673bfdaf35ad8e1ed4971c45fbd6f5
Opcode Fuzzy Hash: 6e97136c0df7a32982093195958884a0e53094c732ef7bf89c7e893e5f516a33
Instruction Fuzzy Hash: ABB09231048A19EBDF002FA1E809B687F68EB0A662F005090F60D880518B72A420CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 6F854050 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 140COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6F854076
_fprintf.LIBCMT ref: 6F854096
_fprintf.LIBCMT ref: 6F8540B6
_fprintf.LIBCMT ref: 6F8540EA
_fprintf.LIBCMT ref: 6F85410F
_fprintf.LIBCMT ref: 6F85412F

Part of subcall function 6F859654: __lock_file.LIBCMT ref: 6F85969B
Part of subcall function 6F859654: __stbuf.LIBCMT ref: 6F859720
Part of subcall function 6F859654: __output_l.LIBCMT ref: 6F859730
Part of subcall function 6F859654: __ftbuf.LIBCMT ref: 6F85973C

_fprintf.LIBCMT ref: 6F854154
_fprintf.LIBCMT ref: 6F854175
_fprintf.LIBCMT ref: 6F854187
_fprintf.LIBCMT ref: 6F8541A7

Strings

</%s>, xrefs: 6F8541A1
, xrefs: 6F854070, 6F854181
<%s, xrefs: 6F854090
/>, xrefs: 6F8540E4

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _fprintf$__ftbuf__lock_file__output_l__stbuf
String ID: $ />$<%s$</%s>
API String ID: 868309879-3857100915
Opcode ID: 0da13aa7f9aced9e5ce1166ae311f45ec83ab57e50d3f4e3ffd72c2af0c63f5b
Instruction ID: 5f2c2dbf9bfc74f1f8805069742c978fb30ec93a6c17729ac873f6c26f2f7273
Opcode Fuzzy Hash: 0da13aa7f9aced9e5ce1166ae311f45ec83ab57e50d3f4e3ffd72c2af0c63f5b
Instruction Fuzzy Hash: 8841D571600605BBCB84CF18C894E9A73A9BFE5205B5409E5E9089F304E731FA3DCBE5

Uniqueness

Uniqueness Score: -1.00%

Function 6F854C60 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 124COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6F854C75
_fprintf.LIBCMT ref: 6F854CAE
_fprintf.LIBCMT ref: 6F854D01
_fprintf.LIBCMT ref: 6F854D5A
_fprintf.LIBCMT ref: 6F854D9B

Strings

encoding="%s" , xrefs: 6F854CFB
version=", xrefs: 6F854CBC
<?xml , xrefs: 6F854C6F, 6F854C86
version="%s" , xrefs: 6F854CA8
encoding=", xrefs: 6F854D0F
standalone="%s" , xrefs: 6F854D54
standalone=", xrefs: 6F854D68

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _fprintf
String ID: <?xml $encoding="$encoding="%s" $standalone="$standalone="%s" $version="$version="%s"
API String ID: 1654120334-1713033844
Opcode ID: 2722ea66622327876c2ba76a3048830586d7612e895e5a9e74e2e83ae928b496
Instruction ID: 0be5641c960acd05143dd00230eab75c0576cdaeb4e8b99b77dc80468818aa46
Opcode Fuzzy Hash: 2722ea66622327876c2ba76a3048830586d7612e895e5a9e74e2e83ae928b496
Instruction Fuzzy Hash: B631B07070071077DB999A188C59FAE3259ABD0B15F400EDAED24AF3C9EF24E934C791

Uniqueness

Uniqueness Score: -1.00%

Function 009B2A78 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,009B94A8,0000000C,009B2BB3,00000000,00000000,?,009B1E99,00000003,?,?,?,?,?,?,009B183F), ref: 009B2A8A
__crt_waiting_on_module_handle.LIBCMT ref: 009B2A95

Part of subcall function 009B1B2B: Sleep.KERNEL32(000003E8,00000000,?,009B29DB,KERNEL32.DLL,?,009B2A27,?,009B1E99,00000003), ref: 009B1B37
Part of subcall function 009B1B2B: GetModuleHandleW.KERNEL32(?,?,009B29DB,KERNEL32.DLL,?,009B2A27,?,009B1E99,00000003,?,?,?,?,?,?,009B183F), ref: 009B1B40

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 009B2ABE
GetProcAddress.KERNEL32(?,DecodePointer), ref: 009B2ACE
__lock.LIBCMT ref: 009B2AF0
InterlockedIncrement.KERNEL32(009BA3E0), ref: 009B2AFD
__lock.LIBCMT ref: 009B2B11
___addlocaleref.LIBCMT ref: 009B2B2F

Strings

DecodePointer, xrefs: 009B2AC6
KERNEL32.DLL, xrefs: 009B2A84, 009B2A89, 009B2A94
EncodePointer, xrefs: 009B2AB2

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 9312c35eeb01b2e5ac7051590530f1ac17490d39e8872f10c540a519144bce72
Instruction ID: fec6a10072c9a17e603a3fc312387f61b522c8900417148e4f8cce36ec6f1bd1
Opcode Fuzzy Hash: 9312c35eeb01b2e5ac7051590530f1ac17490d39e8872f10c540a519144bce72
Instruction Fuzzy Hash: 64119D70804701AAD720EF65DA85BDABBE8EF88734F20851DE0A9972A1CF709941DB64

Uniqueness

Uniqueness Score: -1.00%

Function 6F85CCBA Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,00000001,6F859F12,6F8714A0,00000008,6F85A049,?,00000001,?,6F8714C0,0000000C,6F859FE8,?,00000001,?), ref: 6F85CCC2
_free.LIBCMT ref: 6F85CCDB

Part of subcall function 6F859B7C: HeapFree.KERNEL32(00000000,00000000,?,6F85D9BE,00000000,6F85C55F,6F858ADB), ref: 6F859B90
Part of subcall function 6F859B7C: GetLastError.KERNEL32(00000000,?,6F85D9BE,00000000,6F85C55F,6F858ADB), ref: 6F859BA2

_free.LIBCMT ref: 6F85CCEE
_free.LIBCMT ref: 6F85CD0C
_free.LIBCMT ref: 6F85CD1E
_free.LIBCMT ref: 6F85CD2F
_free.LIBCMT ref: 6F85CD3A
_free.LIBCMT ref: 6F85CD5E
EncodePointer.KERNEL32(00000000), ref: 6F85CD65
_free.LIBCMT ref: 6F85CD7A
_free.LIBCMT ref: 6F85CD90
_free.LIBCMT ref: 6F85CDB8

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: bc1abfc193c56768016b6f24b8913e525032a80cae0f65c32b1c9407ef1fe806
Instruction ID: 6e535a4b04c194deaf50b8def409424a6f3e3afee6590a7845fe4bece3f64b9c
Opcode Fuzzy Hash: bc1abfc193c56768016b6f24b8913e525032a80cae0f65c32b1c9407ef1fe806
Instruction Fuzzy Hash: 3321B172901B71DBEF959F28D84865E7BA0BB4B23431109EED4159F294CB34A874CFC1

Uniqueness

Uniqueness Score: -1.00%

Function 009B1470 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 009B147D
OpenServiceA.ADVAPI32(00000000,NPF,000F01FF), ref: 009B149A
CloseServiceHandle.ADVAPI32(00000000), ref: 009B14A7

Strings

NPF, xrefs: 009B1494

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: OpenService$CloseHandleManager
String ID: NPF
API String ID: 4136619037-2688663593
Opcode ID: 4365760b9c7dc4ecd22f3caa4028a5f4bf8f5c5216196da8a827ae78f765b9bc
Instruction ID: 57e1f41acea82034f4810773ab466ea16348fa0299414c764a658a4ece87f762
Opcode Fuzzy Hash: 4365760b9c7dc4ecd22f3caa4028a5f4bf8f5c5216196da8a827ae78f765b9bc
Instruction Fuzzy Hash: 08012B35714A106BC321BB2EAE14BEB369CAFD6771FC14125F904D2171EA64C50AD4F2

Uniqueness

Uniqueness Score: -1.00%

Function 6F85B448 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6F85D946: __getptd_noexit.LIBCMT ref: 6F85D947
Part of subcall function 6F85D946: __amsg_exit.LIBCMT ref: 6F85D954

EncodePointer.KERNEL32(00000000), ref: 6F85B472
_CallSETranslator.LIBCMT ref: 6F85B4A8
_GetRangeOfTrysToCheck.LIBCMT ref: 6F85B4D2

Strings

MOC, xrefs: 6F85B487
RCC, xrefs: 6F85B48F
$, xrefs: 6F85B45F

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: CallCheckEncodePointerRangeTranslatorTrys__amsg_exit__getptd_noexit
String ID: MOC$RCC$$
API String ID: 3119380580-3012946005
Opcode ID: 6ce555306d44dbe04f94086fe8e524b1c13af95d2d6a3490d376d748c8546325
Instruction ID: f6cd5ffb69feca8d9fbe188930ac5f430dde5fa22fa7d046b212c96c28872eb8
Opcode Fuzzy Hash: 6ce555306d44dbe04f94086fe8e524b1c13af95d2d6a3490d376d748c8546325
Instruction Fuzzy Hash: A8416832500609EFDF55CF48CC80EAAB7B6FF54314F188599E9185B292D335E961CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F854A70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6F854AB8
_fprintf.LIBCMT ref: 6F854AD6

Part of subcall function 6F859654: __lock_file.LIBCMT ref: 6F85969B
Part of subcall function 6F859654: __stbuf.LIBCMT ref: 6F859720
Part of subcall function 6F859654: __output_l.LIBCMT ref: 6F859730
Part of subcall function 6F859654: __ftbuf.LIBCMT ref: 6F85973C

_fprintf.LIBCMT ref: 6F854AF3
_fprintf.LIBCMT ref: 6F854B3B

Strings

, xrefs: 6F854AD0
<![CDATA[%s]]>, xrefs: 6F854AED

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _fprintf$__ftbuf__lock_file__output_l__stbuf
String ID: $<![CDATA[%s]]>
API String ID: 868309879-443777849
Opcode ID: 7e092b8d6390a46c9c5a91aec9793eb712107e00ff2378bc6399e8ebde91e79d
Instruction ID: 995d075b999bba6faf106f38dd3d9cae35e2e886d534300777045e554e882603
Opcode Fuzzy Hash: 7e092b8d6390a46c9c5a91aec9793eb712107e00ff2378bc6399e8ebde91e79d
Instruction Fuzzy Hash: 3521A0B1418340ABD781CF18C885B6BB7E8FB95214F400EA9F8599F280E731E528C797

Uniqueness

Uniqueness Score: -1.00%

Function 6F862687 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 6F862695

Part of subcall function 6F861CA4: __setmbcp.LIBCMT ref: 6F861CAF

GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe,00000104,?,00000001,?,?,?,?,6F859EBD), ref: 6F8626B1
__malloc_crt.LIBCMT ref: 6F8626FB
_parse_cmdline.LIBCMT ref: 6F862715

Strings

C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe, xrefs: 6F8626A2, 6F8626A9, 6F8626D7, 6F862714
SSV], xrefs: 6F8626D5

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: FileModuleName___initmbctable__malloc_crt__setmbcp_parse_cmdline
String ID: C:\Program Files (x86)\Ezviz Studio\NpfDetectApp.exe$SSV]
API String ID: 1375966528-2652460367
Opcode ID: c0e92171d83543f3a4c6203c8e0498f6e09467d4833385170136d963d7dba962
Instruction ID: 84546616d673dd0c784aba9cbfc1d617f042fb1f9738ec4127b345f8d0308e51
Opcode Fuzzy Hash: c0e92171d83543f3a4c6203c8e0498f6e09467d4833385170136d963d7dba962
Instruction Fuzzy Hash: 9F11B1B5804658BBDB14CBACC980EDF77ACEB83334B504ADAE4109B180DB345A21CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6F85DA80 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 6F85DA80

Part of subcall function 6F85CE8A: EncodePointer.KERNEL32(00000000,00000001,6F85DA85,6F859E83,6F8714A0,00000008,6F85A049,?,00000001,?,6F8714C0,0000000C,6F859FE8,?,00000001,?), ref: 6F85CE8D
Part of subcall function 6F85CE8A: __initp_misc_winsig.LIBCMT ref: 6F85CEA8

__mtinitlocks.LIBCMT ref: 6F85DA85
__mtterm.LIBCMT ref: 6F85DA8E
__calloc_crt.LIBCMT ref: 6F85DAB3
__initptd.LIBCMT ref: 6F85DAD5
GetCurrentThreadId.KERNEL32 ref: 6F85DADC

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: CurrentEncodePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm
String ID:
API String ID: 1469070506-0
Opcode ID: b04efd30264641ce68f77444ffe156851c79d8f0571350222492e1031b3cccaa
Instruction ID: 9e4386dc482d49f516bcecf935a50580c68532219981e01e67adbda30d70af85
Opcode Fuzzy Hash: b04efd30264641ce68f77444ffe156851c79d8f0571350222492e1031b3cccaa
Instruction Fuzzy Hash: 5FF0963310C7227BEA9A66BD7D07B9F2AD29F42238B140EDAEC60DD1D0EF1198718595

Uniqueness

Uniqueness Score: -1.00%

Function 6F858DE5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,6F858EAE,?), ref: 6F858DFF
GetProcAddress.KERNEL32(00000000), ref: 6F858E06
EncodePointer.KERNEL32(00000000), ref: 6F858E12
DecodePointer.KERNEL32(00000001,6F858EAE,?), ref: 6F858E2F

Strings

RoInitialize, xrefs: 6F858DEE
combase.dll, xrefs: 6F858DFA

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 7b0ddb1fefc918737081efa7b9c55f6d54a81a26a1563d18c39a1a3692c72bda
Instruction ID: 92566d3eed1ddde8bed95d91fb3f436f0304cadb3c858977fbba26034924be31
Opcode Fuzzy Hash: 7b0ddb1fefc918737081efa7b9c55f6d54a81a26a1563d18c39a1a3692c72bda
Instruction Fuzzy Hash: B2E09A705A8A22EBEF001FB0CC0EB1877B4BB4272AF1014E0B002D9580CB706020CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6F858EBA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,6F858DD4), ref: 6F858ED4
GetProcAddress.KERNEL32(00000000), ref: 6F858EDB
EncodePointer.KERNEL32(00000000), ref: 6F858EE6
DecodePointer.KERNEL32(6F858DD4), ref: 6F858F01

Strings

RoUninitialize, xrefs: 6F858EC3
combase.dll, xrefs: 6F858ECF

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 32ec0dab4dd94bccdd33232993ac1b94bbac1b289e30e0adc8680cc810d51205
Instruction ID: 524f863f011d5e9b3bf14e59219798ce161c79b328e5f65a05885113ffca0a5a
Opcode Fuzzy Hash: 32ec0dab4dd94bccdd33232993ac1b94bbac1b289e30e0adc8680cc810d51205
Instruction Fuzzy Hash: 83E04F70524A23EBDF414FB1880EB1976B4B756325F2058D5F005D9580DB709020CF99

Uniqueness

Uniqueness Score: -1.00%

Function 6F8532A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 93COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6F8532CF

Part of subcall function 6F85A80B: RaiseException.KERNEL32(?,?,?,6F8712F0,?,?,?,?,?,6F859134,?,6F8712F0,?,00000001), ref: 6F85A860

__CxxThrowException@8.LIBCMT ref: 6F853341

Strings

ios_base::eofbit set, xrefs: 6F853396
ios_base::failbit set, xrefs: 6F85334C
ios_base::badbit set, xrefs: 6F8532E0

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3476068407-1866435925
Opcode ID: da5a7bcbfa763f497f479ecb3299aaf156342fc7d75704748217472162c5ebf4
Instruction ID: 8ebc1643ebb7c3f2a9c11ed56f9861732b59c2452c49a875daea98820588711d
Opcode Fuzzy Hash: da5a7bcbfa763f497f479ecb3299aaf156342fc7d75704748217472162c5ebf4
Instruction Fuzzy Hash: 5D415E70804348EBEF50CFE4C84ABCDBB75AB15318F104A99E0257F2D0DBB65A59CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6F8638AC Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6F8638B8

Part of subcall function 6F858A54: __FF_MSGBANNER.LIBCMT ref: 6F858A6B
Part of subcall function 6F858A54: __NMSG_WRITE.LIBCMT ref: 6F858A72
Part of subcall function 6F858A54: RtlAllocateHeap.NTDLL(011A0000,00000000,00000001,?,?,?,?,6F859101,?), ref: 6F858A97

_free.LIBCMT ref: 6F8638CB

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 2a91c0b9d88c323f31916b7f5686d2fde2d96d33609cfc5e2be6d57d2a1ed411
Instruction ID: f6942f0b9bb4af2b29283f48c5b6e15acb85bf986a36e1a3f5c040ffe3208513
Opcode Fuzzy Hash: 2a91c0b9d88c323f31916b7f5686d2fde2d96d33609cfc5e2be6d57d2a1ed411
Instruction Fuzzy Hash: BC11C472504725BBDF551BBC9C49B4937E4AF07375B104DE5E8199E380DB3598A0CF90

Uniqueness

Uniqueness Score: -1.00%

Function 009B4196 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 009B41A2

Part of subcall function 009B2BD8: __getptd_noexit.LIBCMT ref: 009B2BDB
Part of subcall function 009B2BD8: __amsg_exit.LIBCMT ref: 009B2BE8

__amsg_exit.LIBCMT ref: 009B41C2
__lock.LIBCMT ref: 009B41D2
InterlockedDecrement.KERNEL32(?), ref: 009B41EF
InterlockedIncrement.KERNEL32(02E21660), ref: 009B421A

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: ce05b4a6481fdecd498d7f37e172afc1b71e8eeccfd8252df104be146616f7e9
Instruction ID: 1d1544661256903f1914e9bf03766f604ccd1051851a807c55a9df34609f0a4e
Opcode Fuzzy Hash: ce05b4a6481fdecd498d7f37e172afc1b71e8eeccfd8252df104be146616f7e9
Instruction Fuzzy Hash: 5001C031D44621ABCB21AF68AB057DE77A4AB55B31F014205F82067282CB34A981FBD6

Uniqueness

Uniqueness Score: -1.00%

Function 009B4653 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 009B4671

Part of subcall function 009B3330: __mtinitlocknum.LIBCMT ref: 009B3346
Part of subcall function 009B3330: __amsg_exit.LIBCMT ref: 009B3352
Part of subcall function 009B3330: EnterCriticalSection.KERNEL32(?,?,?,009B6446,00000004,009B9678,0000000C,009B473C,?,?,00000000,00000000,00000000,?,009B2B8A,00000001), ref: 009B335A

___sbh_find_block.LIBCMT ref: 009B467C
___sbh_free_block.LIBCMT ref: 009B468B
HeapFree.KERNEL32(00000000,?,009B95F8,0000000C,009B3311,00000000,009B9518,0000000C,009B334B,?,?,?,009B6446,00000004,009B9678,0000000C), ref: 009B46BB
GetLastError.KERNEL32(?,009B6446,00000004,009B9678,0000000C,009B473C,?,?,00000000,00000000,00000000,?,009B2B8A,00000001,00000214), ref: 009B46CC

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 28cc10d649d206b1ed7455e17bc3d5c176f0c9f87da0e0efa03582aa5d0c60c7
Instruction ID: a2f00306456d1e2fd0bce1483026fbf8460426247bb59ed992f984705db8beb2
Opcode Fuzzy Hash: 28cc10d649d206b1ed7455e17bc3d5c176f0c9f87da0e0efa03582aa5d0c60c7
Instruction Fuzzy Hash: 30016271905315EADB217FB19F0A7DF3BA8AF42770F508518F504A60D2CF74C940AA95

Uniqueness

Uniqueness Score: -1.00%

Function 6F8547D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6F8548C5

Strings

%s='%s', xrefs: 6F8548BF
", xrefs: 6F854861
%s="%s", xrefs: 6F854896

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _fprintf
String ID: "$%s="%s"$%s='%s'
API String ID: 1654120334-3105552625
Opcode ID: 1fa38cb9ccec37b0f576e45c0708ce2b3e612c1983560433f2a4ee1301e928b0
Instruction ID: 77759fe61e5404c9e56da3d1479992831a7dcbec2cc8a084171acefb9c50b93d
Opcode Fuzzy Hash: 1fa38cb9ccec37b0f576e45c0708ce2b3e612c1983560433f2a4ee1301e928b0
Instruction Fuzzy Hash: 42414771108780AFD300CF28C451B5BBBE4EB98718F400E5EF4A65A291D7B5E568CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6F854EC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6F854ED8
_fprintf.LIBCMT ref: 6F854EF5

Strings

, xrefs: 6F854ED2
<%s>, xrefs: 6F854EEF

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _fprintf
String ID: $<%s>
API String ID: 1654120334-550942137
Opcode ID: 165f95a00d25b5112bd19d71f4b840a308469bf5b6017288e8f97a164a7bc89c
Instruction ID: f3fd9c2a645ca03f154f9bad730c558d19fe78b73334da35e0fda3633da78e60
Opcode Fuzzy Hash: 165f95a00d25b5112bd19d71f4b840a308469bf5b6017288e8f97a164a7bc89c
Instruction Fuzzy Hash: 21E092725001287B87419A48DC81D6A736CFAA166574508E6ED049F204E361E93987B1

Uniqueness

Uniqueness Score: -1.00%

Function 6F854930 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6F854948
_fprintf.LIBCMT ref: 6F854965

Strings

, xrefs: 6F85495F
, xrefs: 6F854942

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _fprintf
String ID: $
API String ID: 1654120334-1045339940
Opcode ID: ce316bb6ee63c55621cc313b6148c420a12b70303b08588c31e35860e05848b7
Instruction ID: 937429d8c6a9040b2cd6c2bfce90d1d227d4cda932732b231e7fbbfddf738123
Opcode Fuzzy Hash: ce316bb6ee63c55621cc313b6148c420a12b70303b08588c31e35860e05848b7
Instruction Fuzzy Hash: 95E0D8725001187B87519A08EC89DAE736CFEE166674508E6FE089F218E371E93887F1

Uniqueness

Uniqueness Score: -1.00%

Function 6F854AC9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6F854AD6
_fprintf.LIBCMT ref: 6F854AF3

Strings

, xrefs: 6F854AD0
<![CDATA[%s]]>, xrefs: 6F854AED

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _fprintf
String ID: $<![CDATA[%s]]>
API String ID: 1654120334-443777849
Opcode ID: a83ff1a0cc5018ba248775ebdfa39469cc5941171f4978aeee604905380a58f5
Instruction ID: 7d99883ddf38c1b72b8aa941950dcb91ff8d03c2058e152828abdd02d51b18f7
Opcode Fuzzy Hash: a83ff1a0cc5018ba248775ebdfa39469cc5941171f4978aeee604905380a58f5
Instruction Fuzzy Hash: C8E06572518240ABC7D5DB58A892B6E73A4FBE5211F8018EEE9494F244F7265038C797

Uniqueness

Uniqueness Score: -1.00%

Function 6F85B6B0 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6F85B741
_memmove.LIBCMT ref: 6F85B7B5
___AdjustPointer.LIBCMT ref: 6F85B806
_memmove.LIBCMT ref: 6F85B80F

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: 1ac13bbf69a472654a96f850e3d1dac8be38decf623c58504199a3add848b307
Instruction ID: 88a3897e03714b2a61e60177f223015b424a5ae21c94fc9c9630f89478c4c398
Opcode Fuzzy Hash: 1ac13bbf69a472654a96f850e3d1dac8be38decf623c58504199a3add848b307
Instruction Fuzzy Hash: C94195353087066BFB5C4E69D842BA677E59F217A8F204CEEE8148E6D0EF31E4A0D714

Uniqueness

Uniqueness Score: -1.00%

Function 6F86518F Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6F8651C5
__isleadbyte_l.LIBCMT ref: 6F8651F3
MultiByteToWideChar.KERNEL32(00000080,00000009,6F8712F0,00000001,?,00000000), ref: 6F865221
MultiByteToWideChar.KERNEL32(00000080,00000009,6F8712F0,00000001,?,00000000), ref: 6F865257

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 777a26b296bf13f482cae130c89fffc640bf57989614c024adc74e7171f7bf3c
Instruction ID: 68dafa96d4104adf53d25e67db075ef03e5a829017bf586df68ffb1774301a49
Opcode Fuzzy Hash: 777a26b296bf13f482cae130c89fffc640bf57989614c024adc74e7171f7bf3c
Instruction Fuzzy Hash: 1931A13160535AAFDB158E78CC44BAA7BBAFF41314F0549A9E8249F291E730E950DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6F85AFE3 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 6F85AFFA

Part of subcall function 6F85B622: ___AdjustPointer.LIBCMT ref: 6F85B66B

_UnwindNestedFrames.LIBCMT ref: 6F85B011
___FrameUnwindToState.LIBCMT ref: 6F85B023
CallCatchBlock.LIBCMT ref: 6F85B047

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: b93ec4ac91b90732f22e917619fe9bd501d638f67573947d0cb6646f5b76b4b6
Instruction ID: 90b193be6c06c1917e249647bb2f4bab634056e439e338434d2430a43ab93527
Opcode Fuzzy Hash: b93ec4ac91b90732f22e917619fe9bd501d638f67573947d0cb6646f5b76b4b6
Instruction Fuzzy Hash: AE014832400208BBDF525F59CC40EDA3BBAFF58754F008895F9286A160C332E8B1EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6F862C0D Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 6F862C31

Part of subcall function 6F863318: __fltout2.LIBCMT ref: 6F863341

__cftog_l.LIBCMT ref: 6F862C57
__cftoe_l.LIBCMT ref: 6F862C89

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: b409e7287d37b3e4165ed8bd190d6122c6529a8296de8767b854c8fb1fbd994f
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 47014C7244014EBBCF025F88DD018EE3F26BB19354B448995FA286D130C73BD9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 009B4DD4 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 009B4DE0

Part of subcall function 009B2BD8: __getptd_noexit.LIBCMT ref: 009B2BDB
Part of subcall function 009B2BD8: __amsg_exit.LIBCMT ref: 009B2BE8

__getptd.LIBCMT ref: 009B4DF7
__amsg_exit.LIBCMT ref: 009B4E05
__lock.LIBCMT ref: 009B4E15

Memory Dump Source

Source File: 00000005.00000002.2055888303.00000000009B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000005.00000002.2055853264.00000000009B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055921148.00000000009B8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055950342.00000000009BA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2055973142.00000000009BC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9b0000_NpfDetectApp.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 2999b67b9b6a2675505a25ebad840ed89f36275089204c4a1bca05e543bca0ce
Instruction ID: fbfa95fd0e72c4e3a499f6e2693bb1fcd15baa6cc2ec92a94ecbb6ad30595123
Opcode Fuzzy Hash: 2999b67b9b6a2675505a25ebad840ed89f36275089204c4a1bca05e543bca0ce
Instruction Fuzzy Hash: 8DF090319503109BE731FBA887027DD73A0BB81730F508619E000A72C3CB34A942AB52

Uniqueness

Uniqueness Score: -1.00%

Function 6F852980 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6F852A62

Part of subcall function 6F852980: _memmove.LIBCMT ref: 6F852929

Strings

invalid string position, xrefs: 6F852958
string too long, xrefs: 6F852962, 6F85296C, 6F852A91, 6F852A9B

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 9b208e3eaae2ee8c4110f639be9ab8c666e95105a20fba013eea156134293929
Instruction ID: 27fe3842cd7fe06c442ba903bbf7075f58e3681c136f2d20ae62f98f0f55f505
Opcode Fuzzy Hash: 9b208e3eaae2ee8c4110f639be9ab8c666e95105a20fba013eea156134293929
Instruction Fuzzy Hash: 1A31EC323006119BD7758DACAC80E5AF7A6FF95725B104EAFE491CF780CB35D8608391

Uniqueness

Uniqueness Score: -1.00%

Function 6F852AB0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6F852B83

Strings

invalid string position, xrefs: 6F852BB2, 6F852BBC
string too long, xrefs: 6F852BC6

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 07503e30c1fa9df634627e2dbcf31d9a551b9f5069872013fc8a9b5d82e61bcf
Instruction ID: 2f3eea12fc14abb5670a39ce6044d97956723951aa7144a2e53bde2838dcb2f7
Opcode Fuzzy Hash: 07503e30c1fa9df634627e2dbcf31d9a551b9f5069872013fc8a9b5d82e61bcf
Instruction Fuzzy Hash: 8731CF32304710DBD3658E5CE880B5AF7A6EB90761F100EAFE5558F281DBB5E860C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6F859135 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

AJ, xrefs: 6F85916D
W`, xrefs: 6F85917D

Memory Dump Source

Source File: 00000005.00000002.2057038993.000000006F851000.00000020.00000001.01000000.00000009.sdmp, Offset: 6F850000, based on PE: true

Associated: 00000005.00000002.2057021497.000000006F850000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057065779.000000006F86A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057084976.000000006F873000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057129123.000000006F96A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2057144980.000000006F96B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6f850000_NpfDetectApp.jbxd

Similarity

API ID: __getptd_noexit
String ID: AJ$W`
API String ID: 3074181302-448165853
Opcode ID: 09e4b5f491b563dc8bc17834c1f51aa412c8fb4eb85e003824013ef0d51fdbcb
Instruction ID: 813207416f65ec96c554166c95592b7c9aa2a93749ae157054b8cea521f36e63
Opcode Fuzzy Hash: 09e4b5f491b563dc8bc17834c1f51aa412c8fb4eb85e003824013ef0d51fdbcb
Instruction Fuzzy Hash: A021D3F29487159BEF984B7C8D0475D7AA2AF82374B518FC5D8344F2D8DB3899228A41

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: update_server.exePID: 66392, Parent PID: 7428COMMON

Execution Graph

Execution Coverage:	22.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1503
Total number of Limit Nodes:	28

Executed Functions

Function 0040515C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction ID: b78bf48cff894a3999656c5243e329942f020ab22272e2e872fdbeeaebf0035e
Opcode Fuzzy Hash: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction Fuzzy Hash: EDE09271B0021426D711A9699C86AEB735DDB58310F0006BFB904EB3C6EDB49E8046ED

Uniqueness

Uniqueness Score: -1.00%

Function 00408FC8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00409061,?,?,?,?,00000000,?,00409B53), ref: 00408FE8
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408FEE
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,Wow64DisableWow64FsRedirection,00000000,00409061,?,?,?,?,00000000,?,00409B53), ref: 00409002
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00409008

Strings

shell32.dll, xrefs: 00409034
Wow64DisableWow64FsRedirection, xrefs: 00408FDE
kernel32.dll, xrefs: 00408FE3, 00408FFD
Wow64RevertWow64FsRedirection, xrefs: 00408FF8

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 17e7db4c528402608d9f53e260f8b79ce616995abb8d95c1af2dd02ed3ed6c5c
Instruction ID: 9fcc65c531327f2d7efb14c601a25e4e420c6304718e48176e9e04a6a3b299d5
Opcode Fuzzy Hash: 17e7db4c528402608d9f53e260f8b79ce616995abb8d95c1af2dd02ed3ed6c5c
Instruction Fuzzy Hash: 6701DF70208300AEEB10AB76DC47B563AA8E782714F60843BF504B22C3CA7C5C44CA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00409FB4 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A010
SetWindowLongA.USER32(000104C2,000000FC,004097FC), ref: 0040A027

Part of subcall function 00406ADC: GetCommandLineA.KERNEL32(00000000,00406B20,?,?,?,?,00000000,?,0040A098,?), ref: 00406AF4

Part of subcall function 00409888: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,020B788C,00409974,00000000,0040995B), ref: 004098F8
Part of subcall function 00409888: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,020B788C,00409974,00000000), ref: 0040990C
Part of subcall function 00409888: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
Part of subcall function 00409888: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
Part of subcall function 00409888: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,020B788C,00409974), ref: 00409940

RemoveDirectoryA.KERNEL32(00000000,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A113
73A25CF0.USER32(000104C2,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A127

Strings

InnoSetupLdrWindow, xrefs: 0040A004
/SL5="$%x,%d,%d,, xrefs: 0040A067
STATIC, xrefs: 0040A009

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 978128352-3001827809
Opcode ID: f35d8c1ce23740e5e47570a4a7ea1aa6b0c7a4e1336b706dbfad7c34b6de0a74
Instruction ID: 994b03bd5abc72cbe06dd2c14f0861f5fc0fad0f3ad24bd21fe84be6bde737e4
Opcode Fuzzy Hash: f35d8c1ce23740e5e47570a4a7ea1aa6b0c7a4e1336b706dbfad7c34b6de0a74
Instruction Fuzzy Hash: 57411A70A00205DFD715EBA9EE86B9A7BA5EB84304F10427BF510B73E2DB789801DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409FD8 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409460: GetLastError.KERNEL32(00000000,00409503,?,0040B240,?,020B788C), ref: 00409484

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A010
SetWindowLongA.USER32(000104C2,000000FC,004097FC), ref: 0040A027

Part of subcall function 00406ADC: GetCommandLineA.KERNEL32(00000000,00406B20,?,?,?,?,00000000,?,0040A098,?), ref: 00406AF4

Part of subcall function 00409888: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,020B788C,00409974,00000000,0040995B), ref: 004098F8
Part of subcall function 00409888: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,020B788C,00409974,00000000), ref: 0040990C
Part of subcall function 00409888: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
Part of subcall function 00409888: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
Part of subcall function 00409888: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,020B788C,00409974), ref: 00409940

RemoveDirectoryA.KERNEL32(00000000,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A113
73A25CF0.USER32(000104C2,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A127

Strings

InnoSetupLdrWindow, xrefs: 0040A004
/SL5="$%x,%d,%d,, xrefs: 0040A067
STATIC, xrefs: 0040A009

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryErrorExitLastLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 240127915-3001827809
Opcode ID: 41e9b17cc1901837085009e7774581f9f675215498936b1d5fec870b95540319
Instruction ID: cbbd3698a6e5ddb8e812fa6c760aedb007618753dcf5685e5a94b93d1743052f
Opcode Fuzzy Hash: 41e9b17cc1901837085009e7774581f9f675215498936b1d5fec870b95540319
Instruction Fuzzy Hash: 04412B70A00205DBC715EBA9EE86B9E3BA5EB84304F10427BF510B73E2DB789801DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409888 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,020B788C,00409974,00000000,0040995B), ref: 004098F8
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,020B788C,00409974,00000000), ref: 0040990C
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,020B788C,00409974), ref: 00409940

Part of subcall function 00409460: GetLastError.KERNEL32(00000000,00409503,?,0040B240,?,020B788C), ref: 00409484

Strings

D, xrefs: 004098D2

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 3e364823df46f41b243604843b678d585e88c5cad38ef85377b023b87dae9783
Instruction ID: 0c6d97fba1df7b16fba7b9ed0c132cba9133a3324ac8f072eb64155fee6ae1b7
Opcode Fuzzy Hash: 3e364823df46f41b243604843b678d585e88c5cad38ef85377b023b87dae9783
Instruction Fuzzy Hash: AC1130B16142086EDB10FBE68C52F9EBBACEF49718F50013EB614F62C7DA785D048669

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00409A14 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409A26
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409A31
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409A72
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409AA4
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409AB4

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: c2769086b94dacb7810d1409196c7497058a42c32b70979fc979e51038c0ff67
Instruction ID: 05782b2e5a8588c9c74d05110837466633af9a4b7a19298b20ab433fd050a55e
Opcode Fuzzy Hash: c2769086b94dacb7810d1409196c7497058a42c32b70979fc979e51038c0ff67
Instruction Fuzzy Hash: D0216FB13003846BD6309A698C85E67B7DC9F85360F18492AFA85E62C3D73DED40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Uniqueness

Uniqueness Score: -1.00%

Function 00409D26 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409D8A

Strings

.tmp, xrefs: 00409DD0
$u@, xrefs: 00409E3E

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: Message
String ID: $u@$.tmp
API String ID: 2030045667-236237750
Opcode ID: 76a7687ccf1c1f3f155fed8792e4b2e0c469f7c74cc7371f2538726c547644a2
Instruction ID: fbeaf51a7290a35b1d20cf1acd7fffd14229a7cea4ec7fe779b7d8bf1d8f9ef0
Opcode Fuzzy Hash: 76a7687ccf1c1f3f155fed8792e4b2e0c469f7c74cc7371f2538726c547644a2
Instruction Fuzzy Hash: 7041A170604201DFD311EF19DE92A5A7BA6FB49304B11453AF801B73E2CB79AC01DAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00409D41 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409D8A

Strings

.tmp, xrefs: 00409DD0
$u@, xrefs: 00409E3E

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: Message
String ID: $u@$.tmp
API String ID: 2030045667-236237750
Opcode ID: 4be92c8e37dddd0a3a50cfadddd3e7ce3c10b6794e32ae209eae1f209508f25f
Instruction ID: 7aabf0afbc79ebbbc3d3aa4d6af75c8ddef5afe13af9357e4f9bebdf666c2db7
Opcode Fuzzy Hash: 4be92c8e37dddd0a3a50cfadddd3e7ce3c10b6794e32ae209eae1f209508f25f
Instruction Fuzzy Hash: 66418070600201DFC711EF69DE92A5A7BB6FB49304B11457AF801B73E2CB79AC01DAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00409254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00409343,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040929A
GetLastError.KERNEL32(00000000,00000000,?,00000000,00409343,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004092A3

Strings

.tmp, xrefs: 00409283

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 7647810fba1c1a7df54c129ecd6d2966c744d5805a6f131b99297333171aebfe
Instruction ID: 381de743b5e558d6c5ac88c9815bc56a2e764fefa580558ac3af8d983805238d
Opcode Fuzzy Hash: 7647810fba1c1a7df54c129ecd6d2966c744d5805a6f131b99297333171aebfe
Instruction Fuzzy Hash: 3C214975A002089BDB01EFE1C9429DEB7B9EB48304F10457BE901B73C2DA7CAF058AA5

Uniqueness

Uniqueness Score: -1.00%

Function 004093FC Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040941B
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040942B
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040943E
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 00409448

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: fb2155ff6e4859bec8591c3fde2b363a3ebb44483e144ae34e4cc697df15f474
Instruction ID: 2c3041558bff2c9731999a3fdaa5bf7f611e1c5313eca5e15d372d414c244bd5
Opcode Fuzzy Hash: fb2155ff6e4859bec8591c3fde2b363a3ebb44483e144ae34e4cc697df15f474
Instruction Fuzzy Hash: 32F0B472A0811457CB34B5EF9981A6F638DEAD1368751813BF904F3383D578CD0392AD

Uniqueness

Uniqueness Score: -1.00%

Function 00408EE0 Relevance: 3.0, APIs: 2, Instructions: 42
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(00000000,00000000,00408F3D,?,0000000D,00000000), ref: 00408F17
GetLastError.KERNEL32(00000000,00000000,00408F3D,?,0000000D,00000000), ref: 00408F1F

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 3b1a080efc38f6a00fe619da50c0df6cd471c35a4e7d9ee13917e5cf65062608
Instruction ID: 347d5d3a4f376e63cbb9019fe75b0976320091a2070a9b9a83531334af51675b
Opcode Fuzzy Hash: 3b1a080efc38f6a00fe619da50c0df6cd471c35a4e7d9ee13917e5cf65062608
Instruction Fuzzy Hash: A3F0C271A04708AFCB01EFB69D4189EB3E8EB88314B5045BBF854F33C2EA395E009598

Uniqueness

Uniqueness Score: -1.00%

Function 0040A161 Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveDirectoryA.KERNEL32(00000000,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A113
73A25CF0.USER32(000104C2,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A127

Part of subcall function 004093FC: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040941B
Part of subcall function 004093FC: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040943E
Part of subcall function 004093FC: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 00409448

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ErrorLast$DirectoryRemoveSleep
String ID:
API String ID: 936953547-0
Opcode ID: 6aaed9f502bdba01af7e6ebabe6af313ac24c77e8368f813f0c0da7e185410e5
Instruction ID: 3fa009acc415daa351a55d2b5950970e0f8674877f0f6eafd0212b86f5367797
Opcode Fuzzy Hash: 6aaed9f502bdba01af7e6ebabe6af313ac24c77e8368f813f0c0da7e185410e5
Instruction Fuzzy Hash: 89F0F470641201DBD725EB69EED9B1537A5EF84305F00413BA101BB6F1CB7C9891EB4E

Uniqueness

Uniqueness Score: -1.00%

Function 00406F00 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406F0A
LoadLibraryA.KERNEL32(00000000,00000000,00406F54,?,00000000,00406F72,?,00008000), ref: 00406F39

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 280b78466cfb49ac5d1a4d8de4e82968344a77d2278ba686a31885ea79f0a63b
Instruction ID: 61c75ae37e4b7eabf140846b9e9d3e90831ba1beb5fed57b889ca027c52d2016
Opcode Fuzzy Hash: 280b78466cfb49ac5d1a4d8de4e82968344a77d2278ba686a31885ea79f0a63b
Instruction Fuzzy Hash: 49F08270614704BEDB029FB69C6282BBBFCE749B0475348B6F904A26D2E53C5D208568

Uniqueness

Uniqueness Score: -1.00%

Function 004075CC Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 004075EB
GetLastError.KERNEL32(?,?,?,00000000), ref: 004075F3

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,020A03AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 4b4e93de333a3cce642c2996d73c93b1535ff8d1f0695df8178d397978e57373
Instruction ID: cda5b13584bb414d1d7c0d7cef5a43535e1b929ad68122291bf656bee98e9d77
Opcode Fuzzy Hash: 4b4e93de333a3cce642c2996d73c93b1535ff8d1f0695df8178d397978e57373
Instruction Fuzzy Hash: A0E092766081016FD601D55EC881B9B33DCDFC5365F00453ABA54EB2D1D675AC0087B6

Uniqueness

Uniqueness Score: -1.00%

Function 0040758C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 004075A3
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 004075B2

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 60e63bc2ff5526e1bd28c8a7098a19329bed0093cf160d1b5924f83231400461
Instruction ID: 6d0e635579d8ef6deec62af0acb898b5effba2491802df9b0589d4017bc118ea
Opcode Fuzzy Hash: 60e63bc2ff5526e1bd28c8a7098a19329bed0093cf160d1b5924f83231400461
Instruction Fuzzy Hash: 4FE012B1A181147AEB24965A9CC5FAB6BDCCBC5314F14847BF904DB282D678DC04877B

Uniqueness

Uniqueness Score: -1.00%

Function 00407524 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 0040753B
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 00407547

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,020A03AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 0dd762855ce75d8d861d21fe55c1929f9bb0fd02210f0b496c114b023f039fab
Instruction ID: cd7afd6369a15af5fc7b0f7528e30ca6696358c0ea2e6c45e94f6e0b4d50a73a
Opcode Fuzzy Hash: 0dd762855ce75d8d861d21fe55c1929f9bb0fd02210f0b496c114b023f039fab
Instruction Fuzzy Hash: 0EE04FB1600210AFEB10EEB98C81B9672DC9F48364F048576EA14DF2C6D274DC00C766

Uniqueness

Uniqueness Score: -1.00%

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Uniqueness

Uniqueness Score: -1.00%

Function 004051D0 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405306), ref: 004051EF

Part of subcall function 00404C2C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404C49

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction ID: c760dbbb10683706500036a577470844d35ac6ab0c013c9c95042e4326961867
Opcode Fuzzy Hash: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction Fuzzy Hash: 3B313D75E00119ABCB00EF95C8C19EEB779FF84304F158977E815BB285E739AE058B98

Uniqueness

Uniqueness Score: -1.00%

Function 004074D6 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407518

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce86d0b46b6749cbb1c8065cdd94f6338fa023cacd1506a2c152e65e14b54ccf
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: ce86d0b46b6749cbb1c8065cdd94f6338fa023cacd1506a2c152e65e14b54ccf
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004074D8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407518

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5c7f1f50133f8918f9d70925a1da877e635501982028b62cfe689d085d452769
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 5c7f1f50133f8918f9d70925a1da877e635501982028b62cfe689d085d452769
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040693C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406984,?,?,?,?,00000000,?,00406999,00406CC7,00000000,00406D0C,?,?,?), ref: 00406967

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 53f9965764e037d0eade91fd77cfc00c47722664131d9e88e47f7f2d0abdeb71
Instruction ID: a5d31a369ac9c1460ce21b6bb4ed2cb839aeaeb50f5f76e03c39097c5263300d
Opcode Fuzzy Hash: 53f9965764e037d0eade91fd77cfc00c47722664131d9e88e47f7f2d0abdeb71
Instruction Fuzzy Hash: A9E065712043047FD701EA629C52959B7ACDB89708B924476B501A6682D5785E108568

Uniqueness

Uniqueness Score: -1.00%

Function 00407628 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040763F

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,020A03AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 2449abf237b154253dcf2b231e0da589e0eb2b5517b9a23d8c49629d5bbf5411
Instruction ID: 68b513bd5595dc6b38f1d245c0222f257f742b1e6f06676187839ef0e6677733
Opcode Fuzzy Hash: 2449abf237b154253dcf2b231e0da589e0eb2b5517b9a23d8c49629d5bbf5411
Instruction Fuzzy Hash: 93E01A727081106BEB10E65EDCC0EABA7DCDFC5764F04547BBA08EB291D674AC049676

Uniqueness

Uniqueness Score: -1.00%

Function 004071E4 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0040904B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,Wow64DisableWow64FsRedirection,00000000,00409061), ref: 00407203

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 606059c89ae6d8e8cf07aa2f3a49422b1cb7a18355834490beef1a35ac41266b
Instruction ID: 095b59eb22c1ada42cfe979e419102ec0d22498c88dfceb067fba30b4837873c
Opcode Fuzzy Hash: 606059c89ae6d8e8cf07aa2f3a49422b1cb7a18355834490beef1a35ac41266b
Instruction Fuzzy Hash: 8DE0D8A0B8830125F22514544C87B77110E53C0700F50847EB710ED3D3D6BEA90641AF

Uniqueness

Uniqueness Score: -1.00%

Function 0040760C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,020B78E4,00409F6B,00000000), ref: 00407613

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,020A03AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 2ff8edb08080e924c2b395f282aa3d8258573adb5ced5672aaac345b41159427
Instruction ID: 5d9383f6f08d3e81a9fa52c4aba0b6319cc61be016c813106cdb36ce464f185a
Opcode Fuzzy Hash: 2ff8edb08080e924c2b395f282aa3d8258573adb5ced5672aaac345b41159427
Instruction Fuzzy Hash: 39C04CB1A0450047DB40A6BE99C1A0662DC5A483157045576BA08DB297D679E8009665

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406F79), ref: 00406F6C

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b3342c3bee8ef6d4bfebdffece25c86b3cab89117035339c57c774ddff03cb9f
Instruction ID: 754ecbd0d3eeca534395493226652c0236480d823d7569c9efe771d01927bad3
Opcode Fuzzy Hash: b3342c3bee8ef6d4bfebdffece25c86b3cab89117035339c57c774ddff03cb9f
Instruction Fuzzy Hash: 97B09B7661C2015DE705D6D5745193863F4D7C47103A1457BF104D25C0D57CD4144518

Uniqueness

Uniqueness Score: -1.00%

Function 00406F77 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406F79), ref: 00406F6C

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8c0feaa3b8caa60bdda2d34a80aa64328f40d718bb3766066fe9d436f42a4d4e
Instruction ID: 7c61e226393e4972c06343dd54fa3db727d2c771c967085a02b7622724de7152
Opcode Fuzzy Hash: 8c0feaa3b8caa60bdda2d34a80aa64328f40d718bb3766066fe9d436f42a4d4e
Instruction Fuzzy Hash: BAA022A8C00002B2CE00E2F08080A3C23282A8C3003C00AAA322EB20C0C03CC000822A

Uniqueness

Uniqueness Score: -1.00%

Function 004068D0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,004068CC,?,004065A9,?,?,00406CE7,00000000,00406D0C,?,?,?,?,00000000,00000000), ref: 004068D2

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 17375083e06acd4281245791c958798094bb343357575ce1856f87173c3dc77f
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 17375083e06acd4281245791c958798094bb343357575ce1856f87173c3dc77f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00407DFC Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407E8C

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173b8e8880a2d8bc8916495ece18949fbab6e5abf9cd9f38168eb99c200b7a3e
Instruction ID: 2791b199587b26d82634b85145401aad68464bde91e43c5b6ac1b5c6de7462a2
Opcode Fuzzy Hash: 173b8e8880a2d8bc8916495ece18949fbab6e5abf9cd9f38168eb99c200b7a3e
Instruction Fuzzy Hash: 7A1172716042449BDB00EE19C881B5B3794AF84359F1484BAF958AB2C6DB38EC04CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Uniqueness

Uniqueness Score: -1.00%

Function 004074A8 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 004074B8

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e9d4eabf3352258034a438adb9f93a7799ac96b59790047b66948ab7235a5e89
Instruction ID: 0172511661962fd54a17c381567595eb1d39a1afdb2a9088c563811225ee2893
Opcode Fuzzy Hash: e9d4eabf3352258034a438adb9f93a7799ac96b59790047b66948ab7235a5e89
Instruction Fuzzy Hash: FDD05E81B00A6017D215E2BE498864696C85F88745B08847AFA84E73D1D67CAC008399

Uniqueness

Uniqueness Score: -1.00%

Function 00407DA4 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E82), ref: 00407DBB

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5b9bfc86dfec920811477731d59a81a0154f8da7388717baf7e2e0d063c75e3e
Instruction ID: 99ab645fda39969175de1cb99313e8e2edaeef7f3c7532f72142fb74a6686f70
Opcode Fuzzy Hash: 5b9bfc86dfec920811477731d59a81a0154f8da7388717baf7e2e0d063c75e3e
Instruction Fuzzy Hash: 0AD0E9B17553055BDB90EEB95CC5B123BD87B48601F5044B66904EB29AE674E8109614

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040936C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040937B
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00409381
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0040939A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004093C1
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004093C6
ExitWindowsEx.USER32(00000002,00000000), ref: 004093D7

Strings

SeShutdownPrivilege, xrefs: 00409393

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 2b7c2d1c4f590a8974f253569f8503172d2d606641626e35aa9b2bf4c08caf06
Instruction ID: 611fb1cec5075bd7f6e538fe0f9c98e62950726bb4ce6d0bef13c3fa82a74cfd
Opcode Fuzzy Hash: 2b7c2d1c4f590a8974f253569f8503172d2d606641626e35aa9b2bf4c08caf06
Instruction Fuzzy Hash: 95F0627068430276E610A6718C47F67228C5B88B08F50483ABE51FA1C3D7BCCC044A6F

Uniqueness

Uniqueness Score: -1.00%

Function 00406F84 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00406FAD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00406FB3
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00407001

Strings

kernel32.dll, xrefs: 00406FA8
Locale, xrefs: 00406FF0
.DEFAULT\Control Panel\International, xrefs: 00406FD8
Control Panel\Desktop\ResourceLocale, xrefs: 00407010
GetUserDefaultUILanguage, xrefs: 00406FA3

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 60a9e4a616bde9d3650d5374f7b0e792bef98a6345d6610fa7bc99ac1ec5f133
Instruction ID: 4848c3cc747176469ce0ef08a48ea257d9f62360c4c8e5a9f2e1a14c28c6fa3b
Opcode Fuzzy Hash: 60a9e4a616bde9d3650d5374f7b0e792bef98a6345d6610fa7bc99ac1ec5f133
Instruction Fuzzy Hash: C3217370E04209ABDB10EBB5CD51B9F77A8EB44304F60857BA500F72C1DB7CAA05879E

Uniqueness

Uniqueness Score: -1.00%

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405314 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040555C,?,?,?,?,00000000,00000000,00000000,?,0040653B,00000000,0040654E), ref: 0040532E

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Part of subcall function 004051A8: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Strings

:mm:ss, xrefs: 0040552A
AMPM, xrefs: 004054F9
m/d/yy, xrefs: 004053FD
:mm, xrefs: 00405510
mmmm d, yyyy, xrefs: 0040541F

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction ID: f22f4b18e1885e1925b87b286fa486de3d96a381b4aec2b7527aff107c54c5fa
Opcode Fuzzy Hash: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction Fuzzy Hash: 8E514234B00648ABDB00EBA59C91B9F776ADB89304F50957BB514BB3C6CA3DCA058B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: e5c78b39f57021be2b84baee447ab27339ef0409ceaef8bd5dd3a85dcd2f6a98
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: e5c78b39f57021be2b84baee447ab27339ef0409ceaef8bd5dd3a85dcd2f6a98
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00409AD0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409ADA
SizeofResource.KERNEL32(00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 00409AED
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4,?,00000000), ref: 00409AFF
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4), ref: 00409B10

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 400a5822642c04a340576dade1617737d9942a0be047b9803f81a1d9eeffe18d
Instruction ID: bd400d834a0aeaf6767d0a45abc69bca8fb82328816d2df24890c915d48f9c17
Opcode Fuzzy Hash: 400a5822642c04a340576dade1617737d9942a0be047b9803f81a1d9eeffe18d
Instruction Fuzzy Hash: 87E05AD035434625EA6036E718D2B2B62085FA471DF00013FBB00792D3DDBC8C04452E

Uniqueness

Uniqueness Score: -1.00%

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409B3A), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409B3A), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000007.00000002.2098473221.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2098365004.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098498725.000000000040B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2098538875.0000000000411000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_update_server.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: update_server.tmpPID: 66408, Parent PID: 66392COMMON

Executed Functions

Function 00488444 Relevance: 136.6, APIs: 22, Strings: 55, Instructions: 1871COMMON

Download Yara Rule

Strings

DIREXISTS, xrefs: 004884C4
GETSYSWOW64DIR, xrefs: 00488B66
FILECOPY, xrefs: 00488CB5
REGGETSUBKEYNAMES, xrefs: 00488FF3
CHARLENGTH, xrefs: 004899DC
REGWRITEEXPANDSTRINGVALUE, xrefs: 00489564
REGWRITEDWORDVALUE, xrefs: 0048974F
REMOVEBACKSLASHUNLESSROOT, xrefs: 00488A31
ISADMINLOGGEDON, xrefs: 00489903
GETSYSTEMDIR, xrefs: 00488B3E
PARAMCOUNT, xrefs: 0048896B
GETCMDTAIL, xrefs: 00488943
GETINIINT, xrefs: 004885AA
REGQUERYMULTISTRINGVALUE, xrefs: 0048918F
REGGETVALUENAMES, xrefs: 00489060
REGDELETEVALUE, xrefs: 00488F4E
ADDBACKSLASH, xrefs: 004889C1
REGWRITESTRINGVALUE, xrefs: 0048944D
GETENV, xrefs: 0048890B
REGQUERYSTRINGVALUE, xrefs: 004890CD
SETINIBOOL, xrefs: 00488818
REGKEYEXISTS, xrefs: 00488D79
STRINGCHANGE, xrefs: 00488BB6
REGDELETEKEYINCLUDINGSUBKEYS, xrefs: 00488E98
REGQUERYBINARYVALUE, xrefs: 0048932E
GETSHORTNAME, xrefs: 00488AD9
FILEORDIREXISTS, xrefs: 004884FD
REGQUERYDWORDVALUE, xrefs: 00489251
SETNTFSCOMPRESSION, xrefs: 00489A1D
GETINIBOOL, xrefs: 0048862F
ADDPERIOD, xrefs: 004899A4
REGWRITEBINARYVALUE, xrefs: 00489823
DELETEINISECTION, xrefs: 004888D1
CONVERTPERCENTSTRING, xrefs: 00488D38
FILEEXISTS, xrefs: 0048848B
REMOVEQUOTES, xrefs: 00488AA1
INIKEYEXISTS, xrefs: 0048869A
SETINIINT, xrefs: 004887AD
SETINISTRING, xrefs: 0048873E
GETUILANGUAGE, xrefs: 0048997F
ISINISECTIONEMPTY, xrefs: 004886F6
STRINGCHANGEEX, xrefs: 00488C1D
ADDQUOTES, xrefs: 00488A69
USINGWINNT, xrefs: 00488C91
GETWINDIR, xrefs: 00488B16
REGWRITEMULTISTRINGVALUE, xrefs: 00489645
FONTEXISTS, xrefs: 0048994B
DELETEINIENTRY, xrefs: 00488883
GETINISTRING, xrefs: 00488536
REMOVEBACKSLASH, xrefs: 004889F9
GETTEMPDIR, xrefs: 00488B8E
PARAMSTR, xrefs: 0048898F
ISPOWERUSERLOGGEDON, xrefs: 00489927
REGVALUEEXISTS, xrefs: 00488DF6
REGDELETEKEYIFEMPTY, xrefs: 00488EF3

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID:
String ID: ADDBACKSLASH$ADDPERIOD$ADDQUOTES$CHARLENGTH$CONVERTPERCENTSTRING$DELETEINIENTRY$DELETEINISECTION$DIREXISTS$FILECOPY$FILEEXISTS$FILEORDIREXISTS$FONTEXISTS$GETCMDTAIL$GETENV$GETINIBOOL$GETINIINT$GETINISTRING$GETSHORTNAME$GETSYSTEMDIR$GETSYSWOW64DIR$GETTEMPDIR$GETUILANGUAGE$GETWINDIR$INIKEYEXISTS$ISADMINLOGGEDON$ISINISECTIONEMPTY$ISPOWERUSERLOGGEDON$PARAMCOUNT$PARAMSTR$REGDELETEKEYIFEMPTY$REGDELETEKEYINCLUDINGSUBKEYS$REGDELETEVALUE$REGGETSUBKEYNAMES$REGGETVALUENAMES$REGKEYEXISTS$REGQUERYBINARYVALUE$REGQUERYDWORDVALUE$REGQUERYMULTISTRINGVALUE$REGQUERYSTRINGVALUE$REGVALUEEXISTS$REGWRITEBINARYVALUE$REGWRITEDWORDVALUE$REGWRITEEXPANDSTRINGVALUE$REGWRITEMULTISTRINGVALUE$REGWRITESTRINGVALUE$REMOVEBACKSLASH$REMOVEBACKSLASHUNLESSROOT$REMOVEQUOTES$SETINIBOOL$SETINIINT$SETINISTRING$SETNTFSCOMPRESSION$STRINGCHANGE$STRINGCHANGEEX$USINGWINNT
API String ID: 0-3658119371
Opcode ID: 1f14d61b7a5d52fdf141eebfabc5151eab6d40e8db8212f4da4e77aab49c8a96
Instruction ID: 936434b6cf74013ef055cbb55979cf012bc570ba37b1a9c085d549fc9f4523a8
Opcode Fuzzy Hash: 1f14d61b7a5d52fdf141eebfabc5151eab6d40e8db8212f4da4e77aab49c8a96
Instruction Fuzzy Hash: 4AD25174B006559BDB04FB79C8825AEB6A5AF49704F14883FF402E738ADE38ED06C759

Uniqueness

Uniqueness Score: -1.00%

Function 0046C5C4 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 959COMMON

Download Yara Rule

Strings

Version of existing file: %u.%u.%u.%u, xrefs: 0046CA98
Couldn't read time stamp. Skipping., xrefs: 0046CC51
Version of existing file: (none), xrefs: 0046CC16
Existing file has a later time stamp. Skipping., xrefs: 0046CCEB
@, xrefs: 0046C6CC
Version of our file: (none), xrefs: 0046CA18
Skipping due to "onlyifdestfileexists" flag., xrefs: 0046CE16
Failed to strip read-only attribute., xrefs: 0046CDEF
Stripped read-only attribute., xrefs: 0046CDE3
Version of our file: %u.%u.%u.%u, xrefs: 0046CA0C
-- File entry --, xrefs: 0046C617
Existing file is protected by Windows File Protection. Skipping., xrefs: 0046CD08
Skipping due to "onlyifdoesntexist" flag., xrefs: 0046C8EA
Incrementing shared file count (32-bit)., xrefs: 0046D4A4
Time stamp of our file: (failed to read), xrefs: 0046C8C3
Existing file's MD5 sum matches our file. Skipping., xrefs: 0046CBD1
Time stamp of our file: %s, xrefs: 0046C8B7
InUn, xrefs: 0046D061
Will register the file (a type library) later., xrefs: 0046D412
Will register the file (a DLL/OCX) later., xrefs: 0046D41E
Dest file exists., xrefs: 0046C8D7
Time stamp of existing file: (failed to read), xrefs: 0046C953
Existing file's MD5 sum is different from our file. Proceeding., xrefs: 0046CBE0
Failed to read existing file's MD5 sum. Proceeding., xrefs: 0046CBEC
Same time stamp. Skipping., xrefs: 0046CC71
Existing file is a newer version. Skipping., xrefs: 0046CB1E
User opted not to overwrite the existing file. Skipping., xrefs: 0046CD69
.tmp, xrefs: 0046CED3
Same version. Skipping., xrefs: 0046CC01
Installing the file., xrefs: 0046CE25
Uninstaller requires administrator: %s, xrefs: 0046D091
Non-default bitness: 64-bit, xrefs: 0046C7CB
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 0046CDB2
Incrementing shared file count (64-bit)., xrefs: 0046D48B
Non-default bitness: 32-bit, xrefs: 0046C7D7
Time stamp of existing file: %s, xrefs: 0046C947
, xrefs: 0046CAEB, 0046CCBC, 0046CD3A
Dest filename: %s, xrefs: 0046C7B0
Dest file is protected by Windows File Protection., xrefs: 0046C809
IF, xrefs: 0046D613

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's MD5 sum is different from our file. Proceeding.$Existing file's MD5 sum matches our file. Skipping.$Failed to read existing file's MD5 sum. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing the file.$IF$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-3571605357
Opcode ID: 56835e39ca076e047aa2f6d3f33d3104a8d2048e3cdf3cb1758606d2133742c4
Instruction ID: bbba4ebc422fcc932ed0245fa1df0834f4a6a16cbc4990aadff4421ccbeeb5a2
Opcode Fuzzy Hash: 56835e39ca076e047aa2f6d3f33d3104a8d2048e3cdf3cb1758606d2133742c4
Instruction Fuzzy Hash: 54928630E042889FCB11DFA5C485BEDBBB5AF05308F5440ABE844B7392D7789E45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423B7C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418162fb869e7f34a03a2d4e4da53bce2b934c451fe0db21bb1df244df0f1015
Instruction ID: 08d2eb01bbb0ed60fc7aa7cee5e011afdc801c2d0a550085eeb8675b0aa62de6
Opcode Fuzzy Hash: 418162fb869e7f34a03a2d4e4da53bce2b934c451fe0db21bb1df244df0f1015
Instruction Fuzzy Hash: ACE19A30B00124EBC710DF69E585A5EB7B0FF48704FA441AAE645AB352CB7DEE81DB09

Uniqueness

Uniqueness Score: -1.00%

Function 00463B8C Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1645windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00490078: GetWindowRect.USER32(00000000), ref: 0049008E

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00463F5B

Part of subcall function 0041D620: GetObjectA.GDI32 ref: 0041D64B

Part of subcall function 004639E8: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00463A85
Part of subcall function 004639E8: ExtractIconA.SHELL32 ref: 00463AAB
Part of subcall function 004639E8: SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00463B07
Part of subcall function 004639E8: ExtractIconA.SHELL32 ref: 00463B2D

Part of subcall function 004902D4: MulDiv.KERNEL32(0000000D,?,0000000D,004643FC), ref: 004902DE

Part of subcall function 0048FFC8: 73A1A570.USER32(00000000,?,?,?), ref: 0048FFEA
Part of subcall function 0048FFC8: SelectObject.GDI32(?,00000000), ref: 00490010
Part of subcall function 0048FFC8: 73A1A480.USER32(00000000,?,0049006E,00490067,?,00000000,?,?,?), ref: 00490061

Part of subcall function 004902C4: MulDiv.KERNEL32(0000004B,?,00000006,0048FFE5,?,?,?), ref: 004902CE

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00464BD3
AppendMenuA.USER32 ref: 00464BE4
AppendMenuA.USER32 ref: 00464BFC

Part of subcall function 00429FCC: SendMessageA.USER32 ref: 00429FE2

Strings

(Default), xrefs: 004651E7
, xrefs: 0046401D
STOPIMAGE, xrefs: 00463F50

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Menu$AppendExtractFileIconInfoObject$A480A570BitmapLoadMessageRectSelectSendSystemWindow
String ID: $(Default)$STOPIMAGE
API String ID: 3433789705-770201673
Opcode ID: 80f7aee92de1e31dca4f16c75dc9a4f5f3520f9015eb7726ec2554a956d9f7b2
Instruction ID: 9b804f360638e7ec9479bb78d72ee5234d78dd0d5496d892e29c920f99ca9afd
Opcode Fuzzy Hash: 80f7aee92de1e31dca4f16c75dc9a4f5f3520f9015eb7726ec2554a956d9f7b2
Instruction Fuzzy Hash: 7DF2C6386105218FCB00EF69D8D9F9973F5BF89304F1541B6E9049B36ADB78AC46CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A964 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,00000000,?,00000000,13I,?,00000000,00000000,?,?,0047BCC8,?,?,00000000), ref: 0047A9C4
FindNextFileA.KERNEL32(000000FF,?,00000000,?,?,00000000,?,00000000,13I,?,00000000,00000000,?,?,0047BCC8,?), ref: 0047AA0D
FindClose.KERNEL32(000000FF,000000FF,?,00000000,?,?,00000000,?,00000000,13I,?,00000000,00000000,?,?,0047BCC8), ref: 0047AA1A
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,00000000,?,00000000,13I,?,00000000,00000000,?,?,0047BCC8,?), ref: 0047AA66
FindNextFileA.KERNEL32(000000FF,?,00000000,0047AB33,?,00000000,?,00000000,?,?,00000000,?,00000000,13I,?,00000000), ref: 0047AB0F
FindClose.KERNEL32(000000FF,0047AB3A,0047AB33,?,00000000,?,00000000,?,?,00000000,?,00000000,13I,?,00000000,00000000), ref: 0047AB2D

Strings

13I, xrefs: 0047A98E

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: 13I
API String ID: 3541575487-562285233
Opcode ID: 9c09ec5516b9541408d399ce974cdbd43a204ef4bb04fd199a45595856a1965c
Instruction ID: 4e67e333ed9d0cc1fab42887fed5e7c2c21fb1f12194a2671a08295e0f582913
Opcode Fuzzy Hash: 9c09ec5516b9541408d399ce974cdbd43a204ef4bb04fd199a45595856a1965c
Instruction Fuzzy Hash: C7517E71900648AFCB11EFA6CC45ADEB7BCEB88315F1084BAA508E7341D6389F95CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00470C84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00470DEE,?,?,00000001,00497154), ref: 00470CDD
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00470DEE,?,?,00000001,00497154), ref: 00470DBA
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00470DEE,?,?,00000001,00497154), ref: 00470DC8

Strings

unins, xrefs: 00470D30
unins???.*, xrefs: 00470CC7

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 716cf061988132e8a78e502cb1a015ffc6b39fa697bfe9ce6c63228b9a15e204
Instruction ID: efef7a00cc11a416bc55dd6669f4c7d8ef89bbc17b889cc882c0d169e59b9d03
Opcode Fuzzy Hash: 716cf061988132e8a78e502cb1a015ffc6b39fa697bfe9ce6c63228b9a15e204
Instruction Fuzzy Hash: A63113756012489FCB50EB65C981BDE77B9AF44304F5084B6A448AB3A2D738AF818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00451668 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004516CB,?,?,-00000001,00000000), ref: 004516A5
GetLastError.KERNEL32(00000000,?,00000000,004516CB,?,?,-00000001,00000000), ref: 004516AD

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 2ccb38690e6aaf115f3138c94c71e4fbb344a9e4605e64161c765321e8b078e6
Instruction ID: 1035efb27f9b4b466a521b4d59d966f000d53702a43f221aaee312fb08fd4d5a
Opcode Fuzzy Hash: 2ccb38690e6aaf115f3138c94c71e4fbb344a9e4605e64161c765321e8b078e6
Instruction Fuzzy Hash: 9EF04931A00304BB8B10EB769C5159EB7ECDB4532571046BBFC14D32A2DA784D048458

Uniqueness

Uniqueness Score: -1.00%

Function 004084D0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004964C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: db4c94cdf382ee3399fd393310c0d3b07f3e4771964ce669c16d021a31866df8
Instruction ID: 1ce02aaae6ec4ade8b295bae84213e8e13784b7c216e354617812bc232f4da8b
Opcode Fuzzy Hash: db4c94cdf382ee3399fd393310c0d3b07f3e4771964ce669c16d021a31866df8
Instruction Fuzzy Hash: 59E0D87170021467D711E95A9C869F7B35CA758314F00427FB949EB3C2EDB8DE4046ED

Uniqueness

Uniqueness Score: -1.00%

Function 00423AF4 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,004240C1,?,00000000,004240CC), ref: 00423B1E

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: f78a68ed826797f4bf69a42243cc74bd686c7ff48922d06499da9bfac42a5011
Instruction ID: 62037174fb3a4e63d39f4d80a9d1e591ad15120c94b51c82d4663250cb3dbf53
Opcode Fuzzy Hash: f78a68ed826797f4bf69a42243cc74bd686c7ff48922d06499da9bfac42a5011
Instruction Fuzzy Hash: A0F0C579205608AFCB40DF9DC588D4AFBE8FB4C260B158295B988CB321C234FE808F94

Uniqueness

Uniqueness Score: -1.00%

Function 0042EEF4 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042EF10

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 526567439b164cf8a1cedbeebbc24c6bfdc41ebf56c0565ee429dfc079ee367e
Instruction ID: 914d3360e1f6a3e7d3a1e305f80b88d129d6a01b97e8a9d2bd08e0dbdb8f1123
Opcode Fuzzy Hash: 526567439b164cf8a1cedbeebbc24c6bfdc41ebf56c0565ee429dfc079ee367e
Instruction Fuzzy Hash: 16D0A77120010C7FCB00DE99D940C6F33AC9B88700BA0C805F508C7205C734EC1087B4

Uniqueness

Uniqueness Score: -1.00%

Function 0046AF80 Relevance: 68.7, APIs: 1, Strings: 38, Instructions: 412
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046AD6C: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,00497154,?,0046B06F,?,00000000,0046B4F7,?,_is1), ref: 0046AD8F

RegCloseKey.ADVAPI32(?,0046B4FE,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046B549,?,?,00000001,00497154), ref: 0046B4F1

Strings

RegisterPreviousData, xrefs: 0046B4A7
HelpLink, xrefs: 0046B355
Inno Setup: User Info: Organization, xrefs: 0046B1CF
Inno Setup: User, xrefs: 0046B0FE
URLUpdateInfo, xrefs: 0046B372
Inno Setup: Selected Components, xrefs: 0046B13C
_is1, xrefs: 0046AFC8
Inno Setup: Icon Group, xrefs: 0046B0C1
Inno Setup: User Info: Name, xrefs: 0046B1BA
Inno Setup: Deselected Components, xrefs: 0046B15B
UninstallString, xrefs: 0046B28A
DisplayVersion, xrefs: 0046B2E1
HelpTelephone, xrefs: 0046B338
URLInfoAbout, xrefs: 0046B31B
Inno Setup: App Path, xrefs: 0046B092
DisplayIcon, xrefs: 0046B250
Publisher, xrefs: 0046B2FE
NoRepair, xrefs: 0046B411
Inno Setup: No Icons, xrefs: 0046B0DF
Inno Setup: Deselected Tasks, xrefs: 0046B1A2
MinorVersion, xrefs: 0046B46E
Contact, xrefs: 0046B3AC
Inno Setup: Setup Version, xrefs: 0046B05D
NoModify, xrefs: 0046B3FD
Inno Setup: Selected Tasks, xrefs: 0046B183
Inno Setup: Setup Type, xrefs: 0046B11D
Comments, xrefs: 0046B3C9
DisplayName, xrefs: 0046B233
" /SILENT, xrefs: 0046B2B7
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046AFC2
5.3.5 (a), xrefs: 0046B062
InstallDate, xrefs: 0046B430
MajorVersion, xrefs: 0046B45C
ModifyPath, xrefs: 0046B3E9
Readme, xrefs: 0046B38F
InstallLocation, xrefs: 0046B0B2
QuietUninstallString, xrefs: 0046B2C4
Inno Setup: User Info: Serial, xrefs: 0046B1E4

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.3.5 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3132538880-4162757603
Opcode ID: bc4f31a0a22ed6b75a83e587c547f7410840a08a3f954a56494266fcb11e0323
Instruction ID: 6b8bd6052d7011f0313b6456d796e8b41d00091cb6ba677f30044cb60bcfab9c
Opcode Fuzzy Hash: bc4f31a0a22ed6b75a83e587c547f7410840a08a3f954a56494266fcb11e0323
Instruction Fuzzy Hash: DBF14374A001099BCB14EB55D8819AEB7B9EB44304F60C07BEC11AB7A5EB7CBD41CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0048CEA0 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000000,0048D395,?,?,?,?,00000000,00000000,00000000), ref: 0048CEE0
FindWindowA.USER32 ref: 0048CF11

Strings

CREATEMUTEX, xrefs: 0048D2C1
SENDBROADCASTNOTIFYMESSAGE, xrefs: 0048D14F
POSTMESSAGE, xrefs: 0048CFBB
POSTBROADCASTMESSAGE, xrefs: 0048D0FB
FREEDLL, xrefs: 0048D28C
OEMTOCHARBUFF, xrefs: 0048D2F3
FINDWINDOWBYWINDOWNAME, xrefs: 0048CF29
REGISTERWINDOWMESSAGE, xrefs: 0048D073
CHARTOOEMBUFF, xrefs: 0048D336
SENDBROADCASTMESSAGE, xrefs: 0048D0AD
CALLDLLPROC, xrefs: 0048D205
FINDWINDOWBYCLASSNAME, xrefs: 0048CEED
SENDMESSAGE, xrefs: 0048CF65
SLEEP, xrefs: 0048CECA
SENDNOTIFYMESSAGE, xrefs: 0048D017
LOADDLL, xrefs: 0048D1A3

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: fcf272993f39ae39fb524659e22902a0f5332a956f5e534cc3d3cc52360d76d7
Instruction ID: b0d844213b24b695988cfb35ecebf8c704e926cd3cc1ee44f2907765548c277e
Opcode Fuzzy Hash: fcf272993f39ae39fb524659e22902a0f5332a956f5e534cc3d3cc52360d76d7
Instruction Fuzzy Hash: 36C161A0B0461067D714BE3E9C4261E569A9F89704B11D93FB406EB7CACE7DDC06439E

Uniqueness

Uniqueness Score: -1.00%

Function 0047E1E8 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0047E1F9
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0047E206
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047E214
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0047E21C
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 0047E228
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 0047E249
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 0047E25C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0047E262
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047E279

Strings

advapi32.dll, xrefs: 0047E257
GetNativeSystemInfo, xrefs: 0047E200
IsWow64Process, xrefs: 0047E216
RegDeleteKeyExA, xrefs: 0047E252
GetSystemWow64DirectoryA, xrefs: 0047E243
kernel32.dll, xrefs: 0047E1F4

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 4e477b3967b851c9eac5dc78f32453af4a94d1867c0ed92fe90c0839294704c9
Instruction ID: 2d47f8cf15d4e27fa0f1176fe36efced94cd1240a4270aaae3bb705869ea135a
Opcode Fuzzy Hash: 4e477b3967b851c9eac5dc78f32453af4a94d1867c0ed92fe90c0839294704c9
Instruction Fuzzy Hash: 6E11B155104741A4DA1073B79D45FEB164C8B09718F188BFB6C8CA62D3D67CC84996BF

Uniqueness

Uniqueness Score: -1.00%

Function 0046F4B0 Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 585
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,00000000,0046FAA9,?,?,?,?,00000000,0046FC03,?,?,00000001), ref: 0046F638
RegCloseKey.ADVAPI32(?,?,00000000,?,00000002,00000000,00000000,0046FAA9,?,?,?,?,00000000,0046FC03,?,?), ref: 0046F641

Part of subcall function 0046F304: GetLastError.KERNEL32(00000000,00000000,00000000,0046F3D8,?,?,00000001,00497154), ref: 0046F391

RegDeleteValueA.ADVAPI32(?,00000000,00000000,0046FA98,?,?,00000000,0046FAA9,?,?,?,?,00000000,0046FC03,?,?), ref: 0046F75F

Part of subcall function 0042DC1C: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC48

Part of subcall function 0046F304: GetLastError.KERNEL32(00000000,00000000,00000000,0046F3D8,?,?,00000001,00497154), ref: 0046F3A7

Strings

Cannot access 64-bit registry keys on this version of Windows, xrefs: 0046F58E
Failed to parse "qword" value, xrefs: 0046F9EB
break, xrefs: 0046F8CF
olddata, xrefs: 0046F862, 0046F8C1
{olddata}, xrefs: 0046F7F7, 0046F88E

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: DeleteErrorLastValue$CloseCreate
String ID: Cannot access 64-bit registry keys on this version of Windows$Failed to parse "qword" value$break$olddata${olddata}
API String ID: 2638610037-3092547568
Opcode ID: 9db23c8cc13e5308f4faf33745cb621f546c7df7267e2e73403dd9afb70e57ea
Instruction ID: 46b4255f78c2f73338f7f4888f5fcbb62f489d65516d599404acd81fcda8c62c
Opcode Fuzzy Hash: 9db23c8cc13e5308f4faf33745cb621f546c7df7267e2e73403dd9afb70e57ea
Instruction Fuzzy Hash: 35322E74E00248AFDB14DFA9D481BDEBBF4AF08304F444066F954AB3A2DB78AD45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00465560 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,0046577A,?,?,00000001,00000000,00000000,00465795,?,00000000,00000000,?), ref: 00465763

Strings

Inno Setup: Deselected Components, xrefs: 004656A4
Inno Setup: Setup Type, xrefs: 00465672
Inno Setup: Selected Tasks, xrefs: 004656CF
Inno Setup: App Path, xrefs: 00465622
Inno Setup: User Info: Serial, xrefs: 00465745
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 004655BF
%s\%s_is1, xrefs: 004655DD
Inno Setup: Icon Group, xrefs: 0046563E
Inno Setup: User Info: Name, xrefs: 0046571F
Inno Setup: Deselected Tasks, xrefs: 004656F1
Inno Setup: Selected Components, xrefs: 00465682
Inno Setup: User Info: Organization, xrefs: 00465732
Inno Setup: No Icons, xrefs: 0046564B

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 94c9d62fb1d7e435db0e42792cab2a1aa0121b794f6c09036552146ff74fe873
Instruction ID: 8cdb4376706b2a9b24b9b35df1ecfc56159c4b319484bfede528e66c14f5fdf6
Opcode Fuzzy Hash: 94c9d62fb1d7e435db0e42792cab2a1aa0121b794f6c09036552146ff74fe873
Instruction Fuzzy Hash: 4951B630A00B04DBCB11EB65D951BDEBBF5EF84304F5084BAE845A7391E738AE05CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0046E8BC Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 319
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0046EA4F
SHChangeNotify.SHELL32 ref: 0046EB46
SHChangeNotify.SHELL32 ref: 0046EB5C
SHChangeNotify.SHELL32 ref: 0046EB81

Strings

{group}\, xrefs: 0046E913
Desktop.ini, xrefs: 0046EC02
.lnk, xrefs: 0046E945
Filename: %s, xrefs: 0046E9F1
.pif, xrefs: 0046E968, 0046EACA
.url, xrefs: 0046E98B
target.lnk, xrefs: 0046EBCB

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 7abe2462af80aab380856dba1a1f84fa715764636b05e62e9a7eb2e252f3fb8a
Instruction ID: 9b3c0a2ebe02865d096d3d92589461d85e8d30d772736a84054ea4ba39fb763a
Opcode Fuzzy Hash: 7abe2462af80aab380856dba1a1f84fa715764636b05e62e9a7eb2e252f3fb8a
Instruction Fuzzy Hash: FBD12274A00249AFDB01DF95D885FDEBBF5AF08314F54402AF900B7392D678AE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004237E4 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F334: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED14,?,004237FF,00423B7C,0041ED14), ref: 0041F352

GetClassInfoA.USER32(00400000,004235EC), ref: 0042380F
RegisterClassA.USER32(00494630), ref: 00423827
GetSystemMetrics.USER32 ref: 00423849
GetSystemMetrics.USER32 ref: 00423858
SetWindowLongA.USER32 ref: 004238B4
SendMessageA.USER32 ref: 004238D5
GetSystemMenu.USER32(004105C0,00000000,004105C0,000000FC,004235FC,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00423B7C), ref: 004238E0
DeleteMenu.USER32(00000000,0000F030,00000000,004105C0,00000000,004105C0,000000FC,004235FC,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 004238EF
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,004105C0,00000000,004105C0,000000FC,004235FC,00000000,00400000,00000000,00000000,00000000), ref: 004238FC
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,004105C0,00000000,004105C0,000000FC,004235FC,00000000,00400000), ref: 00423912

Strings

5B, xrefs: 00423803, 00423884

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: 5B
API String ID: 183575631-3738334870
Opcode ID: b19bb719b7eb1ad709b09f98ca7e3e4fd2a3f6a376e8f9cfc52139108479964a
Instruction ID: 4eea79998965153292ad411f177aff7c9d901da1d54039d3c3496ec011b6d66c
Opcode Fuzzy Hash: b19bb719b7eb1ad709b09f98ca7e3e4fd2a3f6a376e8f9cfc52139108479964a
Instruction Fuzzy Hash: C53161B17402106AEB10AF65EC82F6A36989715709F11017BBA41AF2D7C67DED04876C

Uniqueness

Uniqueness Score: -1.00%

Function 00477ECC Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 00477FCE

Strings

_isetup\_shfoldr.dll, xrefs: 00477EFE
Failed to load DLL "%s", xrefs: 00477FB1
Failed to get address of SHGetFolderPath function, xrefs: 00477FDF
shfolder.dll, xrefs: 00477F31, 00477F6A
Failed to get version numbers of _shfoldr.dll, xrefs: 00477F24
SHFOLDERDLL, xrefs: 00477F0B
shell32.dll, xrefs: 00477F79
] I, xrefs: 00477F15, 00477F5A, 00477F42, 00477F4A
SHGetFolderPathA, xrefs: 00477FC3

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$] I$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-953201679
Opcode ID: 3a61dcf9b9bd17d64e1f1d53dccfc62cf8d1677eca963567b862213e4dcef6d3
Instruction ID: be8cea5b208f70f3497dc675e9b67cc11d28b3b7ca4846f22d5268085fe32373
Opcode Fuzzy Hash: 3a61dcf9b9bd17d64e1f1d53dccfc62cf8d1677eca963567b862213e4dcef6d3
Instruction Fuzzy Hash: D5312530A04249DBCB00EB95D9859DEB7B4EB54308F51C87BE508E7351DB789E08CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00454C98 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32 ref: 00454E69
756FE550.OLE32(00494A58,00000000,00000001,00494774,?,00000000,00454F64), ref: 00454CDA

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32 ref: 00403CE9

756FE550.OLE32(00494764,00000000,00000001,00494774,?,00000000,00454F64), ref: 00454D00

Strings

IPersistFile::Save, xrefs: 00454EEB
IShellLink::QueryInterface, xrefs: 00454E8D
IPropertyStore::SetValue, xrefs: 00454DE9, 00454E35
IPropertyStore::Commit, xrefs: 00454E4E
CoCreateInstance, xrefs: 00454D0B

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: E550String$AllocByteCharFreeMultiWide
String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue$IShellLink::QueryInterface
API String ID: 2757340368-2052886881
Opcode ID: 5948eefd91c64643e410a8502d34ef97e64b0715af901c2b07599baa63df0646
Instruction ID: 0b21da03975bca805d8248ee8d2b37e628922fffcf98328ca7261b0fae796446
Opcode Fuzzy Hash: 5948eefd91c64643e410a8502d34ef97e64b0715af901c2b07599baa63df0646
Instruction Fuzzy Hash: AA915071A00104AFDB50DFA9C885F9E77F8AF89709F50406AF904EB262DB78DD48CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00477BA0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00477D13,?,?,00000000,00496628,00000000,00000000,?,00492BF5,00000000,00492D9E,?,00000000), ref: 00477C33
GetLastError.KERNEL32(00000000,00000000,00000000,00477D13,?,?,00000000,00496628,00000000,00000000,?,00492BF5,00000000,00492D9E,?,00000000), ref: 00477C3C

Strings

\_setup64.tmp, xrefs: 00477CCB
REGDLL_EXE, xrefs: 00477CB0
_isetup, xrefs: 00477C1E
o1I, xrefs: 00477C47, 00477C54
Created temporary directory: , xrefs: 00477BD5
\_RegDLL.tmp, xrefs: 00477CA0
e1I, xrefs: 00477CF8, 00477C6A, 00477C74

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $REGDLL_EXE$\_RegDLL.tmp$\_setup64.tmp$_isetup$e1I$o1I
API String ID: 1375471231-477672290
Opcode ID: 4c75ab1de06e94221e890cf111cb2a76886db217d149b9edc6180f5924f9a91e
Instruction ID: 656792ce42a3b8ee986284f240f9f7d4df8ffa0b35947b5a09b08d7327d2a589
Opcode Fuzzy Hash: 4c75ab1de06e94221e890cf111cb2a76886db217d149b9edc6180f5924f9a91e
Instruction Fuzzy Hash: 89412674A042099FCB11EF95D882ADEB7B5EF48309F50857BE81477392D738AE05CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042EF34 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32(00000000,0042F043,?,?,?,00000001,00000000,?,00456ACA,00000000,00496628), ref: 0042EF63
GetFocus.USER32(00000000,0042F043,?,?,?,00000001,00000000,?,00456ACA,00000000,00496628), ref: 0042EF6B
RegisterClassA.USER32(004947AC), ref: 0042EF8C
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F060,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042EFCA
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F010
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F021
SetFocus.USER32(00000000,00000000,0042F043,?,?,?,00000001,00000000,?,00456ACA,00000000,00496628), ref: 0042F028

Strings

TWindowDisabler-Window, xrefs: 0042EFC3, 0042F009
(fI, xrefs: 0042F03A, 0042EFF3, 0042F000

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: (fI$TWindowDisabler-Window
API String ID: 3167913817-2792019125
Opcode ID: 8c16546f9a585749c763ac640097901552d234e7c9639c2d0d67cc4ae301c64c
Instruction ID: 77e24118650528b8c543fe6d0d23e90f8f7024fb04e3d66e63b834f41b798fd0
Opcode Fuzzy Hash: 8c16546f9a585749c763ac640097901552d234e7c9639c2d0d67cc4ae301c64c
Instruction Fuzzy Hash: 35219571740710BAE220EF62DD02F1A76A4EB05B04FA2453BF604BB2D2D7BC6D54C6AD

Uniqueness

Uniqueness Score: -1.00%

Function 00401A90 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(00496420), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32 ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(00496420), ref: 00401B62

Strings

|dI, xrefs: 00401B11
@dI, xrefs: 00401ADB, 00401AF5, 00401AFD
PdI, xrefs: 00401B07

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: @dI$PdI$|dI
API String ID: 3782394904-4088903152
Opcode ID: d7983087b8bcbabcafc2c9d8a305f4a93e6fa46b606c4ef3e584c6169f95cf8d
Instruction ID: bf2c7a4256457c5f50c71aa29f18f829c6f6e2c919ab822836d088e606c14c70
Opcode Fuzzy Hash: d7983087b8bcbabcafc2c9d8a305f4a93e6fa46b606c4ef3e584c6169f95cf8d
Instruction Fuzzy Hash: 5D118F30A403405EEB15ABE99D82F263BE59761B4CF56407BF80067AF1D77C9850C76E

Uniqueness

Uniqueness Score: -1.00%

Function 0047C34C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 170windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 0047C4F4
FreeLibrary.KERNEL32(00000000), ref: 0047C508
SendNotifyMessageA.USER32(000104C2,00000496,00002710,00000000), ref: 0047C57A

Strings

Deinitializing Setup., xrefs: 0047C36A
GetCustomSetupExitCode, xrefs: 0047C3A9
Not restarting Windows because Setup is being run from the debugger., xrefs: 0047C529
Restarting Windows., xrefs: 0047C555
DeinitializeSetup, xrefs: 0047C405

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 76278f9214a12ce10e81877f2a34cfd83f08e22d6e0336a8a950cfc38c124afa
Instruction ID: 90f5f2579ebd2cd042589c700d0c35de107af6cb7106057c8f5cc839c7e64824
Opcode Fuzzy Hash: 76278f9214a12ce10e81877f2a34cfd83f08e22d6e0336a8a950cfc38c124afa
Instruction Fuzzy Hash: 5851B130614200AFD721DB79DC95BAA7BE4EB59314F50C57BEC08C72A2DB38A845CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00451DF8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451E91,?,?,?,?,00000000,?,00493224), ref: 00451E18
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451E1E
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451E91,?,?,?,?,00000000,?,00493224), ref: 00451E32
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451E38

Strings

Wow64RevertWow64FsRedirection, xrefs: 00451E28
Wow64DisableWow64FsRedirection, xrefs: 00451E0E
shell32.dll, xrefs: 00451E64
kernel32.dll, xrefs: 00451E13, 00451E2D

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: b69695f4757dcfd3a81ec6ab30e1db3e18e2299280acd1b52451f71d5d608202
Instruction ID: bff3e1d123b44789eb661b74cfa9bb81be17ee1d1842bcd010c9e5766072ccdb
Opcode Fuzzy Hash: b69695f4757dcfd3a81ec6ab30e1db3e18e2299280acd1b52451f71d5d608202
Instruction Fuzzy Hash: E4018470200744AED701AB62AC03B6B3A98D754B5AF91447BFC04A61A3D7BC5D089E2D

Uniqueness

Uniqueness Score: -1.00%

Function 0046E048 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 263fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0046E219,?,00000000,?,00000001,00000000,0046E3E7,?,00000000,?,00000000,?,0046E5A2), ref: 0046E1F5
FindClose.KERNEL32(000000FF,0046E220,0046E219,?,00000000,?,00000001,00000000,0046E3E7,?,00000000,?,00000000,?,0046E5A2,?), ref: 0046E213
FindNextFileA.KERNEL32(000000FF,?,00000000,0046E33B,?,00000000,?,00000001,00000000,0046E3E7,?,00000000,?,00000000,?,0046E5A2), ref: 0046E317
FindClose.KERNEL32(000000FF,0046E342,0046E33B,?,00000000,?,00000001,00000000,0046E3E7,?,00000000,?,00000000,?,0046E5A2,?), ref: 0046E335

Strings

sF, xrefs: 0046E08E, 0046E0A5
sF, xrefs: 0046E29F, 0046E2A2
IF, xrefs: 0046E3D9, 0046E357, 0046E381, 0046E38F, 0046E3A7, 0046E36E, 0046E121, 0046E1C4, 0046E15C, 0046E173, 0046E181, 0046E138, 0046E141, 0046E1C7

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: IF$sF$sF
API String ID: 2066263336-2713198477
Opcode ID: f0e40a4e00950c07559632bc7aaecbd792cf4997354c2d9bde7e00a015f43da5
Instruction ID: 1230aeaf309185c7ec03d96dbdc6ad6414d2784c2265a1c5d62d22ef3a6f047c
Opcode Fuzzy Hash: f0e40a4e00950c07559632bc7aaecbd792cf4997354c2d9bde7e00a015f43da5
Instruction Fuzzy Hash: 51B13D3490425D9FCF11DFA6C881ADEBBF9BF49304F5081AAE808A7391D7389A46CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00430314 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32 ref: 0043031C
RegisterClipboardFormatA.USER32 ref: 0043032B
GetCurrentThreadId.KERNEL32 ref: 00430345
GlobalAddAtomA.KERNEL32(00000000), ref: 00430366

Strings

commdlg_help, xrefs: 00430317
commdlg_FindReplace, xrefs: 00430326
WndProcPtr%.8X%.8X, xrefs: 00430357

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: d957c5322606f91c3a63daffd078634db936568746c689a8806e8aa63a5fc16b
Instruction ID: 0713c644b5c0c2c8d9555e19a872e1a2a1cf9f6f22ed51b2a28eccd68185566a
Opcode Fuzzy Hash: d957c5322606f91c3a63daffd078634db936568746c689a8806e8aa63a5fc16b
Instruction Fuzzy Hash: 9CF082704483808BD700EB75C842B197AE0EB98708F01467FB898A62E1D77A8500CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 00453A04 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00000080,COMMAND.COM" /C ,?,00453C20,00453C20,00000031,00453C20,00000000), ref: 00453BAC
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00000080,COMMAND.COM" /C ,?,00453C20,00453C20,00000031,00453C20), ref: 00453BB9

Part of subcall function 00453970: WaitForInputIdle.USER32 ref: 0045399C
Part of subcall function 00453970: MsgWaitForMultipleObjects.USER32 ref: 004539BE
Part of subcall function 00453970: GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 004539CD
Part of subcall function 00453970: CloseHandle.KERNEL32(00000001,004539FA,004539F3,?,00000031,00000080,00000000,?,?,00453D4B,00000080,0000003C,00000000,00453D61), ref: 004539ED

Strings

.bat, xrefs: 00453A94
cmd.exe" /C ", xrefs: 00453AE1
.cmd, xrefs: 00453AAF
D, xrefs: 00453B4C
COMMAND.COM" /C , xrefs: 00453B18

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 4e7ec2e2260c078c3b4aff6861c530735bb05ea7ef14efc6dabd21ae76f048df
Instruction ID: 0d4c244814a61e6a9f40f8d6579175ec88b371b5f0bc4768c512e06936e56e52
Opcode Fuzzy Hash: 4e7ec2e2260c078c3b4aff6861c530735bb05ea7ef14efc6dabd21ae76f048df
Instruction Fuzzy Hash: 0D51767460035DABCB01EFA5C842B9EBBB9AF44346F50443BB844B7283D7789F098B58

Uniqueness

Uniqueness Score: -1.00%

Function 004235FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042368C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 004236B9
OemToCharA.USER32(?,?), ref: 004236CC
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 0042370C

Strings

MAINICON, xrefs: 00423681
2, xrefs: 0042365A

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: b8e4f3de8f6e7962c855b1bbff0a6ea575b20ad32e9f870a500b7efad52da8d9
Instruction ID: d7f5d394b2ec06d520cb0a4b60bf3498b9d8aa77ab50e693133e7ce4a757069a
Opcode Fuzzy Hash: b8e4f3de8f6e7962c855b1bbff0a6ea575b20ad32e9f870a500b7efad52da8d9
Instruction Fuzzy Hash: DC31A2B0A042559ADF10EF29D8C57C67BE8AF14308F4441BAE844DB393D7BED988CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00418EA8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418EAD
GlobalAddAtomA.KERNEL32(00000000), ref: 00418ECE
GetCurrentThreadId.KERNEL32 ref: 00418EE9
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F0A

Part of subcall function 00423038: 73A1A570.USER32(00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 0042308E
Part of subcall function 00423038: EnumFontsA.GDI32(00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 004230A1
Part of subcall function 00423038: 73A24620.GDI32(00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230A9
Part of subcall function 00423038: 73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230B4

Part of subcall function 004235FC: LoadIconA.USER32(00400000,MAINICON), ref: 0042368C
Part of subcall function 004235FC: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 004236B9
Part of subcall function 004235FC: OemToCharA.USER32(?,?), ref: 004236CC
Part of subcall function 004235FC: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 0042370C

Part of subcall function 0041F088: GetVersion.KERNEL32(?,00418F60,00000000,?,?,?,00000001), ref: 0041F096
Part of subcall function 0041F088: SetErrorMode.KERNEL32(00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0B2
Part of subcall function 0041F088: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0BE
Part of subcall function 0041F088: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0CC
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F0FC
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F125
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F13A
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F14F
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F164
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F179
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F18E
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F1A3
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F1B8
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F1CD

Strings

Delphi%.8X, xrefs: 00418EBF
ControlOfs%.8X%.8X, xrefs: 00418EFB

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$A24620A480A570EnumFileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 3864787166-2767913252
Opcode ID: 1c5da02b922e4aac06326fd948070b9cb60db65944391413fb0283cc291dbe50
Instruction ID: b4a2cca2d4326696562d23f03e9beb5cdbbc64ba536a620a3ee3ba5bc66bdef7
Opcode Fuzzy Hash: 1c5da02b922e4aac06326fd948070b9cb60db65944391413fb0283cc291dbe50
Instruction Fuzzy Hash: 9A1160B06142409AC700FF2A984274A7AE0EB64309F41843FF448DB2A1DB3D9945CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004135AC Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32 ref: 004135D4
GetWindowLongA.USER32(?,000000F0), ref: 004135DF
GetWindowLongA.USER32(?,000000F4), ref: 004135F1
SetWindowLongA.USER32 ref: 00413604
SetPropA.USER32(?,00000000,00000000), ref: 0041361B
SetPropA.USER32(?,00000000,00000000), ref: 00413632

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 86a15e674b3ea48860a72e4751bd866d9c55aec508b8b4782c27e449c12c4e66
Instruction ID: 44bb5ba5a57c54889193f85f1a8a28b74f903b4ef320443ee5f093ebf11223bc
Opcode Fuzzy Hash: 86a15e674b3ea48860a72e4751bd866d9c55aec508b8b4782c27e449c12c4e66
Instruction Fuzzy Hash: B611C975500244BFDB00DF99DC85E9A3BE8BB19364F114266B928DB2A1D738D9908B68

Uniqueness

Uniqueness Score: -1.00%

Function 004540C4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045425B,?,00000000,0045429B), ref: 004541A1

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00454124
PendingFileRenameOperations, xrefs: 00454140
WININIT.INI, xrefs: 004541D0
PendingFileRenameOperations2, xrefs: 00454170

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 3b606e1cfbb150bd088f74f1063c905db1383d3fd6ed35e0c09aba21d543f6f9
Instruction ID: 8ceaccac1fe58e6261fec66e20af0929b63452d54162f6f6a325dab65676f0d5
Opcode Fuzzy Hash: 3b606e1cfbb150bd088f74f1063c905db1383d3fd6ed35e0c09aba21d543f6f9
Instruction Fuzzy Hash: 0051BA30E001189FDB10DF62DC519DEB7B9EFC4348F5085B7F814AB292DB78AA85CA58

Uniqueness

Uniqueness Score: -1.00%

Function 004639E8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00463A85
ExtractIconA.SHELL32 ref: 00463AAB

Part of subcall function 00463928: DrawIconEx.USER32 ref: 004639C0
Part of subcall function 00463928: DestroyCursor.USER32(00000000), ref: 004639D6

SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00463B07
ExtractIconA.SHELL32 ref: 00463B2D

Strings

c:\directory, xrefs: 00463A80

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Icon$ExtractFileInfo$CursorDestroyDraw
String ID: c:\directory
API String ID: 2926980410-3984940477
Opcode ID: 1a7901e35b7efb8855ed844898b1e62419ded63c9a28a762335ba207438abc47
Instruction ID: 671f662d79a6b5497fd1efd513546b718c4d5ac7f56db0c83477fb4c85f01fd4
Opcode Fuzzy Hash: 1a7901e35b7efb8855ed844898b1e62419ded63c9a28a762335ba207438abc47
Instruction Fuzzy Hash: 5C417F70640288AFD711DF55DC8AFDEBBE8EB48705F1040A6F904DB382D679EE808B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32 ref: 0042DC88
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DE0B,00000000,0042DE23,?,?,?,?,00000006,?,00000000,00491FBA), ref: 0042DCA3
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DCA9

Strings

RegDeleteKeyExA, xrefs: 0042DC99
advapi32.dll, xrefs: 0042DC9E

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: 1ac9f45d9403d68368f5ea09b308c2771ffc131f1d77a79e4eddddbac772e20e
Instruction ID: 479eeeb2458f1cbf9b477f45b3eef1c6296245770f751ec8fb172f928072974a
Opcode Fuzzy Hash: 1ac9f45d9403d68368f5ea09b308c2771ffc131f1d77a79e4eddddbac772e20e
Instruction Fuzzy Hash: 57E06DF0B45230AAD620676B7D4AFA327299B64725F54403BB105A619182FD4C40DE5C

Uniqueness

Uniqueness Score: -1.00%

Function 0047D994 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,0047DCA9,?,?,00000001,?), ref: 0047DAA5
SHChangeNotify.SHELL32 ref: 0047DB1A

Strings

Need to restart Windows? %s, xrefs: 0047DB57
, xrefs: 0047DBD7

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 3e22ee14f3f5d1664d53e548fd637f0a900ad5636ab224251b622ae2201e353e
Instruction ID: 90cd12f1ce5866ea51d49213f29bb353ee2a99eceb2f679e27348fc142a0b483
Opcode Fuzzy Hash: 3e22ee14f3f5d1664d53e548fd637f0a900ad5636ab224251b622ae2201e353e
Instruction Fuzzy Hash: FD91B170A142448FCB11EB69D882B9E77F1AF55308F5080BBE8049B366DB78AD09DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0046B8B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

GetLastError.KERNEL32(00000000,0046BAB1,?,?,00000001,00497154), ref: 0046B98E
SHChangeNotify.SHELL32 ref: 0046BA08
SHChangeNotify.SHELL32 ref: 0046BA2D

Strings

Creating directory: %s, xrefs: 0046B976

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: 4dce9c22cd4e8b8aa9e38bfb5329b7ba90ac70ab5a42e95a57bf943196cca827
Instruction ID: 7ea54ca36873d6337a8b148a308a739efa0342075aaa82460d6101fa077cad05
Opcode Fuzzy Hash: 4dce9c22cd4e8b8aa9e38bfb5329b7ba90ac70ab5a42e95a57bf943196cca827
Instruction Fuzzy Hash: 40512F74E00258ABDB01DFE5C482BDEB7F5EF48304F50856AE851A7382D7785E44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004537C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00453876
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,0045393C), ref: 004538E0

Strings

sfc.dll, xrefs: 00453838
SfcIsFileProtected, xrefs: 00453870

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: 9e3a1317458504cf0b4866f9773363e1e3fe743d4d1484e92b4ef5958820482c
Instruction ID: 8896df26e74b4f53e6f77957fc07a02fe6ad1856ac683947f167e21e68caa71d
Opcode Fuzzy Hash: 9e3a1317458504cf0b4866f9773363e1e3fe743d4d1484e92b4ef5958820482c
Instruction Fuzzy Hash: 9D4167B0A042189FEB10DF55DC85B9D77B8AB04346F5041BBB908A7293D7785F48CE5C

Uniqueness

Uniqueness Score: -1.00%

Function 0045262C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0045271B,?,?,00000000,00496628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00452672
GetLastError.KERNEL32(00000000,00000000,?,00000000,0045271B,?,?,00000000,00496628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045267B

Strings

o1I, xrefs: 00452700, 004526B1, 004526BB
.tmp, xrefs: 0045265B

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp$o1I
API String ID: 1375471231-2043145612
Opcode ID: 6263e7da38dc712251df72676f2ee857ab2003e645070e4b394e34e858e0385a
Instruction ID: 89aaa5dd644a1bfb9c6e4ab11305a67587a6d25824e33790291d603b6c08dcc0
Opcode Fuzzy Hash: 6263e7da38dc712251df72676f2ee857ab2003e645070e4b394e34e858e0385a
Instruction Fuzzy Hash: 14216575A002089BDB01EFA1C9929DFB7B8EF58305F50457BEC01B7342DA7CAE058AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00451118 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,] I), ref: 00451138
74D41500.VERSION(00000000,?,00000000,?,00000000,004511B3,?,00000000,?,?,?,] I), ref: 00451165
74D41540.VERSION(?,004511DC,?,?,00000000,?,00000000,?,00000000,004511B3,?,00000000,?,?,?,] I), ref: 0045117F

Strings

] I, xrefs: 0045111E

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: D41500D41520D41540
String ID: ] I
API String ID: 2153611984-27375975
Opcode ID: ae97c8c8a0c1eba3379072f8b46b7e7df9da348ac85090545a8034cef28368fb
Instruction ID: c2ad28a97d73236a39d00b1522cfa6caf261f6f5eba90309d69346832355d152
Opcode Fuzzy Hash: ae97c8c8a0c1eba3379072f8b46b7e7df9da348ac85090545a8034cef28368fb
Instruction Fuzzy Hash: 5D219235A00508AFDB01DAA98C41EBFB7FCEB49340F5544BAFD00E3392D6799E058769

Uniqueness

Uniqueness Score: -1.00%

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Runtime error at 00000000, xrefs: 00404DBE, 00404DD1
Error, xrefs: 00404DB9

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 8c8c0f2434a4a7f5450b7d1f87c82a5e4d49965682bc3ad0c70a84493f0d02f9
Instruction ID: 7ca15834b35bf0f9f7e67f0c6f6a322a9a8b6c98d325c36795369cb21074e1e4
Opcode Fuzzy Hash: 8c8c0f2434a4a7f5450b7d1f87c82a5e4d49965682bc3ad0c70a84493f0d02f9
Instruction Fuzzy Hash: 9221B360A442418ADB11E7B9ECC1B163F919BE5348F06817BE700B73E6C67C884587AE

Uniqueness

Uniqueness Score: -1.00%

Function 004543FC Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,00454467,?,00000001,00000000), ref: 0045445A

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00454408
PendingFileRenameOperations, xrefs: 0045442C
PendingFileRenameOperations2, xrefs: 0045443B

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 4d74768cc722451e6c2d7b21cab6517138d2d42bcabe4ec3ebcd03ef8cae5871
Instruction ID: f6b2750a9208994f71abef58e55a78fed862e8850860690132b194e4ac46e676
Opcode Fuzzy Hash: 4d74768cc722451e6c2d7b21cab6517138d2d42bcabe4ec3ebcd03ef8cae5871
Instruction Fuzzy Hash: C0F062313442046FDB04D6A6EC12B5B73ADD7C5B19FA0446AFC009A682DA79AD48D51C

Uniqueness

Uniqueness Score: -1.00%

Function 004211E4 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 004212D1
SetMenu.USER32(00000000,00000000), ref: 004212EE
SetMenu.USER32(00000000,00000000), ref: 00421323
SetMenu.USER32(00000000,00000000), ref: 0042133F

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 828adb1f4503573b8b19ec7e50c880e5d7ba93b5c851f867c46ca8f401a21855
Instruction ID: 658f50d7c39b10a4f0c402205ec9e9078e39c2738942e4c3e39302bb3a71e335
Opcode Fuzzy Hash: 828adb1f4503573b8b19ec7e50c880e5d7ba93b5c851f867c46ca8f401a21855
Instruction Fuzzy Hash: 7641BE307002645BEB20AA7AA88579B37914F65308F4845BFFC44EF3A7CA7DCC4582AD

Uniqueness

Uniqueness Score: -1.00%

Function 00416AB2 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00416AF4
SetTextColor.GDI32(?,00000000), ref: 00416B0E
SetBkColor.GDI32(?,00000000), ref: 00416B28
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416B50

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: b1cc4a46ad263673a5081daebee7b86d87a0b554ca28d8db599fbe3b7c371493
Instruction ID: c000e8b01db0500dd6874d208778bcf8efa3d9016d5589f965051e8255cd057a
Opcode Fuzzy Hash: b1cc4a46ad263673a5081daebee7b86d87a0b554ca28d8db599fbe3b7c371493
Instruction Fuzzy Hash: 74115EB2604604AFC710EE6ECC84E8777ECEF49710B15886BB55ADB652C638FC418B79

Uniqueness

Uniqueness Score: -1.00%

Function 004239F4 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(0042398C), ref: 00423A18
GetWindow.USER32(?,00000003), ref: 00423A2D
GetWindowLongA.USER32(?,000000EC), ref: 00423A3C
SetWindowPos.USER32(00000000,004240CC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042411B,?,?,00423CE3), ref: 00423A72

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: b2f5db6fe163c30d8c8c0473a117728a579ec2d7ead3c741ce22ac317b482cf1
Instruction ID: 335c349655b4e4ce664b27c97d7ab575fba50449cb033fde685ace27ceb71c75
Opcode Fuzzy Hash: b2f5db6fe163c30d8c8c0473a117728a579ec2d7ead3c741ce22ac317b482cf1
Instruction Fuzzy Hash: 91115A70700610ABDB10EF68DC85F5A77E8EB08725F11026AF9A4AB2E2C37CDC40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00423038 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 0042308E
EnumFontsA.GDI32(00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 004230A1
73A24620.GDI32(00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230A9
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230B4

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: A24620A480A570EnumFonts
String ID:
API String ID: 2630238358-0
Opcode ID: 0130a543140e80f2b9f86b8e83a342749db33d5760528b3305e50fe7c2cc1c24
Instruction ID: 4d68480f6d607538855b0f171b38ffa839f5ce6e0578d669e72114bdc8101102
Opcode Fuzzy Hash: 0130a543140e80f2b9f86b8e83a342749db33d5760528b3305e50fe7c2cc1c24
Instruction Fuzzy Hash: 0601D2616053002AE700BF6A5C82B9B37649F00709F40027BF804AF2C7D6BE9805476E

Uniqueness

Uniqueness Score: -1.00%

Function 00453970 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32 ref: 0045399C
MsgWaitForMultipleObjects.USER32 ref: 004539BE
GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 004539CD
CloseHandle.KERNEL32(00000001,004539FA,004539F3,?,00000031,00000080,00000000,?,?,00453D4B,00000080,0000003C,00000000,00453D61), ref: 004539ED

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: d73ba6bc89f5e98173ec20bdde4f08e8ee51d8155801d5fd2e19193da69aa3ab
Instruction ID: f26be41c5c034272f157e269139ed2410fa661b94adc91c278c581610335523b
Opcode Fuzzy Hash: d73ba6bc89f5e98173ec20bdde4f08e8ee51d8155801d5fd2e19193da69aa3ab
Instruction Fuzzy Hash: 3301F9F06006087EEB219B998C06F6BBB9CDB457A1F600167F904D32C2C5F89E00CA69

Uniqueness

Uniqueness Score: -1.00%

Function 00477DA0 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00477DC1
GetLastError.KERNEL32 ref: 00477DCB
GetTickCount.KERNEL32 ref: 00477DD5
Sleep.KERNEL32(00000032), ref: 00477DE5

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 992abed508f8a0049c86747ab3f386f6750e58d5c846670dd06b9ae3b8dfdd1c
Instruction ID: 455298f4415a448e3fa874f92f6781e0756abc36bce73f1148afe723a625cd3c
Opcode Fuzzy Hash: 992abed508f8a0049c86747ab3f386f6750e58d5c846670dd06b9ae3b8dfdd1c
Instruction Fuzzy Hash: C3E06D7230DA4446DA3635BF2C866FB4AACCFC6364B28553FE08DD6282C8984C06956A

Uniqueness

Uniqueness Score: -1.00%

Function 0045A940 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00450088: SetEndOfFile.KERNEL32(?,?,0045AA1E,00000000,0045ABA9,?,00000000,00000002,00000002), ref: 0045008F

FlushFileBuffers.KERNEL32(?), ref: 0045AB75

Strings

NumRecs range exceeded, xrefs: 0045AA72
EndOffset range exceeded, xrefs: 0045AAA9

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 9af2f4d271ce0e0e904a3aa6f378da5fefc62b70fb08d87fb5636183414ecdba
Instruction ID: 49fd1ead36e8c92626c0d22f3e04e342ae71ee3369d077df08b87a69a2b16800
Opcode Fuzzy Hash: 9af2f4d271ce0e0e904a3aa6f378da5fefc62b70fb08d87fb5636183414ecdba
Instruction Fuzzy Hash: 68617334A002588FDB24DF25C881BDAB7B5EF49305F0085EAED889B352D674AEC9CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004931D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,004931DE), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,004931DE), ref: 00403356

Part of subcall function 00409AE8: 6F541CD0.COMCTL32(004931ED), ref: 00409AE8

Part of subcall function 004108C4: GetCurrentThreadId.KERNEL32 ref: 00410912

Part of subcall function 00418FB0: GetVersion.KERNEL32(00493201), ref: 00418FB0

Part of subcall function 0044F178: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00493215), ref: 0044F1B3
Part of subcall function 0044F178: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F1B9

Part of subcall function 0044F55C: GetVersionExA.KERNEL32(00496780,0049321A), ref: 0044F56B

Part of subcall function 00451DF8: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451E91,?,?,?,?,00000000,?,00493224), ref: 00451E18
Part of subcall function 00451DF8: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451E1E
Part of subcall function 00451DF8: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451E91,?,?,?,?,00000000,?,00493224), ref: 00451E32
Part of subcall function 00451DF8: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451E38

Part of subcall function 00460EAC: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00493238), ref: 00460EBB
Part of subcall function 00460EAC: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00460EC1

Part of subcall function 00468C50: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 00468C65

Part of subcall function 00474088: GetModuleHandleA.KERNEL32(kernel32.dll,?,00493242), ref: 0047408E
Part of subcall function 00474088: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 0047409B
Part of subcall function 00474088: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 004740AB

Part of subcall function 00490338: RegisterClipboardFormatA.USER32 ref: 00490351

SetErrorMode.KERNEL32(00000001,00000000,0049328A), ref: 0049325C

Part of subcall function 00492FE0: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00493266,00000001,00000000,0049328A), ref: 00492FEA
Part of subcall function 00492FE0: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00492FF0

Part of subcall function 00424444: SendMessageA.USER32 ref: 00424463

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

ShowWindow.USER32(?,00000005,00000000,0049328A), ref: 004932CD

Part of subcall function 0047D0AC: SetActiveWindow.USER32(?), ref: 0047D150

Strings

Setup, xrefs: 004932B3

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF541FormatLibraryLineLoadMessageModeRegisterSendShowTextThread
String ID: Setup
API String ID: 1894428048-3839654196
Opcode ID: fee832f36ce975679e260f9b0954113cf3741595f260ce40ded7ca7ebb5c54dd
Instruction ID: 779a321fc15f42447a8f0963ad68d9f2a93317841f7d3acf2e890d1de8ee30c9
Opcode Fuzzy Hash: fee832f36ce975679e260f9b0954113cf3741595f260ce40ded7ca7ebb5c54dd
Instruction Fuzzy Hash: 0531A3312146409FDB11BBB7AC1351D3BA4EB8A71DBA2447FF804C2653CE3D5C548A6E

Uniqueness

Uniqueness Score: -1.00%

Function 004513F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32 ref: 00451444
GetLastError.KERNEL32(00000000,00000000,?,?,dE,00000000,004564D0,?,?,?,00000000,0045146A,?,?,?,00000001), ref: 0045144C

Strings

dE, xrefs: 00451436, 00451439

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID: dE
API String ID: 2919029540-3809906464
Opcode ID: 593608dd5432025e5c10579cc54da45850a235723a39842afc18d8064d6d1a21
Instruction ID: 6a74b67a3bdf66ca54efcfc0657381ecd904da166113fafb2436bbcb0ae12e28
Opcode Fuzzy Hash: 593608dd5432025e5c10579cc54da45850a235723a39842afc18d8064d6d1a21
Instruction Fuzzy Hash: E1117972600208AF8B00DEA9DC41EDFB7ECEB4D310B114566FD18D3212D638AD15CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004776B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,00477936,00000000,0047794C,?,?,?,?,00000000), ref: 00477712

Strings

RegisteredOrganization, xrefs: 00477701
RegisteredOwner, xrefs: 004776EF

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 5da0313d24de2a72906f0e02df73607d497778b3bd604c1f31dadd7d7b78e1f2
Instruction ID: 44da9ba76ca96eafcd406259b3cb4b8fe95da4c4325a64976e48815ca65e7baf
Opcode Fuzzy Hash: 5da0313d24de2a72906f0e02df73607d497778b3bd604c1f31dadd7d7b78e1f2
Instruction Fuzzy Hash: 94F0593470C244AFDB04D6A5EC52BAB3B9AD740308FA4807BA544CB391C67CBD05D74C

Uniqueness

Uniqueness Score: -1.00%

Function 004231AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 004231B9
LoadCursorA.USER32(00000000,00000000), ref: 004231E3

Strings

EI, xrefs: 004231C6

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CursorLoad
String ID: EI
API String ID: 3238433803-1715459816
Opcode ID: cf7d116e50ce189f5790faa080c989bb411d79830bfeb1cde74da96b9f6355ff
Instruction ID: e763212e35d88e91f52bf3e5ce882ef76e84b1945e438db40d164ba05c470673
Opcode Fuzzy Hash: cf7d116e50ce189f5790faa080c989bb411d79830bfeb1cde74da96b9f6355ff
Instruction Fuzzy Hash: 1DF0A7117001145BD620593E6CC1D3A72688F87736B61033BFE2AD72D1C62E2D51426D

Uniqueness

Uniqueness Score: -1.00%

Function 00470F48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047117F), ref: 00470F6D
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047117F), ref: 00470F84

Part of subcall function 004520A4: GetLastError.KERNEL32(00000000,00452B15,00000005,00000000,00452B4A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00492A61,00000000), ref: 004520A7

Strings

CreateFile, xrefs: 00470F79

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 7d7f0adbb495ba2e141194a5ba8799ea20fff4202c1297b42232a8d62608c13e
Instruction ID: 4dce3a0fb710f8058c99a71000b1262451dde5c1e1bb000cefd451e94b844243
Opcode Fuzzy Hash: 7d7f0adbb495ba2e141194a5ba8799ea20fff4202c1297b42232a8d62608c13e
Instruction Fuzzy Hash: C4E06D74341304BFEA20E669DCC6F4977889B04728F108152FA48AF3E2C6F9EC408658

Uniqueness

Uniqueness Score: -1.00%

Function 0046ADDC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,TqI,00000004,00000001,?,0046B40F,?,?,00000000,0046B4F7,?,_is1,?), ref: 0046ADEF

Strings

TqI, xrefs: 0046ADE5, 0046ADE8
NoModify, xrefs: 0046ADED

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Value
String ID: NoModify$TqI
API String ID: 3702945584-2484388882
Opcode ID: f5a2910f86b5d4890aa6fcbcf0034d47aef96215c39c1bb137200c97013dc63d
Instruction ID: 388a847686ab158aae351853834ee3a19678c554c0d9cb8fd514d48c61279f2c
Opcode Fuzzy Hash: f5a2910f86b5d4890aa6fcbcf0034d47aef96215c39c1bb137200c97013dc63d
Instruction Fuzzy Hash: F4E04FB0640704BFEB04DB55CD4AF6B77ACDB48714F104059BA08EB281E674FE10CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC54 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

Strings

OG, xrefs: 0042DC6A, 0042DC6D
System\CurrentControlSet\Control\Windows, xrefs: 0042DC6E

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Open
String ID: OG$System\CurrentControlSet\Control\Windows
API String ID: 71445658-2870956291
Opcode ID: cac79e148e5d1637301d0cd401e0a8768c8b40d51dfb76d9d00be79e5a4099f3
Instruction ID: fabb803f5ff523eeab3b7a035bb747b9213277980d9d81731b2bf545c5070290
Opcode Fuzzy Hash: cac79e148e5d1637301d0cd401e0a8768c8b40d51dfb76d9d00be79e5a4099f3
Instruction Fuzzy Hash: EDD0C772910128BBDB10DA89DC41DF7775DDB59760F54401AFD0497141C1B4EC5197F4

Uniqueness

Uniqueness Score: -1.00%

Function 00468C50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E1F0: SetErrorMode.KERNEL32(00008000), ref: 0042E1FA
Part of subcall function 0042E1F0: LoadLibraryA.KERNEL32(00000000,00000000,0042E244,?,00000000,0042E262,?,00008000), ref: 0042E229

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 00468C65

Strings

shell32.dll, xrefs: 00468C5A
SHPathPrepareForWriteA, xrefs: 00468C50

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 508af3c658affefe6038fbba91c66eaedd781a48fc4f31e111b442a49285859a
Instruction ID: f54d236eaa647a004fc156d77ac0774b12b8f86e94465ae50302f3b70839ea38
Opcode Fuzzy Hash: 508af3c658affefe6038fbba91c66eaedd781a48fc4f31e111b442a49285859a
Instruction Fuzzy Hash: FDB092A064271082CE006BB2584271B22149750744B10C57FB040AA295EE7D88044FBE

Uniqueness

Uniqueness Score: -1.00%

Function 00447F60 Relevance: 4.7, APIs: 3, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,0044813D), ref: 00448080
GetProcAddress.KERNEL32(00000000,00000000), ref: 00448101

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: d9787b66ae215e656ee415771d480fc3d32ddb8ef1add214a3308f413d75a1a6
Instruction ID: 5c6eebc632780948e30306f747c70913dfebb380d33768fd88d962b889412947
Opcode Fuzzy Hash: d9787b66ae215e656ee415771d480fc3d32ddb8ef1add214a3308f413d75a1a6
Instruction Fuzzy Hash: CD515170A00105AFDB00EFA5C481AAFB7F9EB54315F10817FE814BB392DB389E458B99

Uniqueness

Uniqueness Score: -1.00%

Function 0047C760 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,0047C898), ref: 0047C830
AppendMenuA.USER32 ref: 0047C841
AppendMenuA.USER32 ref: 0047C859

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: 103ad35a9952b07d56bdb3bad9c34a645578be9cba599f62803875c0b4fd2168
Instruction ID: 938ecdfec97688d9e91313a56ab48558b9b04f1f4dc78c4c1ee95835cae09dfe
Opcode Fuzzy Hash: 103ad35a9952b07d56bdb3bad9c34a645578be9cba599f62803875c0b4fd2168
Instruction Fuzzy Hash: BA31CF307143455AD710FB768CC2B9A3A989B51318F55947FF904AA2D3CA7C9C09C66E

Uniqueness

Uniqueness Score: -1.00%

Function 0044ADC0 Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00000000,00000000,0044AEC1,?,0047D0C7,?,?), ref: 0044AE35
SelectObject.GDI32(?,00000000), ref: 0044AE58
73A1A480.USER32(00000000,?,0044AE98,00000000,0044AE91,?,00000000,?,00000000,00000000,0044AEC1,?,0047D0C7,?,?), ref: 0044AE8B

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: A480A570ObjectSelect
String ID:
API String ID: 1230475511-0
Opcode ID: 91444e5bf131007ac93604d47e6fc7e18e34c23fefa9c833d2c38518ec62aedf
Instruction ID: 233d7bfbdcc25e67ff0a572e229f91d747dfb26028a93c536af8bc2826ebb7c8
Opcode Fuzzy Hash: 91444e5bf131007ac93604d47e6fc7e18e34c23fefa9c833d2c38518ec62aedf
Instruction Fuzzy Hash: D721B570E84208AFEB01DFA5C841B9F7BB9DB48304F51847AF504A6281C77C9950CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0044AAF4 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044AB80,?,0047D0C7,?,?), ref: 0044AB52
DrawTextW.USER32 ref: 0044AB65
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044AB99

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID:
API String ID: 65125430-0
Opcode ID: 145cb60817e1461b02aba970f6a399deb92e78d362c3eca44f3c4fb02434d21d
Instruction ID: de988064b5c118741e346c03ff1e8b17db840b4da88b1af59de34c2d8924ec6d
Opcode Fuzzy Hash: 145cb60817e1461b02aba970f6a399deb92e78d362c3eca44f3c4fb02434d21d
Instruction Fuzzy Hash: D811E6B27446447FE711DAAA8C81D6FB7EDDB88724F10413AF604E7280C6389E018669

Uniqueness

Uniqueness Score: -1.00%

Function 00490208 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0048FCB4: 73A1A570.USER32(00000000,?,?,00000000), ref: 0048FCC5
Part of subcall function 0048FCB4: SelectObject.GDI32(00000000,00000000), ref: 0048FCE7
Part of subcall function 0048FCB4: GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,0049023D), ref: 0048FCFB
Part of subcall function 0048FCB4: GetTextMetricsA.GDI32 ref: 0048FD1D
Part of subcall function 0048FCB4: 73A1A480.USER32(00000000,00000000,0048FD47,00000000,00000000,0048FD40,?,00000000,?,?,00000000), ref: 0048FD3A

MulDiv.KERNEL32(?,?,00000006), ref: 0049027F
MulDiv.KERNEL32(?,?,0000000D,?,?,00000006), ref: 00490294
KiUserCallbackDispatcher.NTDLL(00000000,00000000,?,?,0000000D,?,?,00000006), ref: 004902B7

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Text$A480A570CallbackDispatcherExtentMetricsObjectPointSelectUser
String ID:
API String ID: 1158279668-0
Opcode ID: 0a58dfecc0c05991834722710fd2e1cc276720da4a3164d7b389e94d1647d906
Instruction ID: c58e8240d52276653bbf13066d109a456b274f974c315304747d466714c2a07e
Opcode Fuzzy Hash: 0a58dfecc0c05991834722710fd2e1cc276720da4a3164d7b389e94d1647d906
Instruction Fuzzy Hash: B221D8713102009FDB40EF69C8C5AAA77A5EB89314F1445B9FD08CF39ADB25EC088BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042436C Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424382
TranslateMessage.USER32(?), ref: 004243FF
DispatchMessageA.USER32 ref: 00424409

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 4c72fe453077d3d5441811771d3c73f57da1beb0f02e586e781598996b195a0c
Instruction ID: aef1b0206ccdbb2aa8587e86ea6dacd49c82d9c27d6d10fa8c02d352bba97142
Opcode Fuzzy Hash: 4c72fe453077d3d5441811771d3c73f57da1beb0f02e586e781598996b195a0c
Instruction Fuzzy Hash: 6F11543030432056DA20E665A94179B73D4DFC1B44F80886EF9DD97382D77D9D4987AA

Uniqueness

Uniqueness Score: -1.00%

Function 004165B4 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 004165DA
SetPropA.USER32(00000000,00000000), ref: 004165EF
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 00416616

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 1283a2ba918a1a05b7609b6f7b848b7b983b1697ade3d6b61c1960e914505d94
Instruction ID: 49560f5f00ee2c9135054c0b38937f4b9f373f0e35015079742173c5fde362c9
Opcode Fuzzy Hash: 1283a2ba918a1a05b7609b6f7b848b7b983b1697ade3d6b61c1960e914505d94
Instruction Fuzzy Hash: C3F0BD71701220BBEB10AB599C85FA632DCAB09715F16057ABE09EF286C778DC44C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 004014E4 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Strings

@dI, xrefs: 00401522

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: @dI
API String ID: 2087232378-2169111365
Opcode ID: ac11951010fca1e09d027c43c8ed5b4b578696c80165eb8de0d03b95ec4bb515
Instruction ID: 1d7fc67d8943aca9bd8b7424c3d760102f2274f63a1bf98f742a2cdc6a51162d
Opcode Fuzzy Hash: ac11951010fca1e09d027c43c8ed5b4b578696c80165eb8de0d03b95ec4bb515
Instruction Fuzzy Hash: 28F0A772B0073067EB605A6A4C81F5359C49FC5B94F154076FD0DFF3E9D6B58C0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDC4 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0041EDD4
IsWindowEnabled.USER32 ref: 0041EDDE
EnableWindow.USER32(?,00000000,?,?), ref: 0041EE04

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: f1041f771c00274fafaec7c92c8c7bfa6f382932e423aeab5ff933265dcc9458
Instruction ID: feef2f1e36016e7b5cf4fb144cadbc7ab6d373431457e94ba2eb74728d462d7d
Opcode Fuzzy Hash: f1041f771c00274fafaec7c92c8c7bfa6f382932e423aeab5ff933265dcc9458
Instruction Fuzzy Hash: B9E0E5B41003006BD711AF67DC85E57769CBB94314F568437AD0597793EA3ED8418AB8

Uniqueness

Uniqueness Score: -1.00%

Function 00408544 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040867A), ref: 00408563

Part of subcall function 00406D54: LoadStringA.USER32 ref: 00406D71

Part of subcall function 004084D0: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004964C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Strings

1I, xrefs: 0040857E, 0040858C, 004085A9, 004085B7, 004085FD, 0040860B, 0040862A, 00408638, 0040866C

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID: 1I
API String ID: 1658689577-762079770
Opcode ID: 6e8303e27ed7ddfbf6acd002e5c720f3c58af445dc5c20a44dc96457956c1da1
Instruction ID: 74dcf24fece9135f842d9e2340cbc50c81b3ec91f87ebb2824f4d2ce1649f107
Opcode Fuzzy Hash: 6e8303e27ed7ddfbf6acd002e5c720f3c58af445dc5c20a44dc96457956c1da1
Instruction Fuzzy Hash: E7316375E00109ABCF00EF95C8819EEB7B9FF84314F118577E815BB285E738AE058B98

Uniqueness

Uniqueness Score: -1.00%

Function 0047D0AC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0047D150

Strings

InitializeWizard, xrefs: 0047D0F3

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 0ac9200fd1a332cb51dc6601dd88b091a5f08a4caebfaa3dfffc1198e7f1bbbf
Instruction ID: 27c915d5e84757d1ee1c922a0b45ecd3517ff57706a6a9b1ea1830c72a43ed0f
Opcode Fuzzy Hash: 0ac9200fd1a332cb51dc6601dd88b091a5f08a4caebfaa3dfffc1198e7f1bbbf
Instruction Fuzzy Hash: 9811C2306382009FD710EB29EC82B5A7BF5EB15724F50403BE808872A2DA39AC50CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00477DF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00477E3C

Strings

Failed to remove temporary directory: , xrefs: 00477E55

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: bf8459b4568011569589267856632f7437084f82826b889116ec1ad329c74b80
Instruction ID: f6f29f8194de21b7fd04b1898db3775e9a4ec43a4ec883b7b0c80518b3716d1c
Opcode Fuzzy Hash: bf8459b4568011569589267856632f7437084f82826b889116ec1ad329c74b80
Instruction Fuzzy Hash: 5F01B530218604AADB21EB75DC43B9F37A8DB15708FE188B7F804A6292D77CAD44865C

Uniqueness

Uniqueness Score: -1.00%

Function 004775CC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,00477812,00000000,0047794C), ref: 00477611

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004775E1

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 225175c1cb3e5d3e9e70e9ef9a971fa01c6206b910d71101a0ac37fcff0035a7
Instruction ID: 814c6dcea663d1405d948e9489940348151ed5d62cb49aab8d6aacd0da240b25
Opcode Fuzzy Hash: 225175c1cb3e5d3e9e70e9ef9a971fa01c6206b910d71101a0ac37fcff0035a7
Instruction Fuzzy Hash: C7F0A7317085146BDA00A65E6D42B9FA6DDCB84778F60443BF608EB346DABDDE0243AD

Uniqueness

Uniqueness Score: -1.00%

Function 0046AD6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,00497154,?,0046B06F,?,00000000,0046B4F7,?,_is1), ref: 0046AD8F

Strings

Inno Setup: Setup Version, xrefs: 0046AD8D

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version
API String ID: 3702945584-4166306022
Opcode ID: b5001300976c311ff63bf81daa3498fb24628c1a8b44004d588d325ece062412
Instruction ID: 411328d8211db58a77dae3404ef256999053971fa6961c2aedf3cbf650fcdf7d
Opcode Fuzzy Hash: b5001300976c311ff63bf81daa3498fb24628c1a8b44004d588d325ece062412
Instruction Fuzzy Hash: 7FE06D713016043FD710AA6ADC85F5BBADCDF88365F10403AB908EB392D578DD0085A9

Uniqueness

Uniqueness Score: -1.00%

Function 00452BE4 Relevance: 3.2, APIs: 2, Instructions: 190fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00452E17,?,00000000,00452E81,?,?,-00000001,00000000,?,00477E51,00000000,00477DA0,00000000), ref: 00452DF3
FindClose.KERNEL32(000000FF,00452E1E,00452E17,?,00000000,00452E81,?,?,-00000001,00000000,?,00477E51,00000000,00477DA0,00000000,00000001), ref: 00452E11

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: b67eff5efbe1f1b3a75b358278fe57666e4309296cd304be60dd772f5e8aa578
Instruction ID: 02b97b2915f0d5af3a60b1074a0ce76f3061349a54ef9b2b3eb99e2ccc93669a
Opcode Fuzzy Hash: b67eff5efbe1f1b3a75b358278fe57666e4309296cd304be60dd772f5e8aa578
Instruction Fuzzy Hash: 9C818C30A0424D9BCB12DF65C9457EFBBB4AF4A305F1480ABE84467392D3789A4ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042DA38 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DB70), ref: 0042DA74
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DB70), ref: 0042DAE4

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fe899f6043c7f770a4508ac600d0d0e70af19fa3b1a52c17f713553a047210da
Instruction ID: de7305fe23da407263f6a21fe748e6d6d926aae016943a7179aec9e2dd5a457b
Opcode Fuzzy Hash: fe899f6043c7f770a4508ac600d0d0e70af19fa3b1a52c17f713553a047210da
Instruction Fuzzy Hash: 4F417171E04129AFDF10DF91D891BAFBBB8EB01704F918466E810B7240D778BE04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042DCF8 Relevance: 3.1, APIs: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OG,?,00000001,?,?,0047E34F,?,00000001,00000000), ref: 0042DC70

RegEnumKeyExA.ADVAPI32 ref: 0042DD8C
RegCloseKey.ADVAPI32(?,0042DDFD,?,00000000,00000000,00000000,00000000,00000000,0042DDF6,?,?,00000008,00000000,00000000,0042DE23), ref: 0042DDF0

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: b395eec5d444746d883dbbe68a26dc186a8be4d3543415a8a9a06ae4829f6fc1
Instruction ID: 4db75c3f0003ee77c81ad7234f2e5e1b513bc4eba3d2eee43a500da64a91fe5e
Opcode Fuzzy Hash: b395eec5d444746d883dbbe68a26dc186a8be4d3543415a8a9a06ae4829f6fc1
Instruction Fuzzy Hash: 4931B270F04649AFDB14DFA6DC52BAFBBB9EB48304F90407BE400F7281D6785A01CA29

Uniqueness

Uniqueness Score: -1.00%

Function 00471EEC Relevance: 3.1, APIs: 2, Instructions: 89timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,00471FE3,?,00000000,00471FF4,?,00000000,0047203D), ref: 00471FB4
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,00471FE3,?,00000000,00471FF4,?,00000000,0047203D), ref: 00471FC8

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: FileTime$Local
String ID:
API String ID: 791338737-0
Opcode ID: 794f3dc64775d537c36396be29bb059d918ede0e47b95337b39c4db572ec4a4f
Instruction ID: 1c2ecd431e7be2e6a04f09c76b7068abadfd7dca7c6163eacf0d26531580d3b4
Opcode Fuzzy Hash: 794f3dc64775d537c36396be29bb059d918ede0e47b95337b39c4db572ec4a4f
Instruction Fuzzy Hash: A8319570A14245AFCB11DFA5C892FAFBBBCEB09704F41857AF904A7391D7799900CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF38 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 0040AF52
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B0AF,00000000,0040B0C7,?,?,?,00000000), ref: 0040AF63

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 495ed283f31991be558d7aaf91bbf96f1b13b17f58e3dd61e94c2b353b9623af
Instruction ID: d0e6d2b3de5701a5b01f0c314f0e154d100cb3f2f79c9d4e2e087994511e300e
Opcode Fuzzy Hash: 495ed283f31991be558d7aaf91bbf96f1b13b17f58e3dd61e94c2b353b9623af
Instruction Fuzzy Hash: 7701F7B1704300AFD700EF69DC92E1A77EDDB897187128076F500EB3D0DA799C119669

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE14 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EE63
73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042E908,?,00000001), ref: 0041EE69

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: A25940CurrentThread
String ID:
API String ID: 2655091166-0
Opcode ID: b328251ae0892c8a3b7f185b32438ae157af80a37aa78e1151a8addd2e42d252
Instruction ID: 6dec67758a4febc774e22da3091525d30ea0c4d8bfc57ce8b44416be19a69247
Opcode Fuzzy Hash: b328251ae0892c8a3b7f185b32438ae157af80a37aa78e1151a8addd2e42d252
Instruction Fuzzy Hash: C3015B74A04704AFD701CFA6EC11956BBE8E789720B22887BE904D37A0EA385811DE18

Uniqueness

Uniqueness Score: -1.00%

Function 0040170C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Strings

@dI, xrefs: 0040173B, 0040177B

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: FreeVirtual
String ID: @dI
API String ID: 1263568516-2169111365
Opcode ID: 09cabece21cf584f7b8116981dfbad3f8653d6c5a4f55eb454a10d9661d4edbc
Instruction ID: dd39995c24d96b1f0cd65365fb3acc738aa13d81c460f04ccbda7f03c85f078f
Opcode Fuzzy Hash: 09cabece21cf584f7b8116981dfbad3f8653d6c5a4f55eb454a10d9661d4edbc
Instruction Fuzzy Hash: 6D01FC766442148FC3109F69DCC0E2677E8D794378F16453EDA85673A1D37A6C018BDC

Uniqueness

Uniqueness Score: -1.00%

Function 00451888 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 004518CA
GetLastError.KERNEL32(00000000,00000000,00000000,004518F0), ref: 004518D2

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 10a17b5f55d8132d355b2be22579e48721c0d02d21db4419b0f25e12a06febb5
Instruction ID: 4a908479c274ede1fa612a67027dcf523005e30280c6ec4e7261d6cc76548501
Opcode Fuzzy Hash: 10a17b5f55d8132d355b2be22579e48721c0d02d21db4419b0f25e12a06febb5
Instruction Fuzzy Hash: B9014971B00304AF9B10FFB99C4259EB7ECDB8832171045BBFC08E3652EA384E048558

Uniqueness

Uniqueness Score: -1.00%

Function 00451378 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004513D7), ref: 004513B1
GetLastError.KERNEL32(00000000,00000000,00000000,004513D7), ref: 004513B9

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7fd9e911900e9a06a0dfd278701c74cc3c46c37c0458817335f085c5dd111093
Instruction ID: 9b23b03b90933790c580962e112c838e42041695dbfb4577ddf6274ef4a18e8c
Opcode Fuzzy Hash: 7fd9e911900e9a06a0dfd278701c74cc3c46c37c0458817335f085c5dd111093
Instruction Fuzzy Hash: 2EF0C871A04708BBEB00EFB5AC516AEB7E8EB09315F5045B7FC04E3A52E6794E148698

Uniqueness

Uniqueness Score: -1.00%

Function 00451510 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,0045156D,?,-00000001,?), ref: 00451547
GetLastError.KERNEL32(00000000,00000000,0045156D,?,-00000001,?), ref: 0045154F

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: cfce4ebf5df12c84a586a0a4f7fa63ec9d1782ec60cdef241106836ee63041f5
Instruction ID: e24a99369ca00d653b3fc93966ede53447ba658949af1692c14fa660c0f258d5
Opcode Fuzzy Hash: cfce4ebf5df12c84a586a0a4f7fa63ec9d1782ec60cdef241106836ee63041f5
Instruction Fuzzy Hash: A6F02871E00308BBCF00EFB59C4259EB3E8DB4831175049B7FC15E3662F6384E048598

Uniqueness

Uniqueness Score: -1.00%

Function 00451A18 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,00451A75,?,-00000001,00000000), ref: 00451A4F
GetLastError.KERNEL32(00000000,00000000,00451A75,?,-00000001,00000000), ref: 00451A57

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 1fa114cdf17c944f9957d25090548f9fef3446c71c16d7dd8eda6bf9a7b6b98b
Instruction ID: a4972dc580858431ea76902efd1aedaa5458d24b8279bd81c51e3053393522ee
Opcode Fuzzy Hash: 1fa114cdf17c944f9957d25090548f9fef3446c71c16d7dd8eda6bf9a7b6b98b
Instruction Fuzzy Hash: 93F0C271A05708AB9B01EFB5AC516AEB3E8EB0831575049B7FC04E3652E7785E048598

Uniqueness

Uniqueness Score: -1.00%

Function 0042E1F0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E1FA
LoadLibraryA.KERNEL32(00000000,00000000,0042E244,?,00000000,0042E262,?,00008000), ref: 0042E229

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 0102d987cd0908c49357e23cdbf7a47517641d04aa5dfc05fc1f8898bd46d34f
Instruction ID: 2bd629673230950b16c4bb4544665cc4d3578012b9e0763c9fae70ecea85f9d4
Opcode Fuzzy Hash: 0102d987cd0908c49357e23cdbf7a47517641d04aa5dfc05fc1f8898bd46d34f
Instruction Fuzzy Hash: 31F08270714744FEDF019F779C6282BBBECE74DB1479249B6F800A2691E63C5810C939

Uniqueness

Uniqueness Score: -1.00%

Function 00450054 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,0046C065,?,00000000), ref: 0045006A
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,0046C065,?,00000000), ref: 00450072

Part of subcall function 0044FE10: GetLastError.KERNEL32(0044FC2C,0044FED2,?,00000000,?,00492588,00000001,00000000,00000002,00000000,004926E9,?,?,00000005,00000000,0049271D), ref: 0044FE13

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: f7b6d91780900016932261e5b31036d83abc2770e31421f62e2bd79437fa69ba
Instruction ID: 619d70630f7d728e19568b0c26e44efacd411b086580920acadf97a9c9154113
Opcode Fuzzy Hash: f7b6d91780900016932261e5b31036d83abc2770e31421f62e2bd79437fa69ba
Instruction Fuzzy Hash: F9E012B53042016BEB10EAA5A9C1F3B23DCEF44715F10447EB944CF183D674CC054B69

Uniqueness

Uniqueness Score: -1.00%

Function 00478F74 Relevance: 1.6, APIs: 1, Instructions: 128windowCOMMON

Download Yara Rule

APIs

SendNotifyMessageA.USER32(000104C2,00000496,00002711,00000000), ref: 0047912C

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: MessageNotifySend
String ID:
API String ID: 3556456075-0
Opcode ID: 1bf78a2a4972fbb2a73e3495687c09ee27ad1c961f8a5cc689fdc3f33d66a45c
Instruction ID: 7d22008d7a83e2500ddd5853d1c98629ae082a9ef6797e0e4edc72868eccde80
Opcode Fuzzy Hash: 1bf78a2a4972fbb2a73e3495687c09ee27ad1c961f8a5cc689fdc3f33d66a45c
Instruction Fuzzy Hash: 884142343240009BCB10FF26D88598A7BA5EB50309B65C5BBB8049F3A7CA3DDD46DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0046A1C4 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

756FE550.OLE32(00494B14,00000000,00000001,00494B24,00497054), ref: 0046A2B9

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: E550
String ID:
API String ID: 734438002-0
Opcode ID: 1a96fdbb3e90de8797b7c34e8fd7761ef28502cc93813c311678e4427fcc9a8f
Instruction ID: 28ea0cda059d87ed8d6f055d3f11cf2141d1ab261bbca5563b99c48b31e217e3
Opcode Fuzzy Hash: 1a96fdbb3e90de8797b7c34e8fd7761ef28502cc93813c311678e4427fcc9a8f
Instruction Fuzzy Hash: 1731BC303686008FD750DB19D895B6A73E1EB95314F6082BBF8489B3A1E779EC41CB4E

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB0C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32 ref: 0041FBA9

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: 50e1310ba0544b59a0555e2be0f3aefd4cf1699031129a7841ddf0d9dd467a2f
Instruction ID: 884c2cb002146e47c45dd1875db58eae66db6a4caaf859e9ca4b80fd75174b4c
Opcode Fuzzy Hash: 50e1310ba0544b59a0555e2be0f3aefd4cf1699031129a7841ddf0d9dd467a2f
Instruction Fuzzy Hash: DD2130716087456FC340DF39D840696BBE4BB48344F148A3EA098C3341D774E99ACBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00468368 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EE14: GetCurrentThreadId.KERNEL32 ref: 0041EE63
Part of subcall function 0041EE14: 73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042E908,?,00000001), ref: 0041EE69

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,004683C6,?,00000000,?,?,004685D3,?,00000000,00468612), ref: 004683AA

Part of subcall function 0041EEC8: IsWindow.USER32 ref: 0041EED6
Part of subcall function 0041EEC8: EnableWindow.USER32(8BF0EBFF,00000001,8BF0EBFF,00000000,00000000,0042ED84,0042ED95,00000000,0042EDE3,?,00000000,0042EE02,?,00000000,?), ref: 0041EEE5

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Window$A25940CurrentEnablePathPrepareThreadWrite
String ID:
API String ID: 390483697-0
Opcode ID: 467ce9893c8a2b941d671877d34955771c88eccab2483bb784be52c54abd03e3
Instruction ID: 1e6c9ee491f26ebb38a393fd70065da3d13cda2054ea28a361ce8fb2712a9f85
Opcode Fuzzy Hash: 467ce9893c8a2b941d671877d34955771c88eccab2483bb784be52c54abd03e3
Instruction Fuzzy Hash: F0F0E9B1258300BFE7159B72EC56B1677E8E314B15F51447FF804C66D0EA7A5890C62D

Uniqueness

Uniqueness Score: -1.00%

Function 004164C0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 004164F5

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cdcc0148ce654954751abbafc01dffb42bdee5d1888213000ee0bb92e9214fa3
Instruction ID: a44329a4cc8b06b024a2b0eee2fd8d89e642962040674eee811c3e7967e458ca
Opcode Fuzzy Hash: cdcc0148ce654954751abbafc01dffb42bdee5d1888213000ee0bb92e9214fa3
Instruction Fuzzy Hash: F5F025B2200510AFDB84CF9CD9C0F9373ECEB0C210B0981A6FA08CF24AD220EC108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00414924 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 0041495F

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0042CBA8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CBF0,?,00000001,?,?,00000000,?,0042CC42,00000000,0045162D,00000000,0045164E,?,00000000), ref: 0042CBD3

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fb728ae1967c572744be537d183b1c2397660519459ab9e6793d4da77068addf
Instruction ID: dfed850972a7f4cfed0b3d6ce6ead54829112a593105f6481b619d55be1254e6
Opcode Fuzzy Hash: fb728ae1967c572744be537d183b1c2397660519459ab9e6793d4da77068addf
Instruction Fuzzy Hash: 1AE06571304708BFD701EB62AC93E5EBBACD745714B914876B400A7651D5B8AE00845C

Uniqueness

Uniqueness Score: -1.00%

Function 0044FF20 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0044FF60

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a92cf0aa8bb23f57ccdc9442b6704fbd4576b7ac5b6e0326e42d432a692528ee
Instruction ID: 45ed5e217c844315310d89a20c49d2eff003bfa8467b370b0955f01a950c20be
Opcode Fuzzy Hash: a92cf0aa8bb23f57ccdc9442b6704fbd4576b7ac5b6e0326e42d432a692528ee
Instruction Fuzzy Hash: 39E0EDA53541583ED240AABCBC52F9767DC9759754F008033B998D7241D4619A158BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042E670 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451E7B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E68F

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 860b655ccada46b5013a8742cf2038536e52ba062f8b3e277fa769ce81e13b95
Instruction ID: 7c82c80d86496392c3130c3e7de8882f0dfcc9e316fc406f93a4df2216b263d5
Opcode Fuzzy Hash: 860b655ccada46b5013a8742cf2038536e52ba062f8b3e277fa769ce81e13b95
Instruction Fuzzy Hash: 21E026617843112AF23514567C83B7F1A4E83C0B04FE4842B7B00DE3C3DAAEAD09429E

Uniqueness

Uniqueness Score: -1.00%

Function 00406300 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,004235EC,00000000,94CA0000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00423B7C), ref: 00406329

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 1d12608fc0467a25e6c73015cc4d191371d7057fe5102c86e19c90aa3d4ae925
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: 4CE002B2204309BFDB00DE8ADDC1DABB7ACFB4C654F844105BB1C972428275AD608BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC1C Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC48

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4676b834bccda8ccd94f8a4f379db04665fbdc7bc7b85aab9c145464b6c6dbba
Instruction ID: 5aa87c08ff8936fcaaa84cf50ff31e6a06e3de0a8084b04fc6442f63f77fe161
Opcode Fuzzy Hash: 4676b834bccda8ccd94f8a4f379db04665fbdc7bc7b85aab9c145464b6c6dbba
Instruction Fuzzy Hash: BDE07EB2600129AF9B40DE8DDC81EEB37ADAB1D350F404016FA08D7200C2B4EC519BB4

Uniqueness

Uniqueness Score: -1.00%

Function 004536BC Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0046C888,00000000,0046D681,?,00000000,0046D6CA,?,00000000,0046D803,?,00000000,?,00000000), ref: 004536D2

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 8472c99a5b5b7a8847d94f813ec6a5622d7e46ea19eae33011c13bad8a3fe9e5
Instruction ID: eca53ef0c4505d94b6e963a585f564cfd6265b0c9c03d819447d58a966c2af15
Opcode Fuzzy Hash: 8472c99a5b5b7a8847d94f813ec6a5622d7e46ea19eae33011c13bad8a3fe9e5
Instruction Fuzzy Hash: 49E065705047004BCB24DF3A848121A7AD15F84321F08C56AAC58CB396E63DC4199616

Uniqueness

Uniqueness Score: -1.00%

Function 004145EC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00490192,?,004901B4,?,?,00000000,00490192,?,?), ref: 0041460B

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00406E78 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406E8C

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a86332fa630e211a890a26f820a456cfae7ee7da2a92b38f798d74d6102b1500
Instruction ID: 5e9ef0cb41ef517b54198f539e7e4457f1ce254f1207c5e451c0fee893fabf4d
Opcode Fuzzy Hash: a86332fa630e211a890a26f820a456cfae7ee7da2a92b38f798d74d6102b1500
Instruction Fuzzy Hash: 3DD05B763082107AD620A55BAC44DA76BDCCFC5770F11063EB558C71C1D6309C01C675

Uniqueness

Uniqueness Score: -1.00%

Function 004235BC Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423568: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042357D

ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000), ref: 004235D7

Part of subcall function 00423598: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 004235B4

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 05b12f49588f72d468172bd8f1b82f2cb8bfea04f415fe28581d7e625a87d56b
Instruction ID: 6e8deb3ed7ffb4c54c7bf11bddd21d475954711d807402a63cfbe74293682e9f
Opcode Fuzzy Hash: 05b12f49588f72d468172bd8f1b82f2cb8bfea04f415fe28581d7e625a87d56b
Instruction Fuzzy Hash: 03D05E123812743102107ABB280998B42A84D862AB388043BB54CDB202E91E8A81A1AC

Uniqueness

Uniqueness Score: -1.00%

Function 00424234 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 0042424C

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: c34688b727229efcedc1f2997f44e421d28f5fd8d0fc977b3f59e8ef08dab085
Instruction ID: a3b20f4c882213fa23ff33249cd178fa67041ba6f44abe22b1f00704e939aabb
Opcode Fuzzy Hash: c34688b727229efcedc1f2997f44e421d28f5fd8d0fc977b3f59e8ef08dab085
Instruction Fuzzy Hash: 4CD05EE27011702BCB01BBED54C4AC667CC8B8829AB1940BBF918EF257C638CE448398

Uniqueness

Uniqueness Score: -1.00%

Function 00453F88 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32 ref: 00453F9E

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: e5c4147ce8d30c90c427c53b97d0de2aa7d796d22412cffb07543fa3924af9c1
Instruction ID: 1680b636b72d7d7da35d26ad3489112d7b5719c0f4c6eb10b1da13dd6a5c5f2b
Opcode Fuzzy Hash: e5c4147ce8d30c90c427c53b97d0de2aa7d796d22412cffb07543fa3924af9c1
Instruction Fuzzy Hash: CAD0C2B260420053C300AEA9AC82697769C8B84316F10483F7C85CA3C3E67CDB4C569A

Uniqueness

Uniqueness Score: -1.00%

Function 0042CC48 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0045185D,00000000,00451876,?,-00000001,00000000), ref: 0042CC53

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 82f5dea6b02cc0f726bbe4c909810c4d52a47932f104f8a95c7157b85414663c
Instruction ID: fb3bcb19fe042810799c60ac9426d807c03ae468120a660d59a80632ebfc0af6
Opcode Fuzzy Hash: 82f5dea6b02cc0f726bbe4c909810c4d52a47932f104f8a95c7157b85414663c
Instruction Fuzzy Hash: 04D012D030121015DA1475BF2ACD75F42884FA5735BB41B37B96DE23E2D23D8956101C

Uniqueness

Uniqueness Score: -1.00%

Function 0042CC00 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00450CD7,00000000), ref: 0042CC0B

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 696c079d1e659a807bafa968d47e5a3e4cea9be412662ea6c9d5bc89f686c2e0
Instruction ID: 3d474633da5dc292dd1e9b08acfa0ea7ef8e6560f0837aa6ac70ccb6d2902417
Opcode Fuzzy Hash: 696c079d1e659a807bafa968d47e5a3e4cea9be412662ea6c9d5bc89f686c2e0
Instruction Fuzzy Hash: 42C08CE03022001A9A1465BF2CC511F42C8891827A3A41F37F53CE32D2D27E88A72428

Uniqueness

Uniqueness Score: -1.00%

Function 00406E28 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A834,0040CDE0,?,00000000,?), ref: 00406E45

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4583f237df22b439ee34a1a79ec62ce4162a2c4c0b032f6043df3341da82d5c7
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: 4583f237df22b439ee34a1a79ec62ce4162a2c4c0b032f6043df3341da82d5c7
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Uniqueness

Uniqueness Score: -1.00%

Function 00450088 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045AA1E,00000000,0045ABA9,?,00000000,00000002,00000002), ref: 0045008F

Part of subcall function 0044FE10: GetLastError.KERNEL32(0044FC2C,0044FED2,?,00000000,?,00492588,00000001,00000000,00000002,00000000,004926E9,?,?,00000005,00000000,0049271D), ref: 0044FE13

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 857a2ef5c33fcabe859aa2781a1519cd0b5291b8658590954683ea0b80d8510a
Instruction ID: 5fd336f37560a3562a1f9a64c462d12011a30875c45227d907a3aa1d5a9b5e2e
Opcode Fuzzy Hash: 857a2ef5c33fcabe859aa2781a1519cd0b5291b8658590954683ea0b80d8510a
Instruction Fuzzy Hash: 35C04C65300110479F00A6BE95C1A1763D95F083063104866BA04CF257D669D8544A18

Uniqueness

Uniqueness Score: -1.00%

Function 00406EB8 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00496628,00492DAD,00000000,00492E02,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d6272d179bacf2974813569cb343044e053bf0796cd1d1d4bd728cfe90bb8503
Instruction ID: f501027f96a9746725af0604134d36a8ca8c314a7ca2a7be08ed73c27bcd633e
Opcode Fuzzy Hash: d6272d179bacf2974813569cb343044e053bf0796cd1d1d4bd728cfe90bb8503
Instruction Fuzzy Hash: 97B012E13D220A2ACE0079FE4CC191700CC462C6163405A3A3406EB1C3D93CC4180414

Uniqueness

Uniqueness Score: -1.00%

Function 00407210 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,00492516,00000000,004926E9,?,?,00000005,00000000,0049271D,?,?,00000000), ref: 0040721B

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 116f646fca034a371e6a5c157b9d4efecc0deabf7e2bcd6bcee3aaaef58023bf
Instruction ID: c18bf430a4858a09d5fd0626d157798880aaaa8ea81a5298b6cf69089c3012d4
Opcode Fuzzy Hash: 116f646fca034a371e6a5c157b9d4efecc0deabf7e2bcd6bcee3aaaef58023bf
Instruction Fuzzy Hash: B0B012E03D161B27CA0079FE4CC191A01CC46292163501B3A3006E71C3D83CC8080514

Uniqueness

Uniqueness Score: -1.00%

Function 00478120 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,0047C512), ref: 00478136

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: a0733d547ba9a615f27e584c0e25f3c3f3139aaaff4c722c948ff892e8f0bc14
Instruction ID: 51a0f791e75373d49b6d83255c8d5b34eb3325c5235352f17ae16dccff1f23d7
Opcode Fuzzy Hash: a0733d547ba9a615f27e584c0e25f3c3f3139aaaff4c722c948ff892e8f0bc14
Instruction Fuzzy Hash: D5C0EAB15292208AC740FB78AC08A523AE4B738289B048D7BA018C6272E7788541CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042E24B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E269), ref: 0042E25C

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 7fad5ebe009d69c2099675b3e000f1c062c351dec5b4fb3cd432c824ae70c241
Instruction ID: b0804e078831a813d9aa2463563e291fc03c9a68ee142e2bda9a21ea894dad8b
Opcode Fuzzy Hash: 7fad5ebe009d69c2099675b3e000f1c062c351dec5b4fb3cd432c824ae70c241
Instruction Fuzzy Hash: AFB09B7670C600DDB709D6D6745552D63D8D7C47207E145B7F001D2580D93C58004928

Uniqueness

Uniqueness Score: -1.00%

Function 0047C750 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32 ref: 0047C758

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 41015414dba2ff1d0e6d752f554a6d68b3b381526d9b140a726a6fabede97f01
Instruction ID: 99d67813a2b21335afc3d4281e01727494b67aba3c321737ecd4854f4d206f17
Opcode Fuzzy Hash: 41015414dba2ff1d0e6d752f554a6d68b3b381526d9b140a726a6fabede97f01
Instruction Fuzzy Hash: 5EA002343D530570F470A2514D03F5400001744F15EE1405573093D0C304D92428201E

Uniqueness

Uniqueness Score: -1.00%

Function 0041655C Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

73A25CF0.USER32(?), ref: 00416563

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15102f7382d34fed751781a5022c55e4c44b9a191595ad2a6c0bef55f1a25186
Instruction ID: 444a78761fbc6a727879d8c4239369b0bde5fc0390465f01f64749401816922a
Opcode Fuzzy Hash: 15102f7382d34fed751781a5022c55e4c44b9a191595ad2a6c0bef55f1a25186
Instruction Fuzzy Hash: CDA002756015049ADE04A7A5C849F662298BB44204FC915F971449B092C53C99008E58

Uniqueness

Uniqueness Score: -1.00%

Function 0044815C Relevance: 1.4, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53dbbbcef3efc6c6016bd36482d28a465ab9e39cf8f3d5051b360d43b3ab76f9
Instruction ID: d201100ca80ec2f8cbfe3f56f823717f17ab321979d0d2a0415f45e630f29b9c
Opcode Fuzzy Hash: 53dbbbcef3efc6c6016bd36482d28a465ab9e39cf8f3d5051b360d43b3ab76f9
Instruction Fuzzy Hash: CD518674E042459FDB00EFA9C482AAEBBF5EF49704F5041BEE500A7351DB789E41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0045C348 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0045C3D8

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 76fbdefa84b6e6646576d37aa534d5687847a51f5d406797e85eb89dfb11de70
Instruction ID: 7994756c429da8fd341528b1115bd972bbd87915911d1c28c7d9b705713d9cd5
Opcode Fuzzy Hash: 76fbdefa84b6e6646576d37aa534d5687847a51f5d406797e85eb89dfb11de70
Instruction Fuzzy Hash: 641163716043089FD700AE55C8C1B4B3795AF8475AF05806AFD589B2C7DB38E848CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F334 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED14,?,004237FF,00423B7C,0041ED14), ref: 0041F352

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fcc5bb2b52a6c868320fd556f825bdddd6823e0008dba192f27ebe0d5c6033d0
Instruction ID: b4617262a153a49870252b9da37c83347ffd54b91452f412ea0f349906787434
Opcode Fuzzy Hash: fcc5bb2b52a6c868320fd556f825bdddd6823e0008dba192f27ebe0d5c6033d0
Instruction Fuzzy Hash: 361118742407099BC710DF59D881B86FBE5EB983A0B10C53BED688B385D378E945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00451BCC Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00451C35), ref: 00451C17

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ab3637484c69f1e3a9289275503d70efe7f0fad7bd619f5ef2b617ba719f0b94
Instruction ID: 9b046278fcf2f54c8895181bb84fa4e67d3ca0abe95595291a9aaadc5344c142
Opcode Fuzzy Hash: ab3637484c69f1e3a9289275503d70efe7f0fad7bd619f5ef2b617ba719f0b94
Instruction Fuzzy Hash: 7B017036604248AF8B11DF69AC105EEF7E8EB4932072082B7FC64C3352D7754D05D694

Uniqueness

Uniqueness Score: -1.00%

Function 0045C2F0 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,0045C3CE), ref: 0045C307

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1db0cbd719025b65296d728f72a94704870e37dd70070be8469bdcaf82232f5c
Instruction ID: 3bb3114e2640d79ee9d1f6c6c170ec04299b672b50bb43f7844af23f30410e64
Opcode Fuzzy Hash: 1db0cbd719025b65296d728f72a94704870e37dd70070be8469bdcaf82232f5c
Instruction Fuzzy Hash: 6CD0E9B17557045FDF90EE798CC1B0237D8BB48741F5044666D04DB286E674E8048A18

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0047E0A8 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 0047E0E6
GetWindowLongA.USER32(00000000,000000F0), ref: 0047E104
ShowWindow.USER32(00000000,00000005,00000000,000000F0,00497030,0047D932,0047D966,00000000,0047D986,?,?,00000001,00497030), ref: 0047E126
ShowWindow.USER32(00000000,00000000,00000000,000000F0,00497030,0047D932,0047D966,00000000,0047D986,?,?,00000001,00497030), ref: 0047E13A

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: f6c937e62bd4f7f33b8cff1129e0ff9e0c9ea1576419266ffb873d417130a402
Instruction ID: c92ae80fdea3dbb9ecd522712915d334841aed4b7b9fd6eda1dbd96f1c302fca
Opcode Fuzzy Hash: f6c937e62bd4f7f33b8cff1129e0ff9e0c9ea1576419266ffb873d417130a402
Instruction Fuzzy Hash: 910171702252509ADB00B776CC46BDB2396AB19344F4486BBF8489B3A3CA7D9C61974C

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0B8 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BFB8: GetObjectA.GDI32 ref: 0041BFC5

GetFocus.USER32 ref: 0041C0D8
73A1A570.USER32(?), ref: 0041C0E4
73A18830.GDI32(?,?,00000000,00000000,0041C163,?,?), ref: 0041C105
73A122A0.GDI32(?,?,?,00000000,00000000,0041C163,?,?), ref: 0041C111
GetDIBits.GDI32 ref: 0041C128
73A18830.GDI32(?,00000000,00000000,0041C16A,00000000,?,?,?,00000000,00000000,0041C163,?,?), ref: 0041C150
73A1A480.USER32(?,?,0041C16A,00000000,?,?,?,00000000,00000000,0041C163,?,?), ref: 0041C15D

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: A18830$A122A480A570BitsFocusObject
String ID:
API String ID: 2231653193-0
Opcode ID: b5ec816d879f7673cf2204928d24ade75243476a1e646848f60b5da6794254d2
Instruction ID: be6d8328aec04e85a436dd0cf8ae2147a44d9b66c6d411dca3268b31211d8f12
Opcode Fuzzy Hash: b5ec816d879f7673cf2204928d24ade75243476a1e646848f60b5da6794254d2
Instruction Fuzzy Hash: B2116A71A40618BFDB10DBA9CC86FAFB7FCEF48700F54446AB514E7281D6789D008B68

Uniqueness

Uniqueness Score: -1.00%

Function 00474088 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00493242), ref: 0047408E
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 0047409B
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 004740AB

Strings

VerifyVersionInfoW, xrefs: 004740A5
VerSetConditionMask, xrefs: 00474095
kernel32.dll, xrefs: 00474089

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 5eed5f223692949adde618fed31680a65b1dac78b626770854a6ad78c0fe1b78
Instruction ID: 0d19a0d9c31f114b981f83037a23f21ddb5836e87f543a540fedd059151603c0
Opcode Fuzzy Hash: 5eed5f223692949adde618fed31680a65b1dac78b626770854a6ad78c0fe1b78
Instruction Fuzzy Hash: B0C0C9E1285780EDAA00A7B11CC29B72548C590B29720813B7148792D2D67C0808CF2C

Uniqueness

Uniqueness Score: -1.00%

Function 004900D0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00490134
OffsetRect.USER32(?,00000000,?), ref: 0049014F
OffsetRect.USER32(?,?,00000000), ref: 00490169
OffsetRect.USER32(?,00000000,?), ref: 00490184

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: d3f66989ff800960b4c0a82a6ffd76303d58a919d7c08028faeb7088e89b5ea7
Instruction ID: 0e3da5e30cc057e3d74a4c16cf1607cb24db427b0c3e95cd5a18fc3dad4c20bc
Opcode Fuzzy Hash: d3f66989ff800960b4c0a82a6ffd76303d58a919d7c08028faeb7088e89b5ea7
Instruction Fuzzy Hash: 52217CB6700201AFD700DE69CC85E6BB7EEEBC4300F14CA2AF694C7249D635ED448796

Uniqueness

Uniqueness Score: -1.00%

Function 00402088 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(00496420), ref: 004020CB

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32 ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(00496420), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,00496420,00000000,00401A82,?,?,0040222E,02110650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32 ref: 00401A7C

Strings

3, xrefs: 00402187, 0040219E

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID: 3
API String ID: 296031713-1842515611
Opcode ID: c9e83c2416c2ed5bf47c5d563a835639b46c609bf4dc24c8581f363c33cd1986
Instruction ID: bee6d1afbc099edcb865eebe2e963010dd73383aa86927e532b05753f0ae9538
Opcode Fuzzy Hash: c9e83c2416c2ed5bf47c5d563a835639b46c609bf4dc24c8581f363c33cd1986
Instruction Fuzzy Hash: EF41C4B2E003119FDB10CFA9DE8521A7BB4F7A9364B16417BD854A77E1D3789841CB4C

Uniqueness

Uniqueness Score: -1.00%

Function 00454060 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 0045407F
Sleep.KERNEL32(?), ref: 0045408F
GetLastError.KERNEL32 ref: 004540A2
GetLastError.KERNEL32 ref: 004540AC

Memory Dump Source

Source File: 00000008.00000002.2096858828.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2096825862.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096929358.0000000000494000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2096967036.0000000000496000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2097003816.00000000004A6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_update_server.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 1cfe8af4b64e0a456bcb337580c2dd6ccf0b1dd65d261ba68195c2c63a229cb4
Instruction ID: 017d81aa95838fcb6bb112513f86caaf4ff52444f8b7b5a451e770b39712fdff
Opcode Fuzzy Hash: 1cfe8af4b64e0a456bcb337580c2dd6ccf0b1dd65d261ba68195c2c63a229cb4
Instruction Fuzzy Hash: B8F0F632A00524578E20A9AE998192F62CDDAC0B6D730052BEF04DF283D439CC854AAE

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EzvizStudioSetups.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Ezviz Studio\AlarmSounds\alarm.wav (copy)

C:\Program Files (x86)\Ezviz Studio\AlarmSounds\is-EA4KH.tmp

C:\Program Files (x86)\Ezviz Studio\AnalyzeData.dll (copy)

C:\Program Files (x86)\Ezviz Studio\AudioIntercom.dll (copy)

C:\Program Files (x86)\Ezviz Studio\AudioRender.dll (copy)

C:\Program Files (x86)\Ezviz Studio\CrashAPI.dll (copy)

C:\Program Files (x86)\Ezviz Studio\CrashReportConfig.ini (copy)

C:\Program Files (x86)\Ezviz Studio\CrashReporter.exe (copy)

C:\Program Files (x86)\Ezviz Studio\D3DCompiler_43.dll (copy)

C:\Program Files (x86)\Ezviz Studio\D3DX9_43.dll (copy)

C:\Program Files (x86)\Ezviz Studio\DeleteSADPNpf.exe (copy)

C:\Program Files (x86)\Ezviz Studio\EagleEyeRender.dll (copy)

C:\Program Files (x86)\Ezviz Studio\EzvizCfgManager.dll (copy)

C:\Program Files (x86)\Ezviz Studio\EzvizDeviceDiscover.dll (copy)

Windows Analysis Report
EzvizStudioSetups.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre